[<\/span>root@CN-AISE002 ~]<\/span># docker ps<\/span> [<\/span>root@CN-AISE002 ~]<\/span># systemctl start docker<\/span> [<\/span>root@CN-AISE002 ~]<\/span># docker –version<\/span> [<\/span>root@CN-AISE002 ~]<\/span># systemctl list-unit-files | grep docker<\/span> \u95ee\u9898\u8bca\u65ad： [<\/span>root@CN-AISE002 ~]<\/span># cat -A \/usr\/lib\/systemd\/system\/docker.service<\/span> # \u5907\u4efd\u539f\u6587\u4ef6<\/span> # \u5b8c\u5168\u5220\u9664\u539f\u6587\u4ef6（\u907f\u514d\u9690\u85cf\u5b57\u7b26\u6b8b\u7559）<\/span> # \u7528\u6807\u51c6\u5355\u884c\u914d\u7f6e\u91cd\u5efa（\u65e0\u7eed\u884c\u3001\u65e0\u53d8\u91cf）<\/span> [Service] [Install] # \u4e25\u683c\u8bbe\u7f6e\u6743\u9650<\/span> [<\/span>root@CN-AISE002 ~]<\/span># grep ExecStart \/usr\/lib\/systemd\/system\/docker.service<\/span> [<\/span>root@CN-AISE002 ~]<\/span># file \/usr\/lib\/systemd\/system\/docker.service<\/span> [<\/span>root@CN-AISE002 ~]<\/span># systemctl daemon-reload<\/span> \u542f\u52a8 Docker \u65f6\u51fa\u73b0\u65b0\u9519\u8bef：<\/p>\n failed to load listeners: no sockets found via socket activation: \u6839\u672c\u539f\u56e0：\u914d\u7f6e\u4e2d\u4f7f\u7528 -H fd:\/\/ \u4f9d\u8d56 systemd socket activation，\u4f46\u7cfb\u7edf\u7f3a\u5c11\u914d\u5957\u7684 docker.socket \u5355\u5143\u3002<\/p>\n \u4fee\u590d\u65b9\u6848：\u76f4\u63a5\u521b\u5efa Unix socket<\/p>\n # \u505c\u6b62\u6240\u6709 dockerd \u8fdb\u7a0b<\/span> # \u4fee\u6539 ExecStart \u884c（\u5c06 -H fd:\/\/ \u6539\u4e3a -H unix:\/\/\/var\/run\/docker.sock）<\/span> # \u9a8c\u8bc1\u4fee\u6539<\/span> # \u91cd\u8f7d systemd \u5e76\u542f\u52a8<\/span> \u9a8c\u8bc1\u7ed3\u679c：<\/p>\n [<\/span>root@CN-AISE002 ~]<\/span># systemctl status docker –no-pager -l | head -20<\/span> [<\/span>root@CN-AISE002 ~]<\/span># docker ps -a | head -5<\/span> Docker \u670d\u52a1\u6210\u529f\u542f\u52a8，\u4f46\u5bb9\u5668\u4ecd\u65e0\u6cd5\u8fd0\u884c\u3002<\/p>\n [<\/span>root@CN-AISE002 ~]<\/span># docker start tei-npu7<\/span> \u6839\u672c\u539f\u56e0\u5206\u6790：<\/p>\n # \u68c0\u67e5\u5f53\u524d runc \u7248\u672c<\/span> # \u4ece Windows \u7535\u8111\u4e0b\u8f7d runc 1.1.13 ARM64 \u7248\u672c，\u901a\u8fc7 U \u76d8\u4f20\u8f93\u5230\u670d\u52a1\u5668<\/span> # \u9a8c\u8bc1\u7248\u672c<\/span> [<\/span>root@CN-AISE002 ~]<\/span># file \/usr\/bin\/runc<\/span> # \u91cd\u542f Docker<\/span> # \u5c1d\u8bd5\u542f\u52a8\u5bb9\u5668<\/span> \u7ed3\u8bba：\u5347\u7ea7 runc \u65e0\u6548，\u95ee\u9898\u6839\u6e90\u5728\u4e8e Docker \u4f7f\u7528\u7684 seccomp \u914d\u7f6e\u6587\u4ef6，\u800c\u975e runc \u7248\u672c\u3002<\/p>\n [<\/span>root@CN-AISE002 ~]<\/span># setenforce 0<\/span> [<\/span>root@CN-AISE002 ~]<\/span># docker start tei-npu7<\/span> \u7ed3\u8bba：SELinux \u975e\u6839\u672c\u539f\u56e0，\u95ee\u9898\u4e0e seccomp \u914d\u7f6e\u7f3a\u5931\u76f4\u63a5\u76f8\u5173\u3002<\/p>\n # \u521b\u5efa\u7b80\u5316\u7248 seccomp \u914d\u7f6e<\/span> # \u91cd\u542f Docker \u4f7f\u914d\u7f6e\u751f\u6548<\/span> # \u5c1d\u8bd5\u542f\u52a8\u5bb9\u5668<\/span> \u9519\u8bef\u7ed3\u679c：<\/p>\n 13a195288ea45db47dcecda63b6c7f0712aeb0ab1c58f42f4342f8faa756c474 \u6839\u672c\u539f\u56e0：JSON \u914d\u7f6e\u683c\u5f0f\u4e0d\u5b8c\u6574（\u5b58\u5728\u591a\u4f59\u7a7a\u683c\u3001\u7f3a\u5c11\u5fc5\u8981\u5b57\u6bb5），runc \u65e0\u6cd5\u89e3\u6790\u5bfc\u81f4 exit status 2\u3002<\/p>\n # \u6e05\u7406\u6b8b\u7559\u5bb9\u5668<\/span> # \u542f\u52a8\u751f\u4ea7\u7ea7\u5bb9\u5668（\u5173\u952e：–security-opt seccomp=unconfined）<\/span>
