`host-ctr` cli crashes when pulling public ECR image about bottlerocket HOT 11 OPEN

Thanks for the report (and thanks for the very clear reproduction instructions, in particular).

from bottlerocket.

Initial triage says:

• Yes, this reproduces as advertised on our latest release. Not a big surprise, since this code hasn't changed recently, but worth noting.
• We may not have encountered this earlier because the default URL for this container (at least on my aws-eks variant node) points to a private repository rather than public.ecr.aws.
• Given the code that is failing here, there's a clear expectation that this should work, and at the very least, not segfault.

from bottlerocket.

The segfault occurs because the caller has passed a null registryConfig pointer to the victim withDynamicResolver function. The solution seems simple enough (i.e., don't dereference the null pointer). Thanks again for the report.

from bottlerocket.

A little more context: the host-ctr executable is invoked by systemd services (see the boot-containers@ and host-containers@ services in package/os). In those service files the service supplies the registry-config option, so host-ctr does not segfault there. If you wish to use host-ctr outside of those services, you can work around this problem by adding --registry-config /dev/null to your own invocation of host-ctr.

from bottlerocket.

I have verified that settings.host-containers.control.source can be a public ECR URI. For production, you can set this via user data on your worker instances.

from bottlerocket.