一、問題描述

項目部署在 CentOS 服務(wù)器上。項目偶爾會出現(xiàn)無響應(yīng)的情況，這時理所當(dāng)然要上去用 JDK 相關(guān)命令看看堆棧和GC等信息了。

進(jìn)入 Java 程序所在容器：docekr-compose exec api bash，進(jìn)入到 api 容器的 bash 終端。

jps 打印 Java 進(jìn)程：

# jps
11 wallet-coin-1.0-SNAPSHOT.jar
1758 Jps

嗯，jps 命令還是能正常使用的，api.jar 程序的進(jìn)程號是1。

jmap 命令打印堆棧摘要信息：jmap -heap 11，然而，報錯了！

bash-4.4# jmap  -heap 11
Attaching to process ID 11, please wait...
Error attaching to process: sun.jvm.hotspot.debugger.DebuggerException: Can't attach to the process: ptrace(PTRACE_ATTACH, ..) failed for 11: Operation not permitted
sun.jvm.hotspot.debugger.DebuggerException: sun.jvm.hotspot.debugger.DebuggerException: Can't attach to the process: ptrace(PTRACE_ATTACH, ..) failed for 11: Operation not permitted
	at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal$LinuxDebuggerLocalWorkerThread.execute(LinuxDebuggerLocal.java:163)
	at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal.attach(LinuxDebuggerLocal.java:278)
	at sun.jvm.hotspot.HotSpotAgent.attachDebugger(HotSpotAgent.java:671)
	at sun.jvm.hotspot.HotSpotAgent.setupDebuggerLinux(HotSpotAgent.java:611)
	at sun.jvm.hotspot.HotSpotAgent.setupDebugger(HotSpotAgent.java:337)
	at sun.jvm.hotspot.HotSpotAgent.go(HotSpotAgent.java:304)
	at sun.jvm.hotspot.HotSpotAgent.attach(HotSpotAgent.java:140)
	at sun.jvm.hotspot.tools.Tool.start(Tool.java:185)
	at sun.jvm.hotspot.tools.Tool.execute(Tool.java:118)
	at sun.jvm.hotspot.tools.HeapSummary.main(HeapSummary.java:49)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at sun.tools.jmap.JMap.runTool(JMap.java:201)
	at sun.tools.jmap.JMap.main(JMap.java:130)
Caused by: sun.jvm.hotspot.debugger.DebuggerException: Can't attach to the process: ptrace(PTRACE_ATTACH, ..) failed for 11: Operation not permitted
	at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal.attach0(Native Method)
	at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal.access$100(LinuxDebuggerLocal.java:62)
	at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal$1AttachTask.doit(LinuxDebuggerLocal.java:269)
	at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal$LinuxDebuggerLocalWorkerThread.run(LinuxDebuggerLocal.java:138)

二、解決方案

這其實(shí)不是什么 Bug，而是 Docker 自 1.10 版本開始加入的安全特性。

類似于 jmap 這些 JDK 工具依賴于 Linux 的 PTRACE_ATTACH，而是 Docker 自 1.10 在默認(rèn)的 seccomp 配置文件中禁用了 ptrace。

這篇文章介紹了整個的緣由以及應(yīng)對方法：JVM in Docker and PTRACE_ATTACH

主要提及三種：

2.1 –security-opt seccomp=unconfined

簡單暴力（不推薦），直接關(guān)閉 seccomp 配置。用法：

docker run --security-opt seccomp:unconfined ...

2.2 –cap-add=SYS_PTRACE

使用 --cap-add 明確添加指定功能：

docker run --cap-add=SYS_PTRACE ...

2.3 Docker Compose 的支持

Docker Compose 自 version 1.1.0 (2015-02-25) 起支持 cap_add。官方文檔：cap_add, cap_drop。用法：

docker-compose.yml 改寫后文件內(nèi)容如下（相同內(nèi)容部分就不重復(fù)貼了）：

version: '2'

services:
  mysql:
    ...
  api:
    ...
    cap_add:
      - SYS_PTRACE
      

三、驗(yàn)證

因?yàn)槲沂菃蝹€容器，所以選擇了第二種解決方法，將docker容器關(guān)閉刪除后，在docker容器啟動命令中加入：–cap-add=SYS_PTRACE，容器啟動執(zhí)行jmap -heap 11可以打印服務(wù)gc信息了文章來源地址http://www.zghlxwxcb.cn/news/detail-701562.html

# jmap -heap 11
Attaching to process ID 11, please wait...
Debugger attached successfully.
Server compiler detected.
JVM version is 25.172-b11

using parallel threads in the new generation.
using thread-local object allocation.
Concurrent Mark-Sweep GC

Heap Configuration:
   MinHeapFreeRatio         = 40
   MaxHeapFreeRatio         = 70
   MaxHeapSize              = 1073741824 (1024.0MB)
   NewSize                  = 134217728 (128.0MB)
   MaxNewSize               = 134217728 (128.0MB)
   OldSize                  = 939524096 (896.0MB)
   NewRatio                 = 2
   SurvivorRatio            = 8
   MetaspaceSize            = 134217728 (128.0MB)
   CompressedClassSpaceSize = 125829120 (120.0MB)
   MaxMetaspaceSize         = 134217728 (128.0MB)
   G1HeapRegionSize         = 0 (0.0MB)

Heap Usage:
New Generation (Eden + 1 Survivor Space):
   capacity = 120848384 (115.25MB)
   used     = 61863776 (58.997894287109375MB)
   free     = 58984608 (56.252105712890625MB)
   51.19123148556128% used
Eden Space:
   capacity = 107479040 (102.5MB)
   used     = 57787616 (55.110565185546875MB)
   free     = 49691424 (47.389434814453125MB)
   53.766405059070124% used
From Space:
   capacity = 13369344 (12.75MB)
   used     = 4076160 (3.8873291015625MB)
   free     = 9293184 (8.8626708984375MB)
   30.488855698529413% used
To Space:
   capacity = 13369344 (12.75MB)
   used     = 0 (0.0MB)
   free     = 13369344 (12.75MB)
   0.0% used
concurrent mark-sweep generation:
   capacity = 939524096 (896.0MB)
   used     = 93429680 (89.10148620605469MB)
   free     = 846094416 (806.8985137939453MB)
   9.94436229978289% used

39322 interned Strings occupying 4867000 bytes.

到了這里，關(guān)于Docker 中 jdk8容器里無法使用 JDK 的 jmap 等命令的問題的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！