How to solve the problem of JVM parameters running in docker

This article mainly explains "how to solve the problem of JVM parameters running in docker". The content of the explanation is simple and clear, and it is easy to learn and understand. Please follow the editor's train of thought to study and learn how to solve the problem of JVM parameters running in docker.

Method 1. Jcmd command:

1. Jps gets the thread id of java

2. Jcmd pidVM.flags acquisition

51152:

XX:CICompilerCount=3-XX:InitialHeapSize=526385152-XX:MaxHeapSize=1073741824-XX:MaxNewSize=357564416-XX:MinHeapDeltaBytes=524288-XX:NewSize=175112192-XX:OldSize=351272960-XX:+UseCompressedClassPointers-XX:+UseCompressedOops-XX:+UseParallelGC?

However, the results of the above command query are incomplete.

Method 2. Jinfo command:

Jinfo-flag pid

An error is reported after using this command in docker:

Attaching to process ID 1, please wait...

Error attaching to process: sun.jvm.hotspot.debugger.DebuggerException: Can't attach to the process: ptrace (PTRACE_ATTACH.) Failed for 1: Operation not permitted

Sun.jvm.hotspot.debugger.DebuggerException: sun.jvm.hotspot.debugger.DebuggerException: Can't attach to the process: ptrace (PTRACE_ATTACH.) Failed for 1: Operation not permitted

At sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal$LinuxDebuggerLocalWorkerThread.execute (LinuxDebuggerLocal.java:163)

At sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal.attach (LinuxDebuggerLocal.java:278)

At sun.jvm.hotspot.HotSpotAgent.attachDebugger (HotSpotAgent.java:671)

At sun.jvm.hotspot.HotSpotAgent.setupDebuggerLinux (HotSpotAgent.java:611)

At sun.jvm.hotspot.HotSpotAgent.setupDebugger (HotSpotAgent.java:337)

At sun.jvm.hotspot.HotSpotAgent.go (HotSpotAgent.java:304)

At sun.jvm.hotspot.HotSpotAgent.attach (HotSpotAgent.java:140)

At sun.jvm.hotspot.tools.Tool.start (Tool.java:185)

At sun.jvm.hotspot.tools.Tool.execute (Tool.java:118)

At sun.jvm.hotspot.tools.JInfo.main (JInfo.java:138)

At sun.reflect.NativeMethodAccessorImpl.invoke0 (NativeMethod)

At sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)

At sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)

At java.lang.reflect.Method.invoke (Method.java:498)

At sun.tools.jinfo.JInfo.runTool (JInfo.java:108)

At sun.tools.jinfo.JInfo.main (JInfo.java:76)

Caused by: sun.jvm.hotspot.debugger.DebuggerException: Can't attach to the process: ptrace (PTRACE_ATTACH.) Failed for 1: Operation not permitted

At sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal.attach0 (Native Method)

At sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal.access$100 (LinuxDebuggerLocal.java:62)

At sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal$1AttachTask.doit (LinuxDebuggerLocal.java:269)

At sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal$LinuxDebuggerLocalWorkerThread.run (LinuxDebuggerLocal.java:138)

Solution:

This is not really a Bug, but a security feature that Docker has added since version 1.10.

JDK tools like jmap rely on Linux's PTRACE_ATTACH, but Docker has disabled ptrace in the default seccomp configuration file since 1.10.

This article introduces the whole reason and how to deal with it: JVM in Docker and PTRACE_ATTACH

There are three main categories mentioned:

1.1-security-opt seccomp=unconfined

Simple violence (not recommended), turn off seccomp configuration directly. Usage:

Docker run-- security-opt seccomp:unconfined...

1.2-cap-add=SYS_PTRACE

Use-- cap-add to explicitly add the specified function:

Docker run-- cap-add=SYS_PTRACE...

1.3 support for Docker Compose

Docker Compose has supported cap_add since version 1.1.0 (2015-02-25). Official documents: cap_add, cap_drop. Usage:

After the previous docker-compose.yml is rewritten, the contents of the file are as follows (the same content will not be re-posted):

Version: '2'services: mysql:... api:... cap_add:-SYS_PTRACE

Use the command after resolving the problem:

Attaching to process ID 1, please wait...Debugger attached successfully.Server compiler detected.JVM version is 25.202-b08Non-default VM flags:-XX:CICompilerCount=3-XX:InitialHeapSize=262144000-XX:MaxHeapSize=268435456-XX:MaxNewSize=89128960-XX:MinHeapDeltaBytes=524288-XX:NewSize=87031808-XX:OldSize=175112192-XX:ThreadStackSize=256-XX:+UseCompressedClassPointers-XX:+UseCompressedOops-XX:+UseParallelGC Command line:-Dlog4j2.formatMsgNoLookups=true-Xmx256m-Xss256k-Djava.security.egd=file:/dev/./urandom Thank you for reading The above is the content of "how to solve the problem of JVM parameters running in docker". After the study of this article, I believe you have a deeper understanding of how to solve the problem of JVM parameters running in docker, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!