> ## Documentation Index
> Fetch the complete documentation index at: https://clickhouse.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Docker에서 CAP_IPC_LOCK 및 CAP_SYS_NICE capability 설정

> 컨테이너에서 ClickHouse를 실행할 때 `CAP_IPC_LOCK` 및 `CAP_SYS_NICE`와 관련된 Docker capability 경고를 해결하는 방법을 알아봅니다.

<div id="question">
  ## 질문
</div>

Docker에서 ClickHouse를 실행할 때 시스템에 `CAP_IPC_LOCK` 및 `CAP_SYS_NICE` capability가 없다고 Docker가 경고합니다. 어떻게 해결할 수 있습니까?

다음은 `CAP_SYS_NICE` 또는 `CAP_SYS_NICE` capability가 없을 때 표시되는 로그 메시지입니다:

```bash theme={null}
docker run -d --name clickhouse-server \
    --ulimit nofile=262144:262144 \
    --network clickhouse-net \
    -p 8123:8123 -p 9000:9000 -p 9009:9009 -p 9363:9363 \
    clickhouse/clickhouse-server:23.2
```

```response theme={null}
2023.04.19 08:04:10.022720 [ 1 ] {} <Information> Application: It looks like the process has no CAP_IPC_LOCK capability, binary mlock will be disabled. It could happen due to incorrect ClickHouse package installation. You could resolve the problem manually with 'sudo setcap cap_ipc_lock=+ep /usr/bin/clickhouse'. Note that it will not work on 'nosuid' mounted filesystems.

2023.04.19 08:04:10.065860 [ 1 ] {} <Information> Application: It looks like the process has no CAP_SYS_NICE capability, the setting 'os_thread_priority' will have no effect. It could happen due to incorrect ClickHouse package installation. You could resolve the problem manually with 'sudo setcap cap_sys_nice=+ep /usr/bin/clickhouse'. Note that it will not work on 'nosuid' mounted filesystems.
```

<div id="answer">
  ## 답변
</div>

1. 컨테이너에 `IPC_LOCK` 및 `SYS_NICE` capability를 부여하려면 `--cap-add` 인수 2개를 추가합니다:

```bash theme={null}
docker run -d --name clickhouse-server \
   --cap-add=SYS_NICE \
   --cap-add=IPC_LOCK \
   --ulimit nofile=262144:262144 \
   --network clickhouse-net \
   -p 8123:8123 -p 9000:9000 -p 9009:9009 -p 9363:9363 \
   clickhouse/clickhouse-server:23.2
```

2. 다음 명령을 사용하여 컨테이너에서 capability가 보이는지 확인하세요:

```bash theme={null}
apt-get update > /dev/null && apt-get install -y libcap2-bin > /dev/null && capsh --print
```

응답은 다음과 비슷합니다:

```response theme={null}
debconf: delaying package configuration, since apt-utils is not installed
WARNING: libcap needs an update (cap=40 should have a name).
Current: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_ipc_lock,cap_sys_chroot,cap_sys_nice,cap_mknod,cap_audit_write,cap_setfcap+ep
Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_ipc_lock,cap_sys_chroot,cap_sys_nice,cap_mknod,cap_audit_write,cap_setfcap
Ambient set =
Securebits: 00/0x0/1'b0
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
 secure-no-ambient-raise: no (unlocked)
uid=0(root) euid=0(root)
gid=0(root)
groups=0(root)
Guessed mode: UNCERTAIN (0)
```

3. ClickHouse에 필요한 두 capability를 모두 수동으로 설정합니다

```bash theme={null}
setcap "cap_ipc_lock=+ep cap_sys_nice=+ep" /usr/bin/clickhouse
```

4. capability가 적용되었는지 확인합니다.

```bash theme={null}
getcap -v /usr/bin/clickhouse
```

다음과 같이 표시됩니다:

```response theme={null}
/usr/bin/clickhouse = cap_ipc_lock,cap_sys_nice+ep
```

5. ClickHouse 서버를 다시 시작하면 로그 메시지가 더 이상 표시되지 않습니다.

<br />

자세한 내용은 이 [Linux capability 문서](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities)를 확인하십시오.