Segmentation fault building project on dotnet/sdk:7.0 image with Apple M1

[jon-mca]

Describe the Bug

Running into a problem where creating a docker image from mcr.microsoft.com/dotnet/sdk:7.0 on an M1 Apple MacBook Pro throws a segmentation fault from package qemu during publish.

ERROR [publish 8/8] RUN dotnet publish "MyProject.csproj" -c Release -o /app/publish --self-conta  6.7s
 > [publish 8/8] RUN dotnet publish "MyProject.csproj" -c Release -o /app/publish --self-contained -r linux-x64:
#15 2.836 MSBuild version 17.4.0+18d5aef85 for .NET
#15 6.456 qemu: uncaught target signal 11 (Segmentation fault) - core dumped
#15 6.729 Segmentation fault

The docker file looks like this, which worked previously with the .NET Core 6 SDK image (changed to point to 7.0 images):

FROM mcr.microsoft.com/dotnet/sdk:7.0 AS publish
WORKDIR /src
COPY [".", "."]
WORKDIR "/src/MyProject"
RUN dotnet publish "MyProject.csproj" -c Release -o /app/publish --self-contained -r linux-x64

FROM mcr.microsoft.com/dotnet/runtime-deps:7.0 AS final
WORKDIR /app
COPY --from=publish /app/publish .
EXPOSE 80
EXPOSE 443
ENTRYPOINT ["./MyProject"]

My suspicion is that the SDK 7.0 base image that is being pulled from docker is not the ARM64 tagged variant, .i.e. Linux Arm64, and what is being used is not compatiable with the the M1.

Steps to Reproduce

Run dockerfile on an M1 equipped Apple Mac computer.

Other Information

A workaround for this issue is to explicity set the SDK base image to use the Linux Arm64 (7.0-bullseye-slim-arm64v8) tagged SDK image:

FROM mcr.microsoft.com/dotnet/sdk:7.0-bullseye-slim-arm64v8 AS publish
WORKDIR /src
COPY [".", "."]
WORKDIR "/src/MyProject"
RUN dotnet publish "MyProject.csproj" -c Release -o /app/publish --self-contained -r linux-x64

FROM mcr.microsoft.com/dotnet/runtime-deps:7.0 AS final
WORKDIR /app
COPY --from=publish /app/publish .
EXPOSE 80
EXPOSE 443
ENTRYPOINT ["./MyProject"]

...or a better workaround example is to provide the tag to use via --build-arg and pass "7.0-bullseye-slim-arm64v8" as a value otherwise it'll default to "7.0":

ARG SDK_TAG=7.0
FROM mcr.microsoft.com/dotnet/sdk:${SDK_TAG} AS publish
WORKDIR /src
COPY [".", "."]
WORKDIR "/src/MyProject"
RUN dotnet publish "MyProject.csproj" -c Release -o /app/publish --self-contained -r linux-x64

FROM mcr.microsoft.com/dotnet/runtime-deps:7.0 AS final
WORKDIR /app
COPY --from=publish /app/publish .
EXPOSE 80
EXPOSE 443
ENTRYPOINT ["./MyProject"]

Output of docker version

Client: Docker Engine - Community
 Version:           20.10.21
 API version:       1.41
 Go version:        go1.19.2
 Git commit:        baeda1f82a
 Built:             Tue Oct 25 17:53:02 2022
 OS/Arch:           darwin/arm64
 Context:           desktop-linux
 Experimental:      true

Server: Docker Desktop 4.14.1 (91661)
 Engine:
  Version:          20.10.21
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.18.7
  Git commit:       3056208
  Built:            Tue Oct 25 17:59:41 2022
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          1.6.9
  GitCommit:        1c90a442489720eec95342e1789ee8a5e1b9536f
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Output of docker info

Client:
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc., v0.9.1)
  compose: Docker Compose (Docker Inc., v2.12.2)
  dev: Docker Dev Environments (Docker Inc., v0.0.3)
  extension: Manages Docker extensions (Docker Inc., v0.2.13)
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc., 0.6.0)
  scan: Docker Scan (Docker Inc., v0.21.0)

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 17
 Server Version: 20.10.21
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 1c90a442489720eec95342e1789ee8a5e1b9536f
 runc version: v1.1.4-0-g5fd4c4d
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
  cgroupns
 Kernel Version: 5.15.49-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: aarch64
 CPUs: 6
 Total Memory: 7.765GiB
 Name: docker-desktop
 ID: CNTH:R6D7:QFEW:INEF:X2VS:DWGM:JCQF:HCQG:OO3S:J4P2:J7YX:A4XF
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5000
  127.0.0.0/8
 Live Restore Enabled: false

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[mthalman]

My suspicion is that the SDK 7.0 base image that is being pulled from docker is not the ARM64 tagged variant, .i.e. Linux Arm64, and what is being used is not compatiable with the the M1.

