使用Terraform部署Azure Web App时遇可执行文件找不到错误

错误日志 #

2023-09-28T11:43:21.777Z INFO - latest Pulling from censored-user/censored-app-v1
2023-09-28T11:43:21.788Z INFO - 445a6a12be2b Already exists
2023-09-28T11:43:21.819Z INFO - d0cea56d3b74 Already exists
2023-09-28T11:43:21.823Z INFO - e2556305f3e2 Already exists
2023-09-28T11:43:21.825Z INFO - e2556305f3e2 Already exists
2023-09-28T11:43:22.546Z INFO - Digest: sha256:e17ed63b24b560768925aed0c653a554ba769a804277a8f22bace8816db2434e
2023-09-28T11:43:22.548Z INFO - Status: Downloaded newer image for censored-user/censored-app-v1:latest
2023-09-28T11:43:22.562Z INFO - Pull Image successful, Time taken: 0 Minutes and 2 Seconds
2023-09-28T11:43:22.613Z INFO - Starting container for site
2023-09-28T11:43:22.614Z INFO - docker run -d --expose=8000 --name censored-app-web-app_0_f98214f0 -e WEBSITE_SITE_NAME=censored-app-web-app -e WEBSITE_AUTH_ENABLED=False -e PORT=8000 -e WEBSITE_ROLE_INSTANCE_ID=0 -e WEBSITE_HOSTNAME=censored-app-web-app.azurewebsites.net -e WEBSITE_INSTANCE_ID=eb80censoredid -e WEBSITE_USE_DIAGNOSTIC_SERVER=False censored-user/censored-app-v1:latest

2023-09-28T11:43:22.615Z INFO - Logging is not enabled for this container.
Please use https://aka.ms/linux-diagnostics to enable logging to see container logs here.
2023-09-28T11:43:23.486Z ERROR - Container start failed for censored-web-app_0_f98214f0 with System.AggregateException, One or more errors occurred. (Docker API responded with status code=BadRequest, response={"message":"failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: \"../censored-app\": stat ../censored-app: no such file or directory: unknown"}
)
InnerException: Docker.DotNet.DockerApiException, Docker API responded with status code=BadRequest, response={"message":"failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: \"../censored-app\": stat ../censored-app: no such file or directory: unknown"}


2023-09-28T11:43:23.727Z INFO - Stopping site censored-web-app because it failed during startup.

关联文件 #

Dockerfile #

FROM rust AS builder

WORKDIR /usr/src/app

COPY . .

RUN apt-get update
RUN apt-get install llvm-dev libclang-dev clang autoconf automake autotools-dev g++ gcc build-essential -y

RUN make clean
RUN make build

FROM ubuntu:22.04

ARG build_number=dev
ENV BUILD_NUMBER=${build_number}

WORKDIR /home/app
COPY --from=builder /usr/src/app/censored-app-dir/target/release/censored-app . 

ENV BUILD_NUMBER=${build_number}
RUN chmod +x ./censored-app

EXPOSE 8000

ENTRYPOINT [ "./censored-app" ]

Terraform配置 #

data "external" "env" {
  program = ["sh", "${path.module}/env.sh"]
}

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "3.73.0"
    }
  }

  required_version = ">= 1.1.0"
}

provider "azurerm" {
  features {}
}


resource "azurerm_resource_group" "resource_group" {
  name     = "Censored-Ressourcegroup"
  location = "germanywestcentral"
}

resource "azurerm_service_plan" "service_plan" {
  name = "Censored-service-plan"
  resource_group_name = azurerm_resource_group.resource_group.name
  location = azurerm_resource_group.resource_group.location
  os_type = "Linux"
  sku_name = "B1"
}

resource "azurerm_linux_web_app" "web_app" {
  name = "censored-web-app"
  resource_group_name = azurerm_resource_group.resource_group.name
  location =  azurerm_service_plan.service_plan.location
  service_plan_id = azurerm_service_plan.service_plan.id

  site_config {
    always_on = false

    application_stack {
      docker_image_name = "censored-user/censored-v1:latest"
      # docker_registry_url = "https://registry.hub.docker.com"
      # docker_registry_username = "cesored-user"
      # docker_registry_password = "***"
    }
  }
}

已尝试的方案 #

• 本地多环境验证：M1 Mac原生/转x86、x86 Ubuntu Desktop构建运行容器均正常
• Dockerfile调整：改用CMD替代ENTRYPOINT、更换基础镜像为ubuntu:23.01
• Terraform配置调整：指定Docker Registry参数/不指定参数，镜像设为公开
• Azure门户手动部署：镜像运行正常
• 更换全新Azure账号部署：问题依旧

解决方案 #

错误核心是容器启动时找不到指定的可执行文件，虽然Dockerfile中设置了WORKDIR，但Azure Web App Linux环境可能会在启动容器时修改工作目录，导致相对路径失效。

1. 修改Dockerfile使用绝对路径作为ENTRYPOINT #

将ENTRYPOINT [ "./censored-app" ]改为：

ENTRYPOINT [ "/home/app/censored-app" ]

重新构建并推送镜像后，用Terraform重新部署。

2. 在Terraform中显式指定容器工作目录 #

在azurerm_linux_web_app的site_config中添加working_directory参数，匹配Dockerfile中的工作目录：

resource "azurerm_linux_web_app" "web_app" {
  # ... 其他配置 ...

  site_config {
    always_on = false
    working_directory = "/home/app" # 添加这一行

    application_stack {
      docker_image_name = "censored-user/censored-v1:latest"
      # ... 其他配置 ...
    }
  }
}

3. 检查镜像名称一致性 #

注意到错误日志中拉取的镜像为censored-user/censored-app-v1:latest，但Terraform配置中写的是censored-user/censored-v1:latest，确认两者是同一镜像，避免因名称错误导致部署了旧的有问题镜像。

内容的提问来源于stack exchange，提问作者Vubito32