AWS Fargate Windows容器启动报操作系统与宿主不匹配错误如何解决

我尝试在ECS Fargate上部署dotnet core Windows服务，已创建ECS服务和任务定义，二者的Operating system family均指定为Windows Server 2019 Core，但Fargate运行任务时触发如下报错：

Status reason   CannotStartContainerError: ResourceInitializationError: failed to create
new container runtime task: failed to create shim: hcs::CreateComputeSystem c41cc2fa7a284f59bb1f8e037cb5b883-3516356657: 
The container operating system does not match the operating system.

• 服务配置截图：
• 任务定义截图：

关联配置代码 #

Terraform任务定义代码 #

resource "aws_ecs_task_definition" "transform_service" {
  family                   = "${var.app_name}-transform-service-task"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                = 2 * 1024  #2 vCPU
  memory             = 16 * 1024 # 16GB
  execution_role_arn = aws_iam_role.transform_service_task_execution_role.arn

  container_definitions = jsonencode([{
    name      = "transform-service-container-${var.environment}"
    image     = "${var.transform_service_repository_url}:latest"
    essential = true
    environment = [{
      "name" : "DOTNET_ENVIRONMENT", "value" : "Development"
    }]
    },
  ])
}

镜像构建Dockerfile #

FROM mcr.microsoft.com/dotnet/core/runtime:3.1 AS base
WORKDIR /app

FROM mcr.microsoft.com/dotnet/core/sdk:3.1 AS build
WORKDIR /src
COPY ["myapp.DataTransform.Service/myapp.DataTransform.Service.csproj","NuGet.Config", "myapp.DataTransform.Service/"]
# 将NuGet.Config文件复制到容器内，以便执行dotnet restore命令时访问DevOps私有Nuget源仓库
RUN dotnet restore --configfile "myapp.DataTransform.Service/NuGet.Config" "myapp.DataTransform.Service/myapp.DataTransform.Service.csproj"
COPY . .
WORKDIR "/src/myapp.DataTransform.Service"
RUN dotnet build "myapp.DataTransform.Service.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "myapp.DataTransform.Service.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "myapp.DataTransform.Service.dll"]

备注：Terraform暂不支持runtimePlatform属性，我在使用Terraform部署任务后，已通过AWS控制台手动配置了该属性。

该报错核心原因是容器镜像的操作系统版本与Fargate指定的Windows Server 2019 Core宿主版本不匹配，Windows容器要求宿主和容器的操作系统大版本必须严格一致。你当前Dockerfile使用的mcr.microsoft.com/dotnet/core/runtime:3.1是多架构通用标签，若构建环境不是Windows Server 2019，拉取的基础镜像版本会和Fargate宿主不兼容。

修复步骤 #

• 替换Dockerfile的基础镜像为Windows Server 2019专属版本（对应内核版本号1809），修改后Dockerfile开头如下即可，其余步骤保持不变：

  FROM mcr.microsoft.com/dotnet/core/runtime:3.1-nanoserver-1809 AS base
  WORKDIR /app
  
  FROM mcr.microsoft.com/dotnet/core/sdk:3.1-nanoserver-1809 AS build
  WORKDIR /src
  

• 若你在Linux或其他版本Windows系统上构建镜像，执行构建命令时需指定平台参数：

  docker build --platform windows/amd64 -t your-image-name .
  

• 新镜像推送至ECR后，更新ECS任务定义重新启动任务即可。
• 若你的Terraform AWS Provider版本≥3.74.0，已原生支持runtime_platform参数，不需要手动在控制台修改，可直接在Terraform任务定义资源中添加以下配置：

  runtime_platform {
    cpu_architecture = "X86_64"
    operating_system_family = "WINDOWS_SERVER_2019_CORE"
  }
  

内容的提问来源于stack exchange，提问作者Georgi Koemdzhiev