building image for a non http service

[matthiasverstraete]

Hi,

I'm trying to build a slim version of my docker image which exposes an opcua service. As it's not using http, I'm using a custom script as probe. The command I'm using at the moment looks like this:

slim build --tag my_image:slim --cmd="python ." --mount /path/to/opc_health_check.py:/opc_health_check.py --http-probe=false --exec="/opc_health_check.py" --target my_image:0.25.0 --show-clogs=true

However, the script seems to fail to connect to my service. Also, the logs of the container that are printed at the end, don't look like the logs I would get when running my image normally.

Output currently looks like this:

cmd=build info=exec message='changing continue-after from probe to nothing because http-probe is disabled' 
cmd=build info=exec message='updating continue-after mode to exec' 
cmd=build state=started
cmd=build info=params target.type='image' target.image='my_image:0.25.0' continue.mode='exec' rt.as.user='true' keep.perms='true' tags='my_image:slim' image-build-engine='internal' 
cmd=build state=image.inspection.start
cmd=build info=image id='sha256:cddf8378e682925a0a657cb5a597be53e9b907eb2b5e291ccec1fd35ec2ca725' size.bytes='21339178594' size.human='21 GB' 
cmd=build info=image.stack name='my_image:0.25.0' id='sha256:cddf8378e682925a0a657cb5a597be53e9b907eb2b5e291ccec1fd35ec2ca725' index='0' 
cmd=build info=image.exposed_ports list='9999/tcp' 
cmd=build state=image.inspection.done
cmd=build state=container.inspection.start
cmd=build info=container id='a2c2ccbd0110d5edf70515f37982f0b471fb46a0efc1258a8410a6a0b5f18b84' status='created' name='slimk_84526_20241029114112' 
cmd=build info=container name='slimk_84526_20241029114112' id='a2c2ccbd0110d5edf70515f37982f0b471fb46a0efc1258a8410a6a0b5f18b84' status='running' 
cmd=build info=container message='obtained IP address' ip='172.17.0.3' 
cmd=build info=cmd.startmonitor status='sent' 
cmd=build info=event.startmonitor.done status='received' 
cmd=build info=container name='slimk_84526_20241029114112' id='a2c2ccbd0110d5edf70515f37982f0b471fb46a0efc1258a8410a6a0b5f18b84' target.port.list='32795' target.port.info='9999/tcp => 0.0.0.0:32795' message='YOU CAN USE THESE PORTS TO INTERACT WITH THE CONTAINER' 
cmd=build info=continue.after mode='exec' message='provide the expected input to allow the container inspector to continue its execution' 
cmd=build info=continue.after mode='exec' shell='/opc_health_check.py' 
slim[build][exec]: output: [Errno 111] Connection refused
slim[build][exec]: output: [Errno 111] Connection refused
slim[build][exec]: output: [Errno 111] Connection refused
slim[build][exec]: output: [Errno 111] Connection refused
slim[build][exec]: output: [Errno 111] Connection refused
slim[build][exec]: output: [Errno 111] Connection refused
slim[build][exec]: output: [Errno 111] Connection refused
slim[build][exec]: output: [Errno 111] Connection refused
slim[build][exec]: output: [Errno 111] Connection refused
slim[build][exec]: output: [Errno 111] Connection refused
slim[build][exec]: output: Failed to connect!
cmd=build info=continue.after mode='exec' exitcode='1' 
cmd=build info=continue.after mode='exec' message='fatal: exec cmd failure' 
cmd=build state=exited code=1
cmd=build info=container.inspector.cleanup name='slimk_84526_20241029114112' id='a2c2ccbd0110d5edf70515f37982f0b471fb46a0efc1258a8410a6a0b5f18b84' 
cmd=build state=container.target.shutdown.start
slim: container stdout:
slim: container stderr:
time="2024-10-29T11:41:29Z" level=error msg="channel.Server.Start() - loop.Accept error = accept tcp [::]:65501: use of closed network connection"
time="2024-10-29T11:41:29Z" level=error msg="channel.Server.Start() - loop.Accept error = accept tcp [::]:65502: use of closed network connection"
slim: end of container logs =============
cmd=build state=container.target.shutdown.done
cmd=build info=report file='slim.report.json' 
cmd=build info=exit code='1' version='linux/amd64|Transformer|1.40.11|1b271555882eacdfb4e6598d6d0552e9b9b1449b|2024-02-02_01:36:22PM' location='/usr/local/bin' 
app='slim' message='GitHub Discussions' info='https://github.com/slimtoolkit/slim/discussions'
app='slim' message='Join the CNCF Slack channel to ask questions or to share your feedback' info='https://cloud-native.slack.com/archives/C059QP1RH1S'
app='slim' message='Join the Discord server to ask questions or to share your feedback' info='https://discord.gg/9tDyxYS'
app='slim' message='Join the Gitter channel to ask questions or to share your feedback' info='https://gitter.im/docker-slim/community'

Any suggestions on what I'm doing wrong? Thanks for the help!

[kcq]

@matthiasverstraete can you give more context about the --cmd="python ." flag you have? what's your work directory in the container? what are you expecting to execute? how's the entrypoint configured in your container?

will be good to collect more context... try enabling trace logging like this:

slim --log-level=trace build --tag my_image:slim --cmd="python ." --mount /path/to/opc_health_check.py:/opc_health_check.py --http-probe=false --exec="/opc_health_check.py" --target my_image:0.25.0 --show-clogs=true

[matthiasverstraete]

Sorry about the lack of context. Here is some extra information:
The docker image contains a directory /app which contains all python code for my service and which contains a __main__.py file. The dockerfile also contains the line CMD ["python", "."], so I'm just trying to execute the normal code to start the service.

With trace logging, I get the following output:
slim_output.log

Here are some follow up questions:

• the /opc_health_check.py script, tries to access the service via the port inside the container. Is that correct? Or should it try to access the service via the exposed port? And if it is the second, how can my script know which port it is?
• The trace logs mention at the end: time="2024-10-30T08:09:55+01:00" level=info msg="can't stop the slim container (container is not running)..." app=slim cmd=build component=container.inspector op=container.Inspector.ShutdownContainer. This seems to indicate my service didn't properly start? However, I can't find any logging which indicates why.
• In the trace logs I do see that a lot of my source code is detected, so at least it is doing something right.

[kcq]

Looking... Will post more soon

[kcq]

Noticed that the exec probes got executed before the application was started, which would explain the connect failures... still looking for more.

[matthiasverstraete]

Ah, is there a way to delay the exec probes?
Also, I wrote the script such that it would take multiple attempts (10 with 1 seconds wait time) to connect to the service, so at some point it should be able to connect.

[kcq]

@matthiasverstraete by the way, what's a good reference to understand the opcua network service protocol?

[matthiasverstraete]

This is a link to the documentation of this protocol: https://opcfoundation.org/

In summary, it's a tcp based protocol, so it uses a port for communication. It exposes 'nodes' which can be read and written.