Felsöka vanliga problem med konfidentiella containrar

Den här artikeln innehåller lösningar på vanliga problem med konfidentiella containrar på Azure Container Instances.

Vanliga problem

Du kan få följande problem och fel när du distribuerar konfidentiella containrar:

• Principfel:

  Deployment Failed.
  ErrorMessage=failed to create containerd task: failed to create shim task:
  uvm::Policy: failed to modify utility VM configuration: guest modify: guest RPC failure:
  error creating Rego policy: rego compilation failed: rego compilation failed: 4 errors occurred:
  

  Deployment Failed.
  ErrorMessage=failed to create containerd task: failed to create shim task:
  uvm::Policy: failed to modify utility VM configuration: guest modify:guest RPC failure:
  error creating Rego policy: rego compilation failed: rego compilation failed: 1 error occurred:
  policy.rego:48 rego_parse_error: non-terminated string;
  

  Container creation denied due to policy: create_container not allowed by policy. 
  Errors: [invalid command].
  

  Denied by policy: rule for mount_device is missing from policy: unknown.
  

  Failed to create containerd task: failed to create shim task: failed to mount container storage:
  failed to add LCOW layer: failed to add SCSI layer: failed to modify UVM with new SCSI mount:
  guest modify: guest RPC failure: mounting scsi device controller 3 lun 2 onto /run/mounts/m4
  denied by policy: mount_device not allowed by policy. Errors: [deviceHash not found].
  

  Container creation denied due to policy: create_container not allowed by policy. 
  

• En princip tillämpar ett nytt ramverk:

  Failed to create containerd task: failed to create shim task: failed to mount container storage:
  guest modify: guest RPC failure: overlay creation denied by policy: mount_overlay not allowed by policy.
  Errors: [framework_svn is ahead of the current svn: 1.1.0 > 0.1.0].
  

• Ogiltig base64-princip för tillämpning av konfidentiell databehandling (CCE):

  The CCE Policy is not valid Base64.
  

• Begränsning – gränsen på 120 kilobyte (KB) för CCE-principen:

  Failed to create containerd task: failed to create shim task: error while creating the compute system:
  hcs::CreateComputeSystem <compute system id>@vm: The requested operation failed.: unknown.\r\n;
  The container group provisioning has failed. Refer to 'DeploymentFailedReason' event for more details.;
  

  Failed to create containerd task: failed to create shim task: task with id: '<task id>' cannot be created in pod: '<pod>'
  which is not running: failed precondition.\r\n;The container group provisioning has failed.
  Refer to 'DeploymentFailedReason' event for more details.
  

• Enhetens hash hittades inte:

  Denied by policy: rule for mount_device is missing from policy: unknown.
  

  Failed to create containerd task: failed to create shim task: failed to mount container storage:
  failed to add LCOW layer: failed to add SCSI layer: failed to modify UVM with new SCSI mount:
  guest modify: guest RPC failure: mounting scsi device controller 3 lun 2 onto /run/mounts/m4
  denied by policy: mount_device not allowed by policy. Errors: [deviceHash not found]
  

• Andra problem:

  • Loggar visas inte.
  • Exec-funktionen fungerar inte.
  • Tidsgränsen för prenumerationsdistributionen uppnås efter 30 minuter.
  • Liveness-avsökning med otillåten princip.
  • Slutkod 139.

Orsak

I de flesta fall uppstår dessa problem på grund av CCE-principen.

Lösning

• Om det uppstår några principfel återskapar du CCE-principen och försöker distribuera igen.

• Om CCE-principen framtvingar ett ramverk återgår du till en äldre ramverks-svn.

• Om enhetens hash inte hittas eller om det finns ett problem med en avbildning rensar du cacheminnet och återskapar CCE-principen.

  Kör kommandot för att rensa cacheminnet docker rmi <image_name>:<tag> . Kör kommandot för att rensa alla avbildningar i cacheminnet docker rmi $(docker images -a -q) . Kör kommandot för docker inspect <image_name>:<tag> att inspektera den saknade hashen.

Kontakta oss för att få hjälp

Om du har frågor eller behöver hjälp skapar du en supportförfrågan eller frågar Azure community support. Du kan också skicka produktfeedback till Azure-feedbackcommunityn.