\nCannot connect to the Docker daemon at unix:\/\/\/var\/run\/docker.sock. Is the docker<\/span> daemon running?<\/p>\n
\nFailed to start docker.service: Unit docker.service not found.<\/p>\n
\nDocker version 23.0<\/span>.6, build ef23cbc<\/p>\n
\ndocker.service bad disabled<\/p>\n
\nsystemd \u5c06 docker.service \u6807\u8bb0\u4e3a bad \u72b6\u6001，\u8868\u660e\u65e0\u6cd5\u89e3\u6790\u8be5 unit \u6587\u4ef6\u7684\u8bed\u6cd5\u7ed3\u6784\u3002\u68c0\u67e5 service \u6587\u4ef6\u53d1\u73b0\u5b58\u5728\u591a\u884c\u7eed\u5199\u548c\u9690\u85cf\u5b57\u7b26\u95ee\u9898：<\/p>\n
\n[<\/span>Unit]<\/span>$
\nDescription<\/span>=<\/span>Docker Application Container Engine$
\n..<\/span>.
\nExecStart<\/span>=<\/span>\/usr\/bin\/dockerd $OPTIONS<\/span> $
\n$DOCKER_STORAGE_OPTIONS<\/span> $
\n$DOCKER_NETWORK_OPTIONS<\/span> $
\n$INSECURE_REGISTRY<\/span>$
\n..<\/span>.<\/p>\n\u4e8c\u3001\u4fee\u590d systemd service \u6587\u4ef6（10:13 – 11:19）<\/h3>\n
\u6b65\u9aa4 1：\u5f7b\u5e95\u91cd\u5efa\u6807\u51c6 service \u6587\u4ef6<\/h4>\n
\ncp<\/span> \/usr\/lib\/systemd\/system\/docker.service \/root\/docker.service.bak.$(<\/span>date<\/span> +%Y%m%d_%H%M%S)<\/span><\/span><\/p>\n
\nrm<\/span> -f \/usr\/lib\/systemd\/system\/docker.service<\/p>\n
\ncat<\/span> ><\/span> \/usr\/lib\/systemd\/system\/docker.service <<<\/span>'EOF'
\n[Unit]
\nDescription=Docker Application Container Engine
\nDocumentation=https:\/\/docs.docker.com
\nAfter=network-online.target firewalld.service containerd.service
\nWants=network-online.target
\nRequires=containerd.service<\/p>\n
\nType=notify
\nExecStart=\/usr\/bin\/dockerd -H fd:\/\/ –containerd=\/run\/containerd\/containerd.sock
\nExecReload=\/bin\/kill -s HUP $MAINPID
\nTimeoutSec=0
\nRestart=always
\nDelegate=yes
\nKillMode=process
\nLimitNOFILE=infinity
\nLimitNPROC=infinity
\nLimitCORE=infinity<\/p>\n
\nWantedBy=multi-user.target
\nEOF<\/span><\/p>\n
\nchmod<\/span> 644<\/span> \/usr\/lib\/systemd\/system\/docker.service<\/p>\n\u6b65\u9aa4 2：\u9a8c\u8bc1\u6587\u4ef6\u683c\u5f0f<\/h4>\n
\nExecStart<\/span>=<\/span>\/usr\/bin\/dockerd -H fd:\/\/ –containerd=<\/span>\/run\/containerd\/containerd.sock<\/p>\n
\n\/usr\/lib\/systemd\/system\/docker.service: ASCII text<\/p>\n
\n[<\/span>root@CN-AISE002 ~]<\/span># systemctl reset-failed docker.service<\/span>
\n[<\/span>root@CN-AISE002 ~]<\/span># systemctl list-unit-files | grep docker<\/span>
\ndocker.service enabled disabled # \u2705 bad \u72b6\u6001\u5df2\u4fee\u590d<\/span><\/p>\n\u6b65\u9aa4 3：\u89e3\u51b3 socket activation \u914d\u7f6e\u9519\u8bef<\/h4>\n
\nmake sure the service was started by systemd<\/p>\n
\npkill<\/span> -f "\/usr\/bin\/dockerd"<\/span><\/p>\n
