Unable to find dotnet runtime when DOTNET_ROOT is set on Mariner

[sirkiza]

Description

I recently encountered that PowerShell on Mariner fails when DOTNET_ROOT is set. I created GitHub issue to resolve this error.

After discussion with the PowerShell community, it was discovered that access to /etc/dotnet/install_location is restricted for non-root users on Mariner, which may be the cause of why PowerShell is not looking for the dotnet runtime in the standard location /usr/share/dotnet.

When DOTNET_ROOT is not set it works just fine. So I would expect the same behavior when DOTNET_ROOT is set.

Reproduction Steps

# tdnf install powershell
echo $DOTNET_ROOT
dotnet --list-runtimes
pwsh -c "echo Hello"
mkdir -p /tmp/hostedtoolcache/dotnet
export DOTNET_ROOT=/tmp/hostedtoolcache/dotnet
dotnet --list-runtimes
pwsh -c "echo Hello"

Expected behavior

Ubuntu

Microsoft.AspNetCore.App 7.0.3 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 7.0.3 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Hello
Microsoft.AspNetCore.App 7.0.3 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 7.0.3 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Hello

Actual behavior

Mariner

Microsoft.AspNetCore.App 6.0.11 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 6.0.11 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.0 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.3 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Hello
Microsoft.AspNetCore.App 6.0.11 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 6.0.11 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.0 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.3 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
You must install .NET to run this application.

App: /opt/microsoft/powershell/7/pwsh
Architecture: x64
App host version: 7.0.3
.NET location: Not found

Learn about runtime installation:
https://aka.ms/dotnet/app-launch-failed

Download the .NET runtime:
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=mariner.2.0-x64&apphost_version=7.0.3

Regression?

No response

Known Workarounds

It works if I create etc/dotnet folder with user permissions

sudo mkdir -m 755 /etc/dotnet
pwsh -c "echo Hello"

UPD: IT DOENS'T WORK

Configuration

• Dotnet runtime: Microsoft.NETCore.App 7.0.3
• Mariner/Ubuntu

Other information

No response

Tagging subscribers to this area: @vitek-karas, @agocke, @VSadov
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

I recently encountered that PowerShell on Mariner fails when DOTNET_ROOT is set. I created GitHub issue to resolve this error.

After discussion with the PowerShell community, it was discovered that access to /etc/dotnet/install_location is restricted for non-root users on Mariner, which may be the cause of why PowerShell is not looking for the dotnet runtime in the standard location /usr/share/dotnet.

When DOTNET_ROOT is not set it works just fine. So I would expect the same behavior when DOTNET_ROOT is set.

Reproduction Steps

echo $DOTNET_ROOT
dotnet --list-runtimes
pwsh -c "echo Hello"
mkdir -p /tmp/hostedtoolcache/dotnet
export DOTNET_ROOT=/tmp/hostedtoolcache/dotnet
dotnet --list-runtimes
pwsh -c "echo Hello"

Expected behavior

Microsoft.AspNetCore.App 7.0.3 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 7.0.3 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Hello
Microsoft.AspNetCore.App 7.0.3 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 7.0.3 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Hello

Actual behavior

Microsoft.AspNetCore.App 6.0.11 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 6.0.11 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.0 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Hello
Microsoft.AspNetCore.App 6.0.11 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 6.0.11 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.0 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
You must install .NET to run this application.

App: /opt/microsoft/powershell/7/pwsh
Architecture: x64
App host version: 7.0.3
.NET location: Not found

Learn about runtime installation:
https://aka.ms/dotnet/app-launch-failed

Download the .NET runtime:
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=mariner.2.0-x64&apphost_version=7.0.3

Regression?

No response

Known Workarounds

The following code works when pwsh is run with root permissions.

export` DOTNET_ROOT=/tmp/hostedtoolcache/dotnet
sudo pwsh -c "echo Hello"

Configuration

• Dotnet runtime: Microsoft.NETCore.App 7.0.3
• Mariner/Ubuntu

Other information

No response

Author:	sirkiza
Assignees:	-
Labels:	area-Host, untriaged
Milestone:	-

[vitek-karas]

If you have the repro environments readily available could you please run the failing command with export COREHOST_TRACE=1 and export COREHOST_TRACEFILE=host.txt. The trace will contain detailed info why it looked for the runtime where it looked.

