I have a Rust binary that I want to run in a container. It works fine when I use a ubuntu
or even gcr.io/distroless/cc
as the base image, but when I tried running from the scratch
image, I ran into some problems. This is obviously because some files are expected to be on the filesystem that aren't there. I was able to work out how to get the CA root certificates installed, but now I get a different error that seems to happen when the binary tries to do a DNS lookup.
My Dockerfile looks mostly like this (I trimmed off some build optimizations):
FROM rust:latest as cargo-build
WORKDIR /build
ENV RUSTFLAGS="-C target-feature=+crt-static"
COPY aggregator/ ./
RUN cargo build --release --target x86_64-unknown-linux-gnu
#####################################
FROM alpine:3.6 as ca-certificates
RUN apk add -U --no-cache ca-certificates
#####################################
FROM scratch
COPY --from=cargo-build /build/target/x86_64-unknown-linux-gnu/release/aggregator /entrypoint
COPY --from=ca-certificates /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
ENTRYPOINT [ "/entrypoint" ]
The error I get when running (from the Rust binary) is:
Error: Failed to load job description from S3
Caused by:
0: io error: error trying to connect: dns error: Device or resource busy (os error 16)
1: io error: error trying to connect: dns error: Device or resource busy (os error 16)
2: error trying to connect: dns error: Device or resource busy (os error 16)
3: dns error: Device or resource busy (os error 16)
4: Device or resource busy (os error 16)
I Googled the error and was able to find another Rust/Docker project with the same error, but they "fixed" the problem by switching from scratch
to gcr.io/distroless/cc
as the base image, and I would like to avoid that by understanding what the problem is.
Looking at the file-system, it seems to have a minimal network configuration, but I might be wrong.
.
├── dev
│ ├── console
│ ├── pts
│ └── shm
├── entrypoint
├── etc
│ ├── hostname
│ ├── hosts
│ ├── mtab -> /proc/mounts
│ ├── resolv.conf
│ └── ssl
│ └── certs
│ └── ca-certificates.crt
├── proc
└── sys
Like I wrote, this works fine with other base images, so what am I missing to get a networked Rust binary to run from "scratch"?
RUSTFLAGS="-C target-feature=+crt-static"
does make my app completely static. At least, runningldd
on it tells me it's not a dynamically linked binary, and lists no dependecies.