\nsed<\/span> -i 's|-H fd:\/\/|-H unix:\/\/\/var\/run\/docker.sock|g'<\/span> \/usr\/lib\/systemd\/system\/docker.service<\/p>\n
\ngrep<\/span> ExecStart \/usr\/lib\/systemd\/system\/docker.service
\n# \u8f93\u51fa: ExecStart=\/usr\/bin\/dockerd -H unix:\/\/\/var\/run\/docker.sock –containerd=\/run\/containerd\/containerd.sock<\/span><\/p>\n
\nsystemctl daemon-reload
\nsystemctl reset-failed docker.service
\nsystemctl start docker<\/span><\/p>\n
\n\u25cf docker.service – Docker Application Container Engine
\nLoaded: loaded (<\/span>\/usr\/lib\/systemd\/system\/docker.service;<\/span> enabled;<\/span> preset: disabled)<\/span>
\nActive: active (<\/span>running)<\/span> since Wed 2026<\/span>-02-04 11<\/span>:19:51 GMT;<\/span> 4s ago
\nDocs: https:\/\/docs.docker.com
\nMain PID: 71469<\/span> (<\/span>dockerd)<\/span>
\nTasks: 78<\/span> (<\/span>limit: 3355442<\/span>)<\/span>
\nMemory: 66<\/span>.6M (<\/span>)<\/span>
\nCGroup: \/system.slice\/docker.service
\n\u2514\u250071469 \/usr\/bin\/dockerd -H unix:\/\/\/var\/run\/docker.sock –containerd=<\/span>\/run\/containerd\/containerd.sock<\/p>\n
\nCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES<\/p>\n\u4e09\u3001\u5bb9\u5668\u542f\u52a8\u5931\u8d25：seccomp \u517c\u5bb9\u6027\u95ee\u9898（11:20 – 14:20）<\/h3>\n
\u95ee\u9898\u73b0\u8c61<\/h4>\n
\nError response from daemon: failed to create shim task: OCI runtime create failed:
\ncontainer_linux.go:348: starting container process caused
\n"error adding seccomp filter rule for syscall clone3: permission denied"<\/span>:<\/span> unknown
\nError: failed to start containers: tei-npu7<\/p>\n\n
\u5c1d\u8bd5\u65b9\u6848 1：\u5347\u7ea7 runc（11:46 – 12:30）<\/h4>\n
\n[<\/span>root@CN-AISE002 ~]<\/span># runc –version | head -1<\/span>
\nrunc version 1.1<\/span>.7<\/p>\n
\ncp<\/span> \/tmp\/runc-aarch64-v1.1.13 \/usr\/bin\/runc
\nchmod<\/span> +x \/usr\/bin\/runc<\/p>\n
\n[<\/span>root@CN-AISE002 ~]<\/span># runc –version | head -1<\/span>
\nrunc version 1.1<\/span>.13a<\/p>\n
\n\/usr\/bin\/runc: ELF 64<\/span>-bit LSB pie executable, ARM aarch64, version 1<\/span> (<\/span>SYSV)<\/span>, static-pie linked..<\/span>.<\/p>\n
\nsystemctl restart docker<\/span><\/p>\n
\n[<\/span>root@CN-AISE002 ~]<\/span># docker start tei-npu7<\/span>
\nError response from daemon: failed to create shim task: OCI runtime create failed:
\ncontainer_linux.go:348: starting container process caused
\n"error adding seccomp filter rule for syscall clone3: permission denied"<\/span>:<\/span> unknown<\/p>\n\u5c1d\u8bd5\u65b9\u6848 2：\u7981\u7528 SELinux（12:31 – 13:00）<\/h4>\n
\n[<\/span>root@CN-AISE002 ~]<\/span># getenforce<\/span>
\nPermissive<\/p>\n
\nError response from daemon: failed to create shim task: OCI runtime create failed:
\ncontainer_linux.go:348: starting container process caused
\n"error adding seccomp filter rule for syscall clone3: permission denied"<\/span>:<\/span> unknown<\/p>\n\u5c1d\u8bd5\u65b9\u6848 3：\u81ea\u5b9a\u4e49 seccomp \u914d\u7f6e（13:01 – 14:20）<\/h4>\n
\nmkdir<\/span> -p \/etc\/docker\/seccomp
\ncat<\/span> ><\/span> \/etc\/docker\/seccomp\/ascend-seccomp.json <<<\/span>'EOF'
\n{