This can be verified by including the following instruction to be executed within the SDK container:

RUN dotnet --info

That will indicate the architecture in the output. If it's not getting the Arm64 image, that's related to Docker and not the 7.0 tag. You can see that the 7.0 tag is configured to serve up an Arm64 image:

> docker manifest inspect mcr.microsoft.com/dotnet/sdk:7.0
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
   "manifests": [
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "size": 2009,
         "digest": "sha256:77f18f87a309d53015601a388f0108e8e0742b98cade2ba5276605799e662b09",
         "platform": {
            "architecture": "amd64",
            "os": "linux"
         }
      },
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "size": 2009,
         "digest": "sha256:a47ea685326c54067b7819d00bf0cb03e98e56c202bbbab22a4bb249cb2977d5",
         "platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v7"
         }
      },
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "size": 2008,
         "digest": "sha256:37062ef2dc44d9e3f4d82632c28702833d7578ae9da4cf40ff52a080e844bd48",
         "platform": {
            "architecture": "arm64",
            "os": "linux",
            "variant": "v8"
         }
      },
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "size": 3854,
         "digest": "sha256:03f882c3dbb4ac697ff9fe4191d4892144318836986bf95f5b7dc67813b8861d",
         "platform": {
            "architecture": "amd64",
            "os": "windows",
            "os.version": "10.0.17763.3650"
         }
      },
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "size": 3855,
         "digest": "sha256:4cff7618d17797f0e9bfe534890564a98326c98260f434a953ff340c5f8eb5d1",
         "platform": {
            "architecture": "amd64",
            "os": "windows",
            "os.version": "10.0.20348.1249"
         }
      }
   ]
}

Is your M1 machine running Docker Desktop for Apple Silicon as opposed to Intel via emulation? See https://docs.docker.com/desktop/install/mac-install/.

Note that you can explicitly configure which architecture is targeted when you pull an image as well by using docker pull --platform linux/arm64 mcr.microsoft.com/dotnet/sdk:7.0.

[crodriguesbr]

HI! I have the same problem.
Running directly on the Apple M2, my program runs correctly, but if I put the same compiled program inside a container, I get the Segment Fault message.
Any idea?

My Settings
Dockerfile
FROM mcr.microsoft.com/dotnet/aspnet:7.0-alpine3.16-arm64v8

Build
dotnet build --no-restore --configuration Release

Publish
dotnet publish --no-restore --no-build --configuration Release --output /publish

[jon-mca]

Hi @mthalman,

Thanks for getting back to me, I get what you are saying although working with the 6.0 SDK image I didn't need to do configure docker to explicity only pull down the Arm64 variants of the image that is registered in the manifest where it would appear it resolves the correct one automatically although I'll need to prove this by what you suggest with getting what the dotnet --info outputs.

I'll get back to you, thanks for your help.

[jon-mca]

Also re-installed docker targeting Apple Silicon just to be on the safe side in case I mistakenly installed the intel based one just so you know.

[PeterHagen]

I use docker buildx to create the linux container on M1. This worked fine on .Net 6 with adding -p "linux/amd64" as parameters. With .Net 7 I get a segmentation fault exception on doing dotnet restore or build. When I remove the explicit platform parameter, it does build the image, but I can't run it on linux. The logs say: exec /usr/bin/dotnet: exec format error. I expect this to be the same issue.

[mthalman]

@PeterHagen - Can you include RUN dotnet -info in your Dockerfile as part of the SDK stage? I'd like to know the output of that.

[richlander]

This writeup may help: #3848

[PeterHagen]

@PeterHagen - Can you include RUN dotnet -info in your Dockerfile as part of the SDK stage? I'd like to know the output of that.

Here you go:

#7 [ 3/13] RUN dotnet --info
#7 2.525 .NET SDK:
#7 2.526  Version:   7.0.100
#7 2.526  Commit:    e12b7af219
#7 2.527 
#7 2.527 Runtime Environment:
#7 2.539  OS Name:     debian
#7 2.539  OS Version:  11
#7 2.557  OS Platform: Linux
#7 2.651  RID:         debian.11-x64
#7 2.651  Base Path:   /usr/share/dotnet/sdk/7.0.100/
#7 2.664 
#7 2.664 Host:
#7 2.664   Version:      7.0.0
#7 2.664   Architecture: x64
#7 2.664   Commit:       d099f075e4
#7 2.664 
#7 2.664 .NET SDKs installed:
#7 2.664   7.0.100 [/usr/share/dotnet/sdk]
#7 2.664 
#7 2.664 .NET runtimes installed:
#7 2.664   Microsoft.AspNetCore.App 7.0.0 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
#7 2.664   Microsoft.NETCore.App 7.0.0 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
#7 2.664 
#7 2.664 Other architectures found:
#7 2.664   None
#7 2.664 
#7 2.664 Environment variables:
#7 2.664   Not set
#7 2.664 
#7 2.664 global.json file:
#7 2.664   Not found
#7 2.664 
#7 2.664 Learn more:
#7 2.664   https://aka.ms/dotnet/info
#7 2.664 
#7 2.664 Download .NET:
#7 2.664   https://aka.ms/dotnet/download

[mthalman]

@PeterHagen - What gets output when you execute this command: docker run --rm debian uname -a

[crodriguesbr]

I found my problem, using strace. I had included in my Dockerfile the Datadog APM Agent for alpine because my dotnet base image was alpine for ARM64, I changed it to the debian image and changed the Datadot APM Agent as well. It worked correctly. I'm using buildx to generate the image build.