DOTNET_ROOT is NOT supposed to look elsewhere, it is meant as "This is the place, ignore everything else". BUT, the dotnet CLI does not read it, so it only applies to application executables, like pwsh. The dotnet CLI will always use the installation from where it was launched, so in the above sample it will always use the one on the PATH. So the interesting question is, if there a valid runtime in the directory you specify for DOTNET_ROOT and if so, is it the same across the two different distros?

[sirkiza]

In my example DOTNET_ROOT is empty directory. And if I understand logic which is currently implemented: pwsh tries to find runtime in location set inside /etc/dotnet/install_location, DOTNET_ROOT and other locations as well.

[sirkiza]

$ cat host.txt
Tracing enabled @ Wed Mar  1 18:54:54 2023 GMT
--- Invoked apphost [version: 7.0.0, commit hash: d099f075e45d2aa6007a22b71b45a08758559f80] main = {
pwsh
-c
echo Hello
}
The managed DLL bound to this executable is: 'pwsh.dll'
Using environment variable DOTNET_ROOT=[/tmp/hostedtoolcache/dotnet] as runtime location.
Looking for architecture-specific install_location file in '/etc/dotnet/install_location_x64'.
The install_location file ['/etc/dotnet/install_location_x64'] does not exist - skipping.
Looking for install_location file in '/etc/dotnet/install_location'.
The install_location file ['/etc/dotnet/install_location'] does not exist - skipping.
The required library libhostfxr.so could not be found. Searched with root path [/opt/microsoft/powershell/7/], environment variable [DOTNET_ROOT], default install location [/usr/share/dotnet], self-registered config location [/etc/dotnet/install_location_x64]
You must install .NET to run this application.

App: /opt/microsoft/powershell/7/pwsh
Architecture: x64
App host version: 7.0.0
.NET location: Not found

Learn about runtime installation:
https://aka.ms/dotnet/app-launch-failed

Download the .NET runtime:
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=mariner.2.0-x64&apphost_version=7.0.0

[richlander]

I think you are saying that you don't like the behavior of DOTNET_ROOT. It seems to be working correctly.

[sirkiza]

It seems it would have worked correctly if it had worked the same on both Ubuntu and Mariner.
It would have also worked correctly if sudo pwsh --version works so that pwsh --version works as well.

It might be some inconsistency between the concept and implementation... But in reality pwsh respects DOTNET_ROOT but also searches in default location (if it have an access to /etc/dotnet)

[richlander]

You know about this, right?

rich@mazama:~$ export DOTNET_ROOT=foo
rich@mazama:~$ echo $DOTNET_ROOT
foo
rich@mazama:~$ sudo bash
[sudo] password for rich:
root@mazama:/home/rich# echo $DOTNET_ROOT

root@mazama:/home/rich#

[vitek-karas]

I think in general @sirkiza is right. Unfortunately (for historical reasons) if the directory which DOTNET_ROOT points to doesn't include hostfxr (or rather fxr directory), the search will falback to the default locations, so first including the registered locations and then the global hardcoded default.

This behavior is undocumented, and honestly probably unintentional, but we probably won't be able to just fix this - anytime soon. And it's probably not worth the trouble.

Based on the log above, it seems that there's no globally registered location - probably because of the restricted access to /etc/dotnet/.... It also seems that this works just fine on Ubuntu.

I don't have Mariner readily available right now, so I can't try if it's possible to access the config files. But if not, then this is basically a clash of designs. For some reason, it works everywhere (as far as we've heard) but Mariner. I don't know why Mariner restricts access to these locations.

[richlander]

We have Mariner container images you can use. I can show you.

I didn't know about that undocumented/unintended behavior. Fun.

[sirkiza]

@vitek-karas

Location is restricted because of default umask of Mariner
I mentioned above that sudo mkdir -m 755 /etc/dotnet also solves the issue :)

[richlander]

K. I'll report this to the folks who own our pacakges.

[sirkiza]

@richlander

Do you mean that all variables I set in export will expire when I run command with sudo? I didn't know that :)

You know about this, right?

rich@mazama:~$ export DOTNET_ROOT=foo
rich@mazama:~$ echo $DOTNET_ROOT
foo
rich@mazama:~$ sudo bash
[sudo] password for rich:
root@mazama:/home/rich# echo $DOTNET_ROOT

root@mazama:/home/rich#

[richlander]

They don't "expire" but yes. This is the correct behavior, IMO.