\n "defaultAction": "SCMP_ACT_ERRNO",
\n "architectures": ["SCMP_ARCH_AARCH64"],
\n "syscalls": [
\n {
\n "names": ["clone3", "clone"],
\n "action": "SCMP_ACT_ALLOW"
\n },
\n {
\n "names": [
\n "accept", "accept4", "access", "bind", "brk", "close", "connect",
\n "epoll_create", "epoll_ctl", "epoll_wait", "execve", "exit", "exit_group",
\n "faccessat", "fchmod", "fchown", "fcntl", "fdatasync", "flock", "fork",
\n "fstat", "fstatfs", "fsync", "ftruncate", "getcwd", "getdents64", "getegid",
\n "geteuid", "getgid", "getpeername", "getpid", "getppid", "getsockname",
\n "getsockopt", "getuid", "ioctl", "listen", "lseek", "lstat", "madvise",
\n "mmap", "mprotect", "munmap", "nanosleep", "open", "openat", "pipe", "pipe2",
\n "poll", "pread64", "pwrite64", "read", "readlink", "recvfrom", "recvmsg",
\n "restart_syscall", "rt_sigaction", "rt_sigprocmask", "rt_sigreturn", "sched_yield",
\n "sendmsg", "sendto", "setsockopt", "sigaltstack", "socket", "stat", "statfs",
\n "uname", "wait4", "write", "writev", "prctl", "arch_prctl", "set_tid_address",
\n "set_robust_list", "futex", "sched_getaffinity", "sched_setaffinity"
\n ],
\n "action": "SCMP_ACT_ALLOW"
\n }
\n ]
\n}
\nEOF<\/span>
\nchmod<\/span> 644<\/span> \/etc\/docker\/seccomp\/ascend-seccomp.json<\/p>\n
\nsystemctl restart docker<\/span>
\nsleep<\/span> 5<\/span><\/p>\n
\ndocker<\/span> run -d \\\\<\/span>
\n –name tei \\\\<\/span>
\n –net host<\/span> \\\\<\/span>
\n –restart always \\\\<\/span>
\n -e ENABLE_BOOST<\/span>=<\/span>True \\\\<\/span>
\n –device=<\/span>\/dev\/davinci_manager \\\\<\/span>
\n –device=<\/span>\/dev\/hisi_hdc \\\\<\/span>
\n –device=<\/span>\/dev\/devmm_svm \\\\<\/span>
\n –device=<\/span>\/dev\/davinci7 \\\\<\/span>
\n -v \/usr\/local\/Ascend\/driver:\/usr\/local\/Ascend\/driver:ro \\\\<\/span>
\n -v \/usr\/local\/sbin:\/usr\/local\/sbin:ro \\\\<\/span>
\n -v \/home\/data:\/home\/HwHiAiUser\/model \\\\<\/span>
\n –security-opt seccomp<\/span>=<\/span>\/etc\/docker\/seccomp\/ascend-seccomp.json \\\\<\/span>
\n –pids-limit 8192<\/span> \\\\<\/span>
\n –memory 32g \\\\<\/span>
\n –cpus 16<\/span> \\\\<\/span>
\n –entrypoint bash<\/span> \\\\<\/span>
\n swr.cn-south-1.myhuaweicloud.com\/ascendhub\/mis-tei:7.1.RC1-800I-A2-aarch64 \\\\<\/span>
\n -c "while true; do sleep 3600; done"<\/span><\/p>\n
\ndocker: Error response from daemon: failed to create shim task: OCI runtime create failed:
\nrunc did not terminate successfully: exit status 2: unknown.<\/p>\n\u56db\u3001\u6700\u7ec8\u89e3\u51b3\u65b9\u6848：\u4f7f\u7528 seccomp=unconfined（14:21 – 15:30）<\/h3>\n
\u95ee\u9898\u5206\u6790<\/h4>\n
\n
\u6267\u884c\u547d\u4ee4<\/h4>\n
\ndocker<\/span> rm<\/span> -f tei 2<\/span>><\/span>\/dev\/null ||<\/span> true<\/span><\/p>\n
\ndocker<\/span> run -d \\\\<\/span>
\n –name tei \\\\<\/span>
\n –net host<\/span> \\\\<\/span>
\n –restart always \\\\<\/span>
\n -e ENABLE_BOOST<\/span>=<\/span>True \\\\<\/span>
\n –device=<\/span>\/dev\/davinci_manager \\\\<\/span>
\n –device=<\/span>\/dev\/hisi_hdc \\\\<\/span>
\n –device=<\/span>\/dev\/devmm_svm \\\\<\/span>
\n –device=<\/span>\/dev\/davinci7 \\\\<\/span>