Start by looking at the container logs. For example, if your database container is called sql2019
then from the host you might issue something similar to:
# docker logs sql2019
...
2021-05-12 13:09:14.47 spid26s Error: 49940, Severity: 16, State: 1.
2021-05-12 13:09:14.47 spid26s Unable to open one or more of the user-specified certificate file(s). Verify that the certificate file(s) exist with read permissions for the user and group running SQL Server.
2021-05-12 13:09:14.56 spid26s Error: 49939, Severity: 16, State: 1.
2021-05-12 13:09:14.56 spid26s Unable to initialize user-specified certificate configuration. The server is being shut down. Verify that the certificate is correctly configured. Error[30]. State[51].
...
db exited with code 1
db | SQL Server 2019 will run as non-root by default.
db | This container is running as user mssql.
db | Your master database file is owned by mssql.
db | To learn more visit https://go.microsoft.com/fwlink/?linkid=2099216.
This tells us some important information:
- We know the file paths are correct because we put them there in the
Dockerfile
and the mssql.conf
file.
- We know permissions could be a problem because they're mentioned in the error message.
- We know that the SQL Server service is running with user
mssql
so we permissions need to allow for that.
In your Dockerfile
you probably have lines similar to the following:
COPY ./mssql.pem /etc/ssl/certs/mssql.pem
COPY ./mssql.key /etc/ssl/private/mssql.key
COPY ./mssql.conf /var/opt/mssql/mssql.conf
Temporarily comment out the mssql.conf
line and docker up
again (without the configuration file):
COPY ./mssql.pem /etc/ssl/certs/mssql.pem
COPY ./mssql.key /etc/ssl/private/mssql.key
# COPY ./mssql.conf /var/opt/mssql/mssql.conf
With the container running you can get a CLI to check the permissions in the /etc/ssl
folder...
# ls -la /etc/ssl
total 32
drwxr-xr-x 1 root root 4096 Apr 3 03:26 .
drwxr-xr-x 1 root root 4096 May 12 13:34 ..
drwxr-xr-x 1 root root 4096 May 12 13:34 certs
-rw-r--r-- 1 root root 10909 Mar 22 11:37 openssl.cnf
drwx------ 1 root root 4096 May 12 13:34 private
Note that the /etc/ssl/private
folder is owned by the root
user and only accessible by the root
user. These permissions will prevent the mssql
user reading the /etc/ssl/private/mssql.key
file.
Update your Dockerfile
to make the /etc/ssl/private
folder accessible:
COPY ./mssql.pem /etc/ssl/certs/mssql.pem
COPY ./mssql.key /etc/ssl/private/mssql.key
COPY ./mssql.conf /var/opt/mssql/mssql.conf
USER root
RUN chmod 755 /etc/ssl/private
USER mssql
And now when you docker up
the SQL Server container should start successfully.
docker run
command work without any of the file mount parameters for the certificate and configuration? Possibly the SQL Instance is shutting down for other reasons, such as an sa password that doesn't meet complexity requirements.docker run
command. That's all in the server configuration.