search

Winson-030 / dify-kubernetes

Deploy Dify on Kubernetes
GNU General Public License v3.0
65 stars 15 forks source link

dify-ssrf CrashLoopBackOff #14

Open wyj0818 opened 1 week ago

wyj0818 commented 1 week ago

The dify-ssrf deployment went wrong when startup

 [ENTRYPOINT] re-create snakeoil self-signed certificate removed in the build process

 [ENTRYPOINT] replacing environment variables in the template

 /docker-entrypoint.sh: line 38: /etc/squid/squid.conf: Read-only file system

 2024/10/22 08:39:07| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback.

 2024/10/22 08:39:07| aclIpParseIpData: IPv6 has not been enabled.

 2024/10/22 08:39:07| aclIpParseIpData: IPv6 has not been enabled.

 2024/10/22 08:39:07| aclIpParseIpData: IPv6 has not been enabled.

 2024/10/22 08:39:07| Processing Configuration File: /etc/squid/squid.conf (depth 0)

 2024/10/22 08:39:07| aclIpParseIpData: IPv6 has not been enabled.

 2024/10/22 08:39:07| aclIpParseIpData: IPv6 has not been enabled.

 2024/10/22 08:39:07| Created PID file (/run/squid.pid)

 2024/10/22 08:39:07| Set Current Directory to /var/spool/squid

 2024/10/22 08:39:07| Creating missing swap directories

 2024/10/22 08:39:07| No cache_dir stores are configured.

 2024/10/22 08:39:07| Removing PID file (/run/squid.pid)

 [ENTRYPOINT] starting squid

 /docker-entrypoint.sh: line 42:    34 Killed                  /usr/sbin/squid -f /etc/squid/squid.conf -NYC 1

I have checked the logs it shows like:

[4081125.742864] [  24983]    13 24983 148914113  2436617 19648512        0           870 squid
[4081125.742866] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=mdatp.service,mems_allowed=0,global_oom,task_memcg=/kubepods.slice/kubepods-burstable.slice/kubepods-burstable-podfbf59ea1_0d60_47db_90a0_cde2ed5dd132.slice/docker-572d38ebfce6be96a2ffbab22264d2527c61085103ef826a6a0927da5c990c1b.scope,task=squid,pid=24983,uid=13
[4081125.742879] Out of memory: Killed process 24983 (squid) total-vm:595656452kB, anon-rss:9746412kB, file-rss:44kB, shmem-rss:12kB, UID:13 pgtables:19188kB oom_score_adj:870

seems like it has a OOM issue.

I'm sure squid doesn't need that large size of Memory and thank you for your kindly help.

Winson-030 commented 1 week ago

/docker-entrypoint.sh: line 38: /etc/squid/squid.conf: Read-only file system

The squid deployment will run a entrypoint script and write configurations into squid.conf.

I think you should review the permission of the configmap which mount squid.conf first.

For the OOM issue, try remove the resource setup then deploy again, see what will happen.

This issue never happened in my K3S cluster, so you'd better check the cluster configurations.