rootfs - Error executing command in chroot #1161
Comments
software-testing-professional
changed the title
software-testing-professional
changed the title
|
I figured out that the problem is caused by The motivation to use Tern as locally installed tool was some authentication issue with out private Docker registry. The easiest solution for me was to switch to the Docker-based Tern, and provide a Docker config.json ( So my problem is solved. :-) |
|
Please reopen this issue. I have the same issue. I need to have my own Dockerfile with Tern in it. I tried it with Ubuntu 21.04 and 22.04. It seems to be always the same issue. The output is: |
|
@Jeeppler can you provide a little more information about how you're running Tern when you see this error? How are you installing Tern and what version are you running? When you say "I need to have my own Dockerfile with Tern in it" -- what Dockerfile are you using? Also, did you try the workaround mentioned here? |
|
@rnjudge thanks for opening the issue again. I installed Tern via I need one more component in the Dockerfile, therefore I need to create my own Dockerfile. The workaround you mentioned does not work for me as I am not having issues with a private Docker registry. @software-testing-professional mentioned that The part weird part is this: for whatever reason the command is empty. This only happens with Alpine images. Debian images can be scanned without any problems. |
|
I will take a look at this today. When you say:
can you share the Dockerfile you use to build Tern? and what is the "one more component" you are needing? |
|
@rnjudge thanks for showing some interest in this issue. We want to integrate Tern into SecHub. As part of the integration we need to have our SecHub Product Delegation Service (PDS) component in the final Docker image. The PDS component ensures, that we run tools in a cluster, either on a VM or even in a Kubernetes cluster. The current state of the Dockerfile is available here: https://github.com/mercedes-benz/sechub/blob/c36d1268ff4e3afeafe71af4693d8425ad8f1e3a/sechub-pds-solutions/tern/docker/Tern-Ubuntu.dockerfile. At the moment I simply build the Dockerfile and went into the container manually to test Tern. Simply running: |
|
@Jeeppler FYI, I am able to reproduce this issue and I'm looking at it. It does seem to be an apk specific issue unique to Ubuntu. When I use a debian based container I don't see this issue. |
|
The When the failing chroot command is run, it should utilize the shell to run the apk commands as you can see in Below is a snippet where you can see that Tern is trying to find the shell that is symlinked pointing to the root of the container. The behavior we're seeing happens because the realpath of the shell utility (i.e. /bin/sh) in a Ubuntu container chroot resolves to In a Debian container, the same command resolves to I can insert a workaround for this to fix the chroot issue we are seeing. |
When Tern ran in a Ubuntu container for images with an `apk` package manager, there was an issue finding the shell which led to a failed package metadata command using chroot. This commit adds a workaround to make sure Tern can find a shell when running in a Ubuntu container, specifically when the shell is symlinked to busybox for the container being analyzed. A more detailed description of the problem can be found in the bug report[1]. It's unclear exactly why the realpath fails to resolve to the correct utility location when Tern runs in a Ubuntu container while analyzing apk-based container images. For now, this commit is meant as a workaround for this exceptional case that is blocking several users. [1]tern-tools#1161 Resolves tern-tools#1161 Signed-off-by: Rose Judge <[email protected]>
|
@rnjudge thanks for analyzing the problem and finding the root cause. |
|
@Jeeppler are you able to test the fix at all? I tested it myself bu would love a second set of eyes on it! I'm planning a patch release to include this fix as well. |
|
@rnjudge yes, I can confirm, that I am now able to scan both |
When Tern ran in a Ubuntu container for images with an `apk` package manager, there was an issue finding the shell which led to a failed package metadata command using chroot. This commit adds a workaround to make sure Tern can find a shell when running in a Ubuntu container, specifically when the shell is symlinked to busybox for the container being analyzed. A more detailed description of the problem can be found in the bug report[1]. It's unclear exactly why the realpath fails to resolve to the correct utility location when Tern runs in a Ubuntu container while analyzing apk-based container images. For now, this commit is meant as a workaround for this exceptional case that is blocking several users. [1]#1161 Resolves #1161 Signed-off-by: Rose Judge <[email protected]>
|
@rnjudge thanks for fixing the issue. |
I'm running Tern in an Ubuntu 20.04 container, along with some other CycloneDX / BOM tools.
When I try to run a scan on an existing Docker image, these ERROR messages show up:
The installed Python is 3.8.10
Do you have any idea how I can fix this?
Best regards,
Michael
The text was updated successfully, but these errors were encountered: