Question 105492 in Azure Question posted in
The official documentation to get you started can be found here.

Azure Web App with custom docker image SSH

I have a custom docker image with php-apache running (FROM php:7.4-apache-bullseye) deployed from an azure registry via push webhook. The webapp has a storage mounted for persistent data . .png images should be served from there but always fail with 400 when served.
It works on my local machine and on a test environment with dedicated hardware.
followed following documentation (https://learn.microsoft.com/en-us/azure/app-service/configure-custom-container?pivots=container-linux#enable-ssh)

So my guess would be to check the app via ssh and see permissions and links created in docker image file.
But when trying to start the ssh service on the container the deployment of the image fails.

This is the Docker file

FROM php:7.4-apache-bullseye

RUN apt-get update && 
    apt-get install supervisor cron 
            nano git zip libpq-dev 
            certbot python3-certbot-apache 
            nodejs npm redis-server gnupg gdal-bin wget libzip-dev -y

RUN ln -fs /usr/share/zoneinfo/Europe/Vienna /etc/localtime
RUN docker-php-ext-install pdo pdo_pgsql pgsql gettext zip

COPY api/. /var/www/api/
WORKDIR /var/www/api/

RUN ln -s /var/www/data_persistent/maps /var/www/api/public/maps

RUN ln -fs /var/www/data_persistent/config/.env /var/www/api/.env
RUN mkdir -p /var/www/api/storage/logs && chmod 777 -R /var/www/api/storage
RUN mkdir -p /var/www/api/storage/app/tmp && chmod 777 -R /var/www/api/storage/app/tmp
RUN mkdir -p /var/www/api/storage/app/raw_data && chmod 777 -R /var/www/api/storage/app/raw_data

RUN mkdir -p /var/www/data_persistent/storage/logs

RUN ln -fs /var/www/api/storage/logs /var/www/data_persistent/storage/logs
RUN chmod 777 -R /var/www/data_persistent/storage/logs

RUN php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
RUN php composer-setup.php
RUN php -r "unlink('composer-setup.php');"


RUN php -d memory_limit=2G composer.phar --quiet install
RUN php -d memory_limit=2G composer.phar --quiet update


ADD config/cronjobs /var/www/cronjobs
RUN crontab -u www-data /var/www/cronjobs

ADD config/apache/xxx.conf /etc/apache2/sites-available/xxx.conf

RUN a2ensite api.arteria.conf

RUN a2enmod rewrite
RUN a2dissite 000-default

ADD config/php.ini /usr/local/etc/php/conf.d/php.ini
ADD config/supervisor_apache.conf /etc/supervisor/conf.d/apache.conf
ADD config/supervisor_cron.conf /etc/supervisor/conf.d/cron.conf

CMD [ "/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/supervisord.conf" ]

RUN  apt-get install --yes --no-install-recommends openssh-server && echo "root:Docker!" | chpasswd 
COPY sshd_config /etc/ssh/
RUN mkdir -p /temp
COPY ssh_setup.sh /temp
COPY init.sh /usr/local/bin/
RUN chmod u+x /usr/local/bin/init.sh
RUN chmod +x /temp/ssh_setup.sh && (sleep 1;/temp/ssh_setup.sh 2>&1 > /dev/null)

EXPOSE 80 2222
# if this is used the app won't start
# ENTRYPOINT ["init.sh"]

withoug sshd running I get az_command_data_logger: SSH is not enabled for this app. To enable SSH follow this instructions: https://go.microsoft.com/fwlink/?linkid=2132395
when trying to ssh through az webapp create-remote-connection
through azure portal it also does not work.
I tried to start ssh via different methods:
In the portal for webapp through startup command under configuration > general settings > Startup Command service ssh start or via startup file or command under deployment center
Or via the init.sh as seen above in the dockerfile

init.sh

#!/bin/bash
set -e

echo "Starting SSH ..."
service ssh start
# service apache2 start

When service ssh start is executed I get following output:

docker run -d --expose=8081 --name webapp_msiProxy -e WEBSITE_ROLE_INSTANCE_ID=0 -e WEBSITE_HOSTNAME=webapp -e WEBSITE_INSTANCE_ID=e262ff50b02bc79dfcf96feacb75832df6ff0f14dccff63ca6ee6cb3eb18fb7d -e HTTP_LOGGING_ENABLED=1 -e WEBSITE_USE_DIAGNOSTIC_SERVER=False mcr.microsoft.com/appsvc/msitokenservice:stage5
ca6ee6cb3eb18fb7d -e HTTP_LOGGING_ENABLED=1 -e WEBSITE_USE_DIAGNOSTIC_SERVER=False xxx.azurecr.io/xxx.img:latest service ssh start
2022-07-29T10:45:56.254Z INFO  - Initiating warmup request to container webapp_msiProxy for site webapp-test
2022-07-29T10:45:56.268Z INFO  - Container webapp_msiProxy for site webapp-test initialized successfully and is ready to serve requests.
2022-07-29T10:45:56.269Z INFO  - Initiating warmup request to container webapp for site webapp-test
2022-07-29T10:45:55.683051217Z Starting OpenBSD Secure Shell server: sshd.
2022-07-29T10:46:26.288Z ERROR - Container webapp for site webapp-test has exited, failing site start
2022-07-29T10:46:26.342Z ERROR - Container webapp didn't respond to HTTP pings on port: 80, failing site start. See container logs for debugging.
2022-07-29T10:46:26.349Z INFO  - Stopping site webapp-test because it failed during startup.

This is the output without ssh:

