Docker - ELK - vm.max_map_count

Question

I'm trying to use the docker's image elk-docker (https://elk-docker.readthedocs.io/) , using Docker Compose. The .yml file, is like this:

elk:
image: sebp/elk
ports:
  - "5601:5601"
  - "9200:9200"
  - "5044:5044"

When I run the command: sudo docker-compose up, the console shows:

* Starting Elasticsearch Server
sysctl: setting key "vm.max_map_count": Read-only file system
...fail!
waiting for Elasticsearch to be up (1/30)
waiting for Elasticsearch to be up (2/30)
waiting for Elasticsearch to be up (3/30)
waiting for Elasticsearch to be up (4/30)
waiting for Elasticsearch to be up (5/30)
waiting for Elasticsearch to be up (6/30)
waiting for Elasticsearch to be up (7/30)
waiting for Elasticsearch to be up (8/30)
waiting for Elasticsearch to be up (9/30)
waiting for Elasticsearch to be up (10/30)
waiting for Elasticsearch to be up (11/30)
waiting for Elasticsearch to be up (12/30)
waiting for Elasticsearch to be up (13/30)
waiting for Elasticsearch to be up (14/30)
waiting for Elasticsearch to be up (15/30)
waiting for Elasticsearch to be up (16/30)
waiting for Elasticsearch to be up (17/30)
waiting for Elasticsearch to be up (18/30)
waiting for Elasticsearch to be up (19/30)
waiting for Elasticsearch to be up (20/30)
waiting for Elasticsearch to be up (21/30)
waiting for Elasticsearch to be up (22/30)
waiting for Elasticsearch to be up (23/30)
waiting for Elasticsearch to be up (24/30)
waiting for Elasticsearch to be up (25/30)
waiting for Elasticsearch to be up (26/30)
waiting for Elasticsearch to be up (27/30)
waiting for Elasticsearch to be up (28/30)
waiting for Elasticsearch to be up (29/30)
waiting for Elasticsearch to be up (30/30)
Couln't start Elasticsearch. Exiting.
Elasticsearch log follows below.
cat: /var/log/elasticsearch/elasticsearch.log: No such file or directory
docker_elk_1 exited with code 1

How can I resolve the problem?

Escarole

Answer 1

You probably need to set vm.max_map_count in /etc/sysctl.conf on the host itself, so that Elasticsearch does not attempt to do that from inside the container. If you don't know the desired value, try doubling the current setting and keep going until Elasticsearch starts successfully. Documentation recommends at least 262144.

Storey

Thanks for your answer. I set vm.max_map_count in the sysctl.conf file with 262144, but the cosole shows the same error. – Escarole

Did you reboot the host? If you want to change the setting dynamically, use sysctl vm.max_map_count to check what value is in effect. – Storey

Yes, I run the command vm.max_map_count, and it showed me: vm.max_map_count = 262144 – Escarole

I've run into this as well and some discussion has taken place about solutions for macOS hosts, but I'm unsure of any impact to Windows. Before Docker v1.13 this was simple enough to solve (docker-machine ssh and run sudo sysctl -w vm.max_map_count=262144). Now that Docker for macOS is using the xhyve virtual machine, replace the docker-machine ssh step with screen ~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/tty . Source: elastic.co/guide/en/elasticsearch/reference/master/… – Brunelle

Side effects when increasing vm.max_map_count: novell.com/support/kb/doc.php?id=7000830 – Stairhead

How to do it if the host machine is a MacOS? – Dismember

If using RancherOS, need to create a yaml file and apply config with sudo ros config merge -i sysctl-config.yml then reboot. – Symphysis

Answer 2

You can do that in 2 ways.

1. Temporary set max_map_count:
   • sudo sysctl -w vm.max_map_count=262144
     but this will only last till you restart your system.
2. Permament
   • In your host machine
     • vi /etc/sysctl.conf
     • make entry vm.max_map_count=262144
     • restart

Conchoidal

I had this issue when I tried to run Docker container with Elasticsearch (8.3.3) on Manjaro Linux. Setting max_map_count helped. – Statuette

Answer 3

In Docker host terminal (Docker CLI) run commands:

docker-machine ssh
sudo sysctl -w vm.max_map_count=262144
exit

Twitter

Answer 4

1. Go inside your docker container

   # docker exec -it <container_id> /bin/bash
   

2. You can view your current max_map_count value

   # more /proc/sys/vm/max_map_count
   

3. Temporary set max_map_count value(container(host) restart will not persist max_map_count value)

   # sysctl -w vm.max_map_count=262144
   

4. Permanently set value

   1. # vi /etc/sysctl.conf
        vm.max_map_count=262144
   
   2. # vi /etc/rc.local 
        #put parameter inside rc.local file
        echo 262144 > /proc/sys/vm/max_map_count
   

Shreve

Answer 5

You have to set the vm.max_map_count variable in /etc/sysctl.conf at least with 262144

After that you can reload the settings with sysctl --system

Tendinous

Answer 6

For me the problem got fixed once I tried setting the "discovery.type=single-node" environment variable while starting up the container as provided in the link below :- https://www.elastic.co/guide/en/elasticsearch/reference/7.5/docker.html#docker-cli-run-dev-mode

Scarlettscarp