我需要什么权限才能在 gce 上使用容器运行可执行文件

Question

我需要什么权限？

我使用 gcloud compute instance create-with-container 命令创建了一个实例。

然后，日志中显示了以下内容。

Error: Failed to start container: Error response from daemon: 
{\" message \ ": \" OCI runtime create failed: container_linux.go: 349: starting container process caused \\\ "exec: \\\\\\\ "./foo\\\\\\\": permission denied \\\ ": unknown \"}

./foo 是可执行的。
图像由 google cloud build 构建。

Dockerfile

# Use the offical golang image to create a binary.
# This is based on Debian and sets the GOPATH to /go.
# https://hub.docker.com/_/golang
FROM golang:1.15-buster as builder

# Create and change to the app directory.
WORKDIR /app

# Retrieve application dependencies.
# This allows the container build to reuse cached dependencies.
# Expecting to copy go.mod and if present go.sum.
COPY go.* ./
RUN go mod download

# Copy local code to the container image.
COPY . ./

# Build the binary.
RUN go build -mod=readonly -v -o foo

# Use the official Debian slim image for a lean production container.
# https://hub.docker.com/_/debian
# https://docs.docker.com/develop/develop-images/multistage-build/#use-multi-stage-builds
FROM debian:buster-slim
RUN set -x && apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
    ca-certificates && \
    rm -rf /var/lib/apt/lists/*

# Copy the binary to the production image from the builder stage.
COPY --from=builder /app/foo /app/foo

# Run the task on container startup.
WORKDIR /app
CMD ["./foo"]

这在云运行上运行良好。

Answer 1

修复构建命令
go build -o foo

原始构建命令生成foo目录并在其中输出执行文件。