Agent containers attempt to blindly execute JSON data when the binary can't be downloaded from the back-end

[0x6675636b796f75676974687562]

When the back-end returns HTTP 404 in response to the request for /internal/files/download-save-agent, agent containers still store the JSON output into a file named save-agent.kexe, make it executable, and attempt to run the result using the default shell:

$ docker container ls -a | grep -F 'save-execution' | awk '{ print $1 }' | xargs -n1 -r docker logs 2>&1 | grep -F 'save-agent.kexe'
+ curl -vvv -X POST http://host.docker.internal:5800/internal/files/download-save-agent --output save-agent.kexe
+ chmod +x save-agent.kexe
+ ./save-agent.kexe
./save-agent.kexe: 1: {timestamp:2022-12-26T08:21:55.070+00:00,path:/internal/files/download-save-agent,status:404,error:Not Found,message:null,requestId:90854645-736}: not found

See ContainerService#prepareConfigurationForExecution on the orchestrator side.

[nulls]

Probably, -f flag can help: https://curl.se/docs/manpage.html#-f

[0x6675636b796f75676974687562]

Probably, -f flag can help: https://curl.se/docs/manpage.html#-f

Exactly.

curl --fail exits with code 22 on an HTTP 404.

Additionally, bash strict mode should be enabled for the shell scriptlet, similarly to what we do in our GitHub Action.