(cdk-assets): support building Docker images with Podman

I’d like to use Podman to build images when using aws_ecs.ContainerImage.fromAsset("folder")

Use Case

Podman allows me to build and run containers locally without any elevated privileges while maintaining basically the same command line interface as regular Docker. My distribution even provides a /usr/bin/docker file that forwards all commands to podman so most of the time, invoking docker run ... just works.

For the commands aws-cdk currently use, everything works apart from docker inspect, which returns a different error code than docker on failure.

Proposed Solution

I’ve patched this file locally and have been deploying stuff with aws-cdk for a few months based on this:

-     if (e.code !== 'PROCESS_FAILED' || e.exitCode !== 1) { throw e; }
+     if (e.code !== 'PROCESS_FAILED' || ![1, 125].includes(e.exitCode)) { throw e; }

Other

As above the immediate fix is pretty simple. Reason I didn’t want to open a PR just yet is because I’m not sure how to add tests for this, if it needs to be running real podman or not for example. Another option would be to just change that to checking any failure and tests could still possibly pass

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[fcoelho]

A small update to the changes I’m running locally: the endpoint used by podman login now cannot be a https:// prefixed string, even though docker supports it (this endpoint change works for both docker and podman)

diff --git a/packages/cdk-assets/lib/private/docker.ts b/packages/cdk-assets/lib/private/docker.ts
index e1fc544..3a22a10 100644
--- a/packages/cdk-assets/lib/private/docker.ts
+++ b/packages/cdk-assets/lib/private/docker.ts
@@ -41,7 +41,7 @@ export class Docker {
       await this.execute(['inspect', tag], { quiet: true });
       return true;
     } catch (e) {
-      if (e.code !== 'PROCESS_FAILED' || e.exitCode !== 1) { throw e; }
+      if (e.code !== 'PROCESS_FAILED' || ![1, 125].includes(e.exitCode)) { throw e; }
       return false;
     }
   }
@@ -68,7 +68,7 @@ export class Docker {
     await this.execute(['login',
       '--username', credentials.username,
       '--password-stdin',
-      credentials.endpoint], {
+      credentials.endpoint.replace(/^https?:\/\//, '')], {
       input: credentials.password,
 
       // Need to quiet otherwise Docker will complain

I was also having issues with SELinux in my system but seems this will sort it, I’ll test it when there’s a new RC out: https://github.com/aws/aws-cdk/pull/15742

[paulegan]

Before I found this issue I had the same problems with podman and implemented almost identical workarounds. So I can confirm that these changes fix cdk with podman (Fedora 33, Podman 3.3.1).

For anyone searching for the errors generated, without these changes login throws:

fail: docker login --username AWS --password-stdin https://88888.dkr.ecr.eu-west-1.amazonaws.com exited with error code 125: Error: credentials key has https[s]:// prefix

and inspect throws:

fail: docker inspect cdkasset-xxx exited with error code 125: Error: error inspecting object: no such object: "cdkasset-xxx"