Docker and Mysql: libz.so.1: cannot open shared object file: Permission denied

Question

When running mysqld in this Dockerfile (on my Linux box, Linux 12.04)

Dockerfile:

FROM ubuntu:precise
RUN apt-get update
RUN apt-get install -y mysql-server

CMD ["/usr/sbin/mysqld"]

I get mysqld: error while loading shared libraries: libz.so.1: cannot open shared object file: Permission denied

Whereas running it on my Mac through boot2docker mysqld starts up just fine.

I have tried different base docker images:

• phusion/baseimage:0.9.8
• phusion/baseimage:0.9.1
• ubuntu:latest

I have run apt-get update and apt-get upgrade (including updating Mysql) on the host system, I have rebooted the host system.

Any ideas on how to proceed?

Info about my system:

$ docker version
Client version: 0.9.0
Go version (client): go1.2.1
Git commit (client): 2b3fdf2
Server version: 0.9.0
Git commit (server): 2b3fdf2
Go version (server): go1.2.1
Last stable version: 0.9.0

$ docker info
Containers: 37
Images: 340
Driver: aufs
Root Dir: /var/lib/docker/aufs
Dirs: 414
WARNING: No swap limit support

$ uname -a
Linux Ubuntu-1204-precise-64-minimal 3.8.0-37-generic #53~precise1-Ubuntu SMP Wed Feb 19 21:37:54 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

Answer to leeduhem comments about permissions of libz.so.1:

$ ls -l /lib/x86_64-linux-gnu/libz.so.1
lrwxrwxrwx 1 root root 15 Nov 10  2011 /lib/x86_64-linux-gnu/libz.so.1 -> libz.so.1.2.3.4

$ ls -l /lib/x86_64-linux-gnu/libz.so.1.2.3.4 
-rw-r--r-- 1 root root 92720 Nov 10  2011 /lib/x86_64-linux-gnu/libz.so.1.2.3.4

Changing permissions with

$ chmod +x  /lib/x86_64-linux-gnu/libz.so.1.2.3.4 

I still get the error.

Running strace -o /tmp/mysql.strace mysqld and cat /tmp/mysql.strace gives

execve("/usr/sbin/mysqld", ["mysqld"], [/* 7 vars */]) = 0
brk(0)                                  = 0x7f4d41f7c000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4d403c5000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission denied)
open("/lib/x86_64-linux-gnu/tls/x86_64/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/lib/x86_64-linux-gnu/tls/x86_64", 0x7fff713907f0) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/tls/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/lib/x86_64-linux-gnu/tls", 0x7fff713907f0) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/x86_64/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/lib/x86_64-linux-gnu/x86_64", 0x7fff713907f0) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission denied)
stat("/lib/x86_64-linux-gnu", 0x7fff713907f0) = -1 EACCES (Permission denied)
open("/usr/lib/x86_64-linux-gnu/tls/x86_64/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/usr/lib/x86_64-linux-gnu/tls/x86_64", 0x7fff713907f0) = -1 ENOENT (No such file or directory)
open("/usr/lib/x86_64-linux-gnu/tls/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/usr/lib/x86_64-linux-gnu/tls", 0x7fff713907f0) = -1 ENOENT (No such file or directory)
open("/usr/lib/x86_64-linux-gnu/x86_64/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/usr/lib/x86_64-linux-gnu/x86_64", 0x7fff713907f0) = -1 ENOENT (No such file or directory)
open("/usr/lib/x86_64-linux-gnu/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/usr/lib/x86_64-linux-gnu", 0x7fff713907f0) = -1 EACCES (Permission denied)
open("/lib/tls/x86_64/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/lib/tls/x86_64", 0x7fff713907f0) = -1 ENOENT (No such file or directory)
open("/lib/tls/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/lib/tls", 0x7fff713907f0)        = -1 ENOENT (No such file or directory)
open("/lib/x86_64/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/lib/x86_64", 0x7fff713907f0)     = -1 ENOENT (No such file or directory)
open("/lib/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/lib", 0x7fff713907f0)            = -1 EACCES (Permission denied)
open("/usr/lib/tls/x86_64/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/usr/lib/tls/x86_64", 0x7fff713907f0) = -1 ENOENT (No such file or directory)
open("/usr/lib/tls/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/usr/lib/tls", 0x7fff713907f0)    = -1 ENOENT (No such file or directory)
open("/usr/lib/x86_64/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/usr/lib/x86_64", 0x7fff713907f0) = -1 ENOENT (No such file or directory)
open("/usr/lib/libz.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/usr/lib", 0x7fff713907f0)        = -1 EACCES (Permission denied)
writev(2, [{"mysqld", 6}, {": ", 2}, {"error while loading shared libra"..., 36}, {": ", 2}, {"libz.so.1", 9}, {": ", 2}, {"cannot open shared object file", 30}, {": ", 2}, {"Permission denied", 17}, {"\n", 1}], 10) = 107

---

Looking at the directories /lib and /lib/x86_64-linux-gnu that the trace seems to indicate are not permitted:

$ ls -ld /lib
drwxr-xr-x 12 root root 4096 Dec 16 13:42 /lib

$ ls -ld /lib/x86_64-linux-gnu
drwxr-xr-x 3 root root 4096 Mar 17 13:39 /lib/x86_64-linux-gnu  

Answer 1

So I solved the issue by using the devicemapper storage backend, as suggested by @jpetazzo.

Steps I carried out:

1. Stopped the docker deamon
2. Started the docker deamon with command docker -d -s="devicemapper"
3. Ran the docker run on the Dockerfile command again. And it worked without any problems.

Answer 2

Deleting the container solve this problem for me.

Update: That solution worked not so long.

So I kept searching and found something related with Apparmor.

If you have mysql installed on your host, Apparmor may restrict access of this shared library for mysql installed on your docker container. The following fixed the problem:

#Type this on your host terminal
sudo ln -s /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld