AWS ECS EC2模式运行Task Definition报CannotStartContainerError求助

• 已创建适配EC2实例、计划承载4个容器、采用bridge默认网络模式的ECS Task Definition，在集群中启动任务时，任务最终终止，状态显示为STOPPED，触发报错CannotStartContainerError: Error response from daemon
• 任务详情页展示的完整错误日志为：

CannotStartContainerError: Error response from daemon: OCI runtime create failed: container_linux.go:370: starting container process caused: process_linux.go:338: getting the final child's pid from pipe caused: read init-p: connection

{
    "ipcMode": null,
    "executionRoleArn": "arn:aws:iam::102692121977:role/ecsTaskExecutionRole",
    "containerDefinitions": [
        {
            "dnsSearchDomains": null,
            "environmentFiles": null,
            "logConfiguration": {
                "logDriver": "awslogs",
                "secretOptions": null,
                "options": {
                    "awslogs-group": "/ecs/Greeting",
                    "awslogs-region": "us-west-2",
                    "awslogs-stream-prefix": "ecs"
                }
            },
            "entryPoint": null,
            "portMappings": [
                {
                    "hostPort": 8082,
                    "protocol": "tcp",
                    "containerPort": 8082
                }
            ],
            "command": null,
            "linuxParameters": null,
            "cpu": 0,
            "environment": [],
            "resourceRequirements": null,
            "ulimits": null,
            "dnsServers": null,
            "mountPoints": [],
            "workingDirectory": null,
            "secrets": null,
            "dockerSecurityOptions": null,
            "memory": null,
            "memoryReservation": null,
            "volumesFrom": [],
            "stopTimeout": null,
            "image": "102692121977.dkr.ecr.us-west-2.amazonaws.com/hamilton-greeting:latest",
            "startTimeout": null,
            "firelensConfiguration": null,
            "dependsOn": null,
            "disableNetworking": null,
            "interactive": null,
            "healthCheck": null,
            "links": null,
            "hostname": null,
            "extraHosts": null,
            "pseudoTerminal": null,
            "user": null,
            "readonlyRootFilesystem": null,
            "dockerLabels": null,
            "systemControls": null,
            "privileged": null,
            "name": "greeting"
        }
    ],
    "memory": "1",
    "taskRoleArn": "arn:aws:iam::102692121977:role/ecsTaskExecutionRole",
    "family": "Greeting",
    "pidMode": null,
    "requiresCompatibilities": [
        "EC2"
    ],
    "networkMode": "bridge",
    "cpu": "1024",
    "inferenceAccelerators": [],
    "proxyConfiguration": null,
    "volumes": [],
    "placementConstraints": [],
    "tags": []
}

• 为所有容器的entrypoint添加sh,-c，执行修改后报错未消失。

• 核心配置错误：当前Task Definition顶层设置的任务总内存值为1，EC2启动类型下该字段的计数单位为MiB，仅相当于给整个任务组分配1MiB的可用内存，完全无法支撑容器init进程运行。进程在启动阶段就会被内核OOM逻辑终止，导致OCI runtime无法从管道获取子进程的PID信息，最终触发连接中断的报错。
  修正操作：根据容器实际运行需求，将memory字段调整为合理值，例如无特殊运行需求的基础服务可先设置256、512等梯度值，匹配当前配置的cpu:1024（1核CPU）的资源配额。
• 完成核心配置修正后，若仍出现同类报错，按以下方向排查：
  • 登录承载任务的EC2实例，执行dmesg | grep -i oom查看内核日志，确认是否存在资源配额不足导致的进程被杀记录
  • 检查EC2实例上的Docker/containerd版本，确认与运行的镜像架构兼容，避免runtime不匹配导致init进程启动失败
  • 校验EC2集群的剩余可分配资源，确认实例剩余内存能够满足Task Definition的总资源要求，避免资源抢占导致任务被强制终止

内容的提问来源于stack exchange，提问作者Francisco_Lucca