Azure / Azure/azure-linux-extensions

ADE: can't start data disk encryption with Docker service running

Open
#713 0 comments 0 reactions 0 assignees View on GitHub
extensions/VMEncryption
Dominant language
Python
Stars
333
Forks
278
Avg merge
2d 9h
Merged PRs (30d)
4

Description

I just wasted the whole day trying to get a clue of the logs and issues reported here.

Seems like ADE extension doesn't like docker machine weird mount points. Colleague shared a general the idea about it being a problem but unfortunately couldn't remember where it was learned from.

This was the only hint in `/var/log/azure/Microsoft.Azure.Security.AzureDiskEncryptionForLinux/extension.log`:
```
2019/01/04 21:53:07 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 14785: [Info] WARNING: unsupported mount scheme [/var/lib/docker/aufs /var/lib/docker/aufs/mnt/80b087750b169f4acd6ed1f47234f0d9b7133d19]
2019/01/04 21:53:07 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 14785: [Info] WARNING: unsupported mount scheme [/var/lib/docker/aufs /var/lib/docker/aufs/mnt/d22a3c25430865fc681592402635588c6fad0494]
...
2019/01/04 21:53:07 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 14785: [Info] PRECHECK: Unsupported mount scheme detected
2019/01/04 21:53:07 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 14785: [Info] PRECHECK: Precheck failure, incompatible environment suspected
2019/01/04 21:53:07 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 14785: [Info] handle.py found enable encryption operation
2019/01/04 21:53:07 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 14785: [Info] Config did not change or first call, enabling encryption
```

Environment: D2s_v3 VM based on a standard Ubuntu Server 16.04 image.
+ Installed docker.io package:
```
Client:
Version: 17.03.2-ce
API version: 1.27
Go version: go1.6.2
Git commit: f5ec1e2
Built: Thu Jul 5 23:07:48 2018
OS/Arch: linux/amd64
```

To workaround the issue I had to `systemctl disable docker.service` and `reboot` the VM.
After that standard Azure encryption process has started the job.
Also according to [EJarvi's post](https://blogs.msdn.microsoft.com/ejarvi/2018/03/30/encrypting-data-disks-on-linux-with-azure-disk-encryption/) ADE requires some time to unlock and mount the encrypted so I set 90s startup delay in `/lib/systemd/system/docker.service`, added this line in `[Service]` section:
```
ExecStartPre=-/bin/sleep 90
```
I believe it should easy to detect docker machine on the VM and point to some doc article.
Hope this report will same a time to another guy like me.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the reported entries in /var/log/azure/Microsoft.Azure.Security.AzureDiskEncryptionForLinux/extension.log and the Docker startup configuration in /lib/systemd/system/docker.service. Reproduce the precheck failure with docker.service running on Ubuntu 16.04, then establish whether detection or documentation is required; done means the Docker/ADE behavior and workaround are clearly defined.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, docker, python, ubuntu
Domain
cloud, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.