Docker - ELK - vm.max_map_count

Question

I'm trying to use the docker's image elk-docker (https://elk-docker.readthedocs.io/) , using Docker Compose. The .yml file, is like this:

elk:
image: sebp/elk
ports:
  - "5601:5601"
  - "9200:9200"
  - "5044:5044"

When I run the command: sudo docker-compose up, the console shows:

* Starting Elasticsearch Server
sysctl: setting key "vm.max_map_count": Read-only file system
...fail!
waiting for Elasticsearch to be up (1/30)
waiting for Elasticsearch to be up (2/30)
waiting for Elasticsearch to be up (3/30)
waiting for Elasticsearch to be up (4/30)
waiting for Elasticsearch to be up (5/30)
waiting for Elasticsearch to be up (6/30)
waiting for Elasticsearch to be up (7/30)
waiting for Elasticsearch to be up (8/30)
waiting for Elasticsearch to be up (9/30)
waiting for Elasticsearch to be up (10/30)
waiting for Elasticsearch to be up (11/30)
waiting for Elasticsearch to be up (12/30)
waiting for Elasticsearch to be up (13/30)
waiting for Elasticsearch to be up (14/30)
waiting for Elasticsearch to be up (15/30)
waiting for Elasticsearch to be up (16/30)
waiting for Elasticsearch to be up (17/30)
waiting for Elasticsearch to be up (18/30)
waiting for Elasticsearch to be up (19/30)
waiting for Elasticsearch to be up (20/30)
waiting for Elasticsearch to be up (21/30)
waiting for Elasticsearch to be up (22/30)
waiting for Elasticsearch to be up (23/30)
waiting for Elasticsearch to be up (24/30)
waiting for Elasticsearch to be up (25/30)
waiting for Elasticsearch to be up (26/30)
waiting for Elasticsearch to be up (27/30)
waiting for Elasticsearch to be up (28/30)
waiting for Elasticsearch to be up (29/30)
waiting for Elasticsearch to be up (30/30)
Couln't start Elasticsearch. Exiting.
Elasticsearch log follows below.
cat: /var/log/elasticsearch/elasticsearch.log: No such file or directory
docker_elk_1 exited with code 1

How can I resolve the problem?

Answer 1

You probably need to set vm.max_map_count in /etc/sysctl.conf on the host itself, so that Elasticsearch does not attempt to do that from inside the container. If you don't know the desired value, try doubling the current setting and keep going until Elasticsearch starts successfully. Documentation recommends at least 262144.

Answer 2

You can do that in 2 ways.

1. Temporary set max_map_count:
   • sudo sysctl -w vm.max_map_count=262144
     but this will only last till you restart your system.
2. Permament
   • In your host machine
     • vi /etc/sysctl.conf
     • make entry vm.max_map_count=262144
     • restart

Answer 3

In Docker host terminal (Docker CLI) run commands:

docker-machine ssh
sudo sysctl -w vm.max_map_count=262144
exit

Answer 4

1. Go inside your docker container

   # docker exec -it <container_id> /bin/bash
   

2. You can view your current max_map_count value

   # more /proc/sys/vm/max_map_count
   

3. Temporary set max_map_count value(container(host) restart will not persist max_map_count value)

   # sysctl -w vm.max_map_count=262144
   

4. Permanently set value

   1. # vi /etc/sysctl.conf
        vm.max_map_count=262144
   
   2. # vi /etc/rc.local 
        #put parameter inside rc.local file
        echo 262144 > /proc/sys/vm/max_map_count