What does AWS ECS exception Container.image contains invalid char means?

Question

We use CircleCi in our workflow in order to deploy PHP site as docker image on ElasticBeanstalk server. The build jobs in CircleCi is defined as follows:

deploy:
    docker:
      - image: docker:17.05.0-ce-git
    steps:
      - checkout
      - setup_remote_docker
      - run:
          name: Install dependencies
          command: |
            apk add --no-cache \
              py-pip=9.0.0-r1
            pip install \
              awscli \
              awsebcli --upgrade
      - run:
          name: Login to AWS
          command: |
            login="$(aws ecr get-login --no-include-email --region us-west-2)"
            ${login}
      - run:
          name: Deploy to Elastic Beanstalk
          command: |
            echo "Commit sha: ${CIRCLE_SHA1}"
            if [ "${CIRCLE_BRANCH}" == "docker" ]; then
              sed -i'' -e "s/%BUILD_NUM%/${CIRCLE_SHA1}/g" Dockerrun.aws.json
              eb deploy sales-web -l $CIRCLE_SHA1
            fi

In Dockerrun.aws.json under containerDefinitions we have (#### are correct values for application id and repository name in ECS)

{
            "essential": true,
            "image": "####.dkr.ecr.us-west-2.amazonaws.com/####:%BUILD_NUM%",
            "memory": 2048,
            "name": "web-container",
            "portMappings": [
                {
                    "containerPort": 80,
                    "hostPort": 80
                }
            ]
        }

The Login to AWS step is successful and image is uploaded, the environment sales-web starts to update but fails

2018-03-02 16:10:41 UTC+0200    ERROR   Failed to deploy application.
2018-03-02 16:10:41 UTC+0200    ERROR   Service:AmazonECS, Code:ClientException, Message:Container.image contains invalid characters., Class:com.amazonaws.services.ecs.model.ClientException
2018-03-02 16:09:52 UTC+0200    INFO    Environment update is starting.

We have made sure that image is built correctly ( we can upload it ti CircleCi server, start the container and run phpunit tests). There is .elasticbeanstalk folder in root directory of project with valid config.yml file.

Have tried and googled for 2 days with no luck. Will appreciate any help or guidence to understand what this error message means. If any additional details are neccessary I will provide them, just ask.

Answer 1

I had a similar issue when trying to use GitHub actions.

- name: Build, tag, and push image to Amazon ECR
  id: build-image
  env:
     <---- $ECR_REPOSITORY missing here since it is used below      
     ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
     IMAGE_TAG: ${{ github.sha }}
  run: |
     # Build a docker container and
     # push it to ECR so that it can
     # be deployed to ECS.
     docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
     docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
     echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT

ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}

which comes from the step above it

 - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1

Answer 2

I had a similar error returned when trying to deploy with Dockerrun.aws.json. For my case I had a space in the image name attribute as shown below. Make sure your Dockerrun.aws.json file is defined correctly

{
    "AWSEBDockerrunVersion": 2,
    "volumes": [
      {
        "name": "demo-app",
        "host": {
          "sourcePath": "/var/app/current/demo-app"
        }
      }
    ],
    "containerDefinitions": [
      {
        "name": "demo-app",
        "image": " foo.dkr.ecr.me-south-1.amazonaws.com/foo:latest",
        "essential": true,
        "memory": 378,
        "links": ["redis"],
        "command": ["./entrypoint.sh"],
        "portMappings": [
          {
            "hostPort": 80,
            "containerPort": 5000
          }
        ],
  
        "mountPoints": [
          {
            "sourceVolume": "demo-app",
            "containerPath": "/src",
            "readOnly": true
          }
        ]
      },
    {
      "name": "redis",
      "image": "redis:latest",
      "essential": false,
      "memory": 128
  }
    ]
  }

Answer 3

I got this using terraform when I had an extra } at the end of one of my variables.

What you might try doing is to construct the image name in docker, and echo it for auditing.

Update your Dockerrun.aws.json to be like:

...
"image": "%IMAGE_NAME",
...

and then update your circle build to be like:

  - run:
      name: Deploy to Elastic Beanstalk
      command: |
        echo "Commit sha: ${CIRCLE_SHA1}"
        if [ "${CIRCLE_BRANCH}" == "docker" ]; then
          IMAGE_NAME=####.dkr.ecr.us-west-2.amazonaws.com/####:${CIRCLE_SHA1}
          echo "IMAGE_NAME is $IMAGE_NAME"
          sed -i'' -e "s/%IMAGE_NAME%/${IMAGE_NAME}/g" Dockerrun.aws.json
          eb deploy sales-web -l $CIRCLE_SHA1
        fi

Then if it fails, copy the IMAGE_NAME output during the build and try pulling the image yourself with

$(aws ecr get-login --no-include-email --region us-west-2)
docker pull <IMAGE_NAME>

I am betting it will have an error that you can troubleshoot.