docker: invalid reference format during db:migrate

[jasonjho]

After building the image, I see the following when running bundle exec rake appengine:exec -- bundle exec rake db:migrate

---------- CONNECT CLOUDSQL ----------
cloud_sql_proxy is running.

---------- EXECUTE COMMAND ----------
bundle exec rake db:migrate
docker: invalid reference format.
See 'docker run --help'.
ERROR
ERROR: build step "gcr.io/google-appengine/exec-wrapper" failed: exit status 125

Nothing seems to be generated in the logs, though it seems to be a Docker issue?

[jasonjho]

This turned out to be an issue with the way one of our -e command line arguments were being passed. We have a particular environment variable that contains the contents of a JSON priv/key credentials file and looks like there are some escaping issues in the exec handler.

[dazuma]

@jasonjho Can you provide a (suitably obfuscated of course) example of the kind of environment variable contents that are triggering this error? Thanks!

[jasonjho]

Sure, we essentially stripped out newlines from our service account key JSON file and appended it into our YAML file as a string. The result will look something like:

-e GOOGLE_CLOUD_KEYFILE_JSON\=\{\ \ \"type\":\ \"service_account\",\ \ \"project_id\":\ \"foo\",\ \ \"private_key_id\":\ \"...\",\ \ \"private_key\":\ \"-----BEGIN\ PRIVATE\ KEY-----\\n...\=\=\\n-----END\ PRIVATE\ KEY-----\\n\",\ \ \"client_email\":\ \"foo@foo.iam.gserviceaccount.com\",\ \ \"client_id\":\ \"9281607187269205232553\",\ \ \"auth_uri\":\ \"https://accounts.google.com/o/oauth2/auth\",\ \ \"token_uri\":\ \"https://accounts.google.com/o/oauth2/token\",\ \ \"auth_provider_x509_cert_url\":\ \"https://www.googleapis.com/oauth2/v1/certs\",\ \ \"client_x509_cert_url\":\ \"https://www.googleapis.com/robot/v1/metadata/x509/foo\%40foo.iam.gserviceaccount.com\"\}

[dazuma]

@jasonjho I believe I found the quoting issue in our backend. A hotfix has been pushed out. Can you verify?

[dazuma]

As the fix has been out for a while, I'm closing this. Please feel free to reopen if the issue is still present.