Azure / Azure/azure-linux-extensions
ADE: can't start data disk encryption with Docker service running
- Dominant language
- Python
- Stars
- 333
- Forks
- 278
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 4
Description
I just wasted the whole day trying to get a clue of the logs and issues reported here.
Seems like ADE extension doesn't like docker machine weird mount points. Colleague shared a general the idea about it being a problem but unfortunately couldn't remember where it was learned from.
This was the only hint in `/var/log/azure/Microsoft.Azure.Security.AzureDiskEncryptionForLinux/extension.log`:
```
2019/01/04 21:53:07 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 14785: [Info] WARNING: unsupported mount scheme [/var/lib/docker/aufs /var/lib/docker/aufs/mnt/80b087750b169f4acd6ed1f47234f0d9b7133d19]
2019/01/04 21:53:07 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 14785: [Info] WARNING: unsupported mount scheme [/var/lib/docker/aufs /var/lib/docker/aufs/mnt/d22a3c25430865fc681592402635588c6fad0494]
...
2019/01/04 21:53:07 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 14785: [Info] PRECHECK: Unsupported mount scheme detected
2019/01/04 21:53:07 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 14785: [Info] PRECHECK: Precheck failure, incompatible environment suspected
2019/01/04 21:53:07 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 14785: [Info] handle.py found enable encryption operation
2019/01/04 21:53:07 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 14785: [Info] Config did not change or first call, enabling encryption
```
Environment: D2s_v3 VM based on a standard Ubuntu Server 16.04 image.
+ Installed docker.io package:
```
Client:
Version: 17.03.2-ce
API version: 1.27
Go version: go1.6.2
Git commit: f5ec1e2
Built: Thu Jul 5 23:07:48 2018
OS/Arch: linux/amd64
```
To workaround the issue I had to `systemctl disable docker.service` and `reboot` the VM.
After that standard Azure encryption process has started the job.
Also according to [EJarvi's post](https://blogs.msdn.microsoft.com/ejarvi/2018/03/30/encrypting-data-disks-on-linux-with-azure-disk-encryption/) ADE requires some time to unlock and mount the encrypted so I set 90s startup delay in `/lib/systemd/system/docker.service`, added this line in `[Service]` section:
```
ExecStartPre=-/bin/sleep 90
```
I believe it should easy to detect docker machine on the VM and point to some doc article.
Hope this report will same a time to another guy like me.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing the reported entries in /var/log/azure/Microsoft.Azure.Security.AzureDiskEncryptionForLinux/extension.log and the Docker startup configuration in /lib/systemd/system/docker.service. Reproduce the precheck failure with docker.service running on Ubuntu 16.04, then establish whether detection or documentation is required; done means the Docker/ADE behavior and workaround are clearly defined.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, docker, python, ubuntu
- Domain
- cloud, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100