CentOS 7 断电重启后 Docker 无法启动的问题

1、问题记录

服务器意外断电重启之后，发现 Docker 服务没有启动，于是手动执行启动命令

systemctl start docker

启动失败，报错如下

Job for docker.service failed because start of the service was attempted too often. See "systemctl status docker.service" and "journalctl -xe" for details.
To force a start use "systemctl reset-failed docker.service" followed by "systemctl start docker.service" again.

按照提示执行重置错误，再次启动依然报错

systemctl reset-failed docker.service

查看 Docker 服务状态

systemctl status docker

状态信息如下，没有什么有价值的信息

● docker.service - Docker Application Container Engine
   Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; vendor preset: disabled)
   Active: inactive (dead) since 一 2022-04-18 09:13:21 CST; 29s ago
     Docs: https://docs.docker.com
  Process: 11997 ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock (code=exited, status=1/FAILURE)
 Main PID: 11997 (code=exited, status=1/FAILURE)

4月 18 09:13:21 master1 systemd[1]: start request repeated too quickly for docker.service
4月 18 09:13:21 master1 systemd[1]: Failed to start Docker Application Container Engine.
4月 18 09:13:21 master1 systemd[1]: Unit docker.service entered failed state.
4月 18 09:13:21 master1 systemd[1]: docker.service failed.
4月 18 09:13:21 master1 systemd[1]: start request repeated too quickly for docker.service
4月 18 09:13:21 master1 systemd[1]: Failed to start Docker Application Container Engine.
4月 18 09:13:21 master1 systemd[1]: docker.service failed.
4月 18 09:13:21 master1 systemd[1]: start request repeated too quickly for docker.service
4月 18 09:13:21 master1 systemd[1]: Failed to start Docker Application Container Engine.
4月 18 09:13:21 master1 systemd[1]: docker.service failed.

---

2、问题分析

Docker 服务启动失败大概率是以下两种问题：

• 防火墙策略
• /etc/docker/daemon.json 配置文件

在确认过配置文件没有问题后（将所有配置都注释掉，依然无法启动），按照防火墙的问题进行排查。

# 查看防火墙状态
systemctl status firewalld

果然问题在防火墙

● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since 一 2022-04-18 08:53:37 CST; 25min ago
     Docs: man:firewalld(1)
 Main PID: 1607 (firewalld)
    Tasks: 2
   Memory: 22.6M
   CGroup: /system.slice/firewalld.service
           └─1607 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --nopid

4月 18 09:17:40 master1 firewalld[1607]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER' fail...y that name.
4月 18 09:17:40 master1 firewalld[1607]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables: No cha...y that name.
4月 18 09:17:40 master1 firewalld[1607]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D PREROUTING' failed: iptables: Bad rule (does a matching rule exist in that chain?).
4月 18 09:17:40 master1 firewalld[1607]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT' failed: iptables: Bad rule (does a matching rule exist in that chain?).
4月 18 09:17:40 master1 firewalld[1607]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATION' failed: iptables: No chain/target/match by that name.
4月 18 09:17:40 master1 firewalld[1607]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATION' failed: iptables: No chain/target/match by that name.
4月 18 09:17:40 master1 firewalld[1607]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matc...hat chain?).
4月 18 09:17:40 master1 firewalld[1607]: ERROR: ZONE_CONFLICT: 'docker0' already bound to a zone
4月 18 09:17:40 master1 firewalld[1607]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matc...hat chain?).
4月 18 09:17:40 master1 firewalld[1607]: ERROR: ZONE_CONFLICT: 'docker0' already bound to a zone
Hint: Some lines were ellipsized, use -l to show in full.

根据 ZONE_CONFLICT: 'docker0' already bound to a zone 这个错误提示，找到对应的解决办法
参考博客地址 https://www.cnblogs.com/wxbn/p/15057806.html

---

3. 问题解决

1. 查看防火墙中是否存在 docker0

   firewall-cmd --get-active-zones
   

2. 变更接口为 docker0 并重启防火墙服务

   sudo firewall-cmd --permanent --zone=docker --change-interface=docker0 
   sudo systemctl restart firewalld
   

3. 启动 Docker 服务，正常

   systemctl start docker