docker run -d --expose=8081 --name xxx-webapp_0_ff4e7ae0_msiProxy -e WEBSITE_ROLE_INSTANCE_ID=0 -e WEBSITE_HOSTNAME=xxx-webapp.azurewebsites.net -e WEBSITE_INSTANCE_ID=e262ff50b02bc79dfcf96feacb75832df6ff0f14dccff63ca6ee6cb3eb18fb7d -e HTTP_LOGGING_ENABLED=1 -e WEBSITE_USE_DIAGNOSTIC_SERVER=False mcr.microsoft.com/appsvc/msitokenservice:stage5
ca6ee6cb3eb18fb7d -e HTTP_LOGGING_ENABLED=1 -e WEBSITE_USE_DIAGNOSTIC_SERVER=False xxx.azurecr.io/xxx.img:latest
2022-07-29T10:48:34.739Z INFO  - Initiating warmup request to container xxx-webapp_0_ff4e7ae0_msiProxy for site xxx-webapp
2022-07-29T10:48:34.779Z INFO  - Container xxx-webapp_0_ff4e7ae0_msiProxy for site xxx-webapp initialized successfully and is ready to serve requests.
2022-07-29T10:48:34.787Z INFO  - Initiating warmup request to container xxx-webapp_0_ff4e7ae0 for site xxx-webapp
2022-07-29T10:48:42.885Z INFO  - Container xxx-webapp_0_ff4e7ae0 for site xxx-webapp initialized successfully and is ready to serve requests.
2022-07-29T10:48:35.227542248Z 2022-07-29 12:48:35,227 CRIT Supervisor is running as root.  Privileges were not dropped because no user is specified in the config file.  If you intend to run as root, you can set user=root in the config file to avoid this message.
2022-07-29T10:48:35.228230140Z 2022-07-29 12:48:35,227 INFO Included extra file "/etc/supervisor/conf.d/apache.conf" during parsing
2022-07-29T10:48:35.228240839Z 2022-07-29 12:48:35,227 INFO Included extra file "/etc/supervisor/conf.d/cron.conf" during parsing
2022-07-29T10:48:35.238925508Z 2022-07-29 12:48:35,238 INFO RPC interface 'supervisor' initialized
2022-07-29T10:48:35.239285403Z 2022-07-29 12:48:35,239 CRIT Server 'unix_http_server' running without any HTTP authentication checking
2022-07-29T10:48:35.239799097Z 2022-07-29 12:48:35,239 INFO supervisord started with pid 1
2022-07-29T10:48:36.242902830Z 2022-07-29 12:48:36,242 INFO spawned: 'apache' with pid 6
2022-07-29T10:48:36.248647159Z 2022-07-29 12:48:36,248 INFO spawned: 'crond' with pid 7
2022-07-29T10:48:36.318576997Z 2022-07-29 12:48:36,318 INFO exited: crond (exit status 0; not expected)
2022-07-29T10:48:38.121554193Z 2022-07-29 12:48:38,117 INFO success: apache entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2022-07-29T10:48:38.121575092Z 2022-07-29 12:48:38,119 INFO spawned: 'crond' with pid 24
2022-07-29T10:48:38.142769832Z 2022-07-29 12:48:38,142 INFO exited: crond (exit status 1; not expected)
2022-07-29T10:48:40.151821925Z 2022-07-29 12:48:40,151 INFO spawned: 'crond' with pid 25
2022-07-29T10:48:40.165754654Z 2022-07-29 12:48:40,165 INFO exited: crond (exit status 1; not expected)
2022-07-29T10:48:43.183743813Z 2022-07-29 12:48:43,183 INFO spawned: 'crond' with pid 27
2022-07-29T10:48:43.199486212Z 2022-07-29 12:48:43,199 INFO exited: crond (exit status 1; not expected)
2022-07-29T10:48:43.206808218Z 2022-07-29 12:48:43,206 INFO gave up: crond entered FATAL state, too many start retries too quickly
2022-07-29T10:48:28.166356219Z Warning! Cannot copy to bundle: /usr/local/share/ca-certificates/azure
2022-07-29T10:48:28.277052555Z WARNING: ca-certificates.crt does not contain exactly one certificate or CRL: skipping
2022-07-29T10:48:28.277948042Z WARNING: ca-cert-azure.pem does not contain exactly one certificate or CRL: skipping
2022-07-29T10:48:28.327528842Z Updated CA certificates
2022-07-29T10:48:30.698311225Z xxx-webapp : [00000000-0000-0000-0000-000000000000] Configuration update started. Site: xxx-webapp
2022-07-29T10:48:30.726927164Z xxx-webapp : [00000000-0000-0000-0000-000000000000] [SystemAssigned] Added Identity with ClientId: xxx
2022-07-29T10:48:30.736592542Z xxx-webapp : [00000000-0000-0000-0000-000000000000] Starting TokenService version 2.0.1.3 from /app with the LinuxDedicated SKU. Environment check: IsLinuxDedicated: True, IsLinuxConsumption: False, IsContainerApps: False, IsWindows: False.
2022-07-29T10:48:30.826680307Z Hosting environment: Production
2022-07-29T10:48:30.827249799Z Content root path: /app
2022-07-29T10:48:30.827698194Z Now listening on: http://[::]:8081
2022-07-29T10:48:30.827708094Z Application started. Press Ctrl+C to shut down.
2022-07-29T10:48:31.777800925Z xxx-webapp : [b88231af-dab1-43db-9923-652be3046246] Incoming request on /healthcheck?api-version=2021-08-01
2022-07-29T10:48:31.787418304Z xxx-webapp : [b88231af-dab1-43db-9923-652be3046246] Request to TokenService: Endpoint x.x.x.x, Port 8081, Path /healthcheck, Query ?api-version=2021-08-01, Method GET, UserAgent HealthCheck/1.0
2022-07-29T10:48:32.010089499Z xxx-webapp : [b88231af-dab1-43db-9923-652be3046246] Returning response for Site , Endpoint x.x.x.x, Port 8081, Path /healthcheck, Method GET, Result = 200
2022-07-29T10:48:34.787364778Z xxx-webapp : [eb1f772a-fb57-463d-95cb-6e0e80859348] Incoming request on /robots933456.txt
2022-07-29T10:48:34.787391378Z xxx-webapp : [eb1f772a-fb57-463d-95cb-6e0e80859348] Request to TokenService: Endpoint x.x.x.x, Port 8081, Path /robots933456.txt, Query , Method GET, UserAgent HealthCheck/1.0
2022-07-29T10:48:34.787396478Z xxx-webapp : [eb1f772a-fb57-463d-95cb-6e0e80859348] Returning response for Site , Endpoint x.x.x.x, Port 8081, Path /robots933456.txt, Method GET, Result = 404

I’m thankful for any ideas or directions on this one.

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    I have found the issue which was quite a journey.
    It was the CMD line in the docker file which was not executed anymore with the ENTRYPOINT directive and the container just shut down after executing the scripts (because there was no foreground task running anymore).
    I had to remove the CMD directive and added it to the init.sh while also moving from bin/bash to bin/sh:

    #!/bin/sh
set -e
ssh-keygen -A
#prepare run dir
if [ ! -d "/var/run/sshd" ]; then
  mkdir -p /var/run/sshd
fi

echo "Starting SSH ..."
service ssh start

/usr/bin/supervisord -n -c /etc/supervisor/supervisord.conf
exec "$@"

  2. 0

    • Try adding ENTRYPOINT [ "/app/init_container.sh" ] at the end of the docker file.

    • The docker file doesn’t have reference to the init_container.sh
      enter image description here

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search