Pre-Built Release Docker Images do not launch for me.

[abwiggins]

Describe the bug

I might be misunderstanding how to use these Release images found in public ECR but when attempting to run the image. I receive the following error:

docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "/root/bin": permission denied: unknown.

I looked at the Dockerfile for creating these images and it seems to me the Entrypoint should be /root/bin/localproxy as an entrypoint should be an executable instead of the folder path /root/bin. Dockerfile reference for Entrypoint. Again, I may misunderstand how to use these images.

I also tried overriding the entrypont and this allowed me to enter the container. I was able to see that /root/bin/localproxy is present in the image and executable:

docker run -it --rm --entrypoint /bin/bash public.ecr.aws/aws-iot-securetunneling-localproxy/ubuntu-bin:latest

But, when trying to run localproxy:

docker run -it --rm --entrypoint /bin/bash public.ecr.aws/aws-iot-securetunneling-localproxy/ubuntu-bin:latest -c "/root/bin/localproxy"

I receive the error:

/bin/bash: line 1: /root/bin/localproxy: cannot execute binary file: Exec format error

But I am able to ls using the same approach:

docker run -it --rm --entrypoint /bin/bash public.ecr.aws/aws-iot-securetunneling-localproxy/ubuntu-bin:latest -c "/usr/bin/ls"

with an output:

bin  boot  dev  etc  home  lib  lib32  lib64  libx32  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

What is the recommended method for using these Release images?

To Reproduce

Steps to reproduce the behavior:

1. Install Docker
2. docker run -it --name localproxy public.ecr.aws/aws-iot-securetunneling-localproxy/ubuntu-bin:latest

Expected behavior

I would expect a docker run command on this image to execute a binary of localproxy & be able to pass additional arguments to localproxy in a fashion similar to:

docker run -it --rm --name localproxy -p 2222:22 public.ecr.aws/aws-iot-securetunneling-localproxy/ubuntu-bin:latest -r ${AWS_REGION} -b 0.0.0.0 -s 22

Actual behavior

permission denied when attempting to run the image

Logs

docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "/root/bin": permission denied: unknown.

Environment (please complete the following information):

• OS: Ubuntu
• Version: 22.04
• Architecture: x86_64
• Localproxy commit: whichever commit lands in public.ecr.aws/aws-iot-securetunneling-localproxy/ubuntu-bin:latest

Additional context

Thank you for any info!

[RogerZhongAWS]

Hello, thanks for pointing this out. I can make a quick fix for the entrypoint issue (and fix the file permissions which is why you were unable to start the container).

In theory what you are trying to do should work. There may be still some gaps in the documentation that we will fill in.

[abwiggins]

Sounds good, @RogerZhongAWS! Thank you for the speedy response. I'll be on the lookout for the updated images & will test on my end as soon as they are available. Thanks again!

[louix]

Regarding this error from aws-iot-securetunneling-localproxy/ubuntu-bin:latest: /bin/bash: line 1: /root/bin/localproxy: cannot execute binary file: Exec format error

The root/bin/localproxy binary is compiled for ARM, so won't run anywhere else!

$ file localproxy 
localproxy: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (GNU/Linux), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=e7a17a3bb2695b00016bedf02679aab4cabd0d33, for GNU/Linux 3.7.0, not stripped

The fedora-bin build should work, though it's missing libatomic so you need to yum install it first.

[niros1]

@louix I get the Could not open '/lib/ld-linux-aarch64.so.1' on MAC (2018), which image should I use for mac?

[louix]

@louix I get the Could not open '/lib/ld-linux-aarch64.so.1' on MAC (2018), which image should I use for mac?

I'm not sure what you need, but these are the Dockerfiles I'm using.

# x64
FROM public.ecr.aws/aws-iot-securetunneling-localproxy/fedora-bin
RUN yum install -y libatomic # this is missing in the base image
ENTRYPOINT ["/root/bin/localproxy"] # this is incorrectly "/root/bin" in the base image

# arm64
FROM public.ecr.aws/aws-iot-securetunneling-localproxy/amazonlinux-bin
RUN yum install -y libatomic openssl11 # this is missing in the base image
ENTRYPOINT ["/root/bin/localproxy"] # this is incorrectly "/root/bin" in the base image

[0xbboyd]

@louix I get the Could not open '/lib/ld-linux-aarch64.so.1' on MAC (2018), which image should I use for mac?

I'm not sure what you need, but these are the Dockerfiles I'm using.

# x64
FROM public.ecr.aws/aws-iot-securetunneling-localproxy/fedora-bin
RUN yum install -y libatomic # this is missing in the base image
ENTRYPOINT ["/root/bin/localproxy"] # this is incorrectly "/root/bin" in the base image

# arm64
FROM public.ecr.aws/aws-iot-securetunneling-localproxy/amazonlinux-bin
RUN yum install -y libatomic openssl11 # this is missing in the base image
ENTRYPOINT ["/root/bin/localproxy"] # this is incorrectly "/root/bin" in the base image

This works for me. Thank you.

[HarshGandhi-AWS]

Hello folks, from the last few comments it looks like the issue was resolved and a solution was shared by @0xbboyd. Thank you @0xbboyd for sharing solution. I will close this issue now. Please feel free to reopen this issue or create a new one if you are still facing any issue using local proxy.

Thank you, Harsh Gandhi

[mickeprag]

The "solution" by @0xbboyd is a workaround, not a solution. The real solution is to fix the Docker images so they are usable. Please reopen this since this is not solved. The original issue with the images still remains.

[blthayer]

This issue is not solved. Recent Docker images have the incorrect ENTRYPOINT bug.

I'd also like to note that it's very odd/unintuitive/surprising the way the images are organized - if I want anything other than ARM I have to use the fedora based image which is missing dependencies? Normally I would expect either a different repository for ARM images (e.g. here's a special repository for arm64v8 Ubuntu: https://hub.docker.com/r/arm64v8/ubuntu/) or if you take a look at the standard Ubuntu Dockerhub repository you'll notice there are images under the same tags for multiple architectures (linux/amd64, linux/arm/v7, linux/arm64/v8, etc.).

[HarshGandhi-AWS]

Sorry @mickeprag , we missed your comment earlier. Thank you @blthayer for letting us know that the issue is not resolved. I will reopen the ticket so our team can work on this issue. Please be patient with us until we reproduce and resolve this issue.

[RogerZhongAWS]

Images have been updated with fixes, closing the issue. Feel free to reopen with additional inquiries if needed.