Custom Lambda image - getting aws-lambda-ric error when trying to run Lambda

Question

I've build a NodeJS project, which I need to run on a custom Docker image.

This is my Dockerfile:

FROM public.ecr.aws/lambda/nodejs:14-x86_64

# Create app directory
WORKDIR /usr/src/

RUN yum update && yum install -y git openssh-client vim python py-pip pip jq
RUN yum update && yum install -y automake autoconf libtool dpkg pkgconfig nasm libpng cmake
RUN pip install awscli
# RUN apk --purge -v del py-pip

# RUN rm /var/cache/apk/*

RUN npm install -g yarn

RUN yarn install --frozen-lockfile

# Bundle app source
COPY . .

RUN yarn build
ENTRYPOINT ["npx", "aws-lambda-ric"]
CMD [ "src/executionHandler.runner" ]

But when I call docker run <imagename>

I get the following errors:

tar: curl-7.78.0/tests/data/test1131: Cannot open: No such file or directory

tar: curl-7.78.0: Cannot mkdir: Permission denied

tar: curl-7.78.0/tests/data/test971: Cannot open: No such file or directory

tar: curl-7.78.0: Cannot mkdir: Permission denied

tar: Exiting with failure status due to previous errors

./scripts/preinstall.sh: line 28: cd: curl-7.78.0: No such file or directory

npm ERR! code ELIFECYCLE

npm ERR! errno 1

npm ERR! [email protected] preinstall: `./scripts/preinstall.sh`

npm ERR! Exit status 1

npm ERR! 

npm ERR! Failed at the [email protected] preinstall script.

npm ERR! This is probably not a problem with npm. There is likely additional logging output above.


npm ERR! A complete log of this run can be found in:

npm ERR!     /root/.npm/_logs/2021-10-13T09_11_31_626Z-debug.log

Install for [ 'aws-lambda-ric@latest' ] failed with code 1

The base image I use was taken from official AWS images repository.

How can I resolve this permissions issue?

Answer 1

This isn't really a permissions issue.

According to https://gallery.ecr.aws/lambda/nodejs the base image you're using public.ecr.aws/lambda/nodejs should come with the entire runtime pre-installed. I think the issue is that your entrypoint uses npx, which is a tool for running local npm packages, and the base image can only have the packages installed globally. npx, if it can't find the package in local package.json, tries to install the package. This is both unnecessary, since it's already installed globally, and not possible in the stripped down public image in to which you have installed some of the prereqs like cmake, autoconf, etc, but not libcurl.

I suspect

ENTRYPOINT ["aws-lambda-ric"]

without npx and without all the extraneous development packages will work fine with this image.