Docker command failing in Batch Service

Google Cloud Compute Infrastructure
1

Hi,

Trying to use the new Batch service from a Workflow to launch the following docker:

This is the Docker run command:

  • docker run -v /localdir:/data log2timeline/plaso log2timeline.py --storage-file /data/output1.plaso /data/hostfiles

When running in Batch service, the following error occurs:

  • log2timeline.py: error: unrecognized arguments: /datain/hostfiles

Here is the Workflow YAML snippet:

main:
params: [event]
steps:

  • extract_bucket_object:
    assign:
  • projectId: ${sys.get_env(“GOOGLE_CLOUD_PROJECT_ID”)}
  • region: “us-central1”
  • imageUri: “log2timeline/plaso:latest”
  • bucketName: ${event.data.bucket}
  • objectName: ${event.data.name}
  • md5Hash: ${event.data.md5Hash}
  • objectId: ${event.id}
  • jobId: ${“processzip-” + string(int(sys.now()))}
  • createAndRunBatchJob:
    call: googleapis.batch.v1.projects.locations.jobs.create
    args:
    parent: ${“projects/” + projectId + “/locations/” + region}
    jobId: ${jobId}
    body:
    taskGroups:

Run x tasks on y VMs

taskCount: 1
parallelism: 1
taskSpec:
computeResource:
cpuMilli: 6000
memoryMib: 8192
runnables:

  • container:
    imageUri: ${imageUri}
    entrypoint: “/usr/local/bin/plaso-switch.sh”
    commands:
  • “log2timeline.py”
  • “–storage_file /dataout/jm1.plaso”
  • “/datain/hostfiles”
    volumes:
  • “/tmp/dfirprocessed:/dataout”
  • “/tmp:/datain”
    volumes:
  • gcs: #maps to Bucket and used to copy zip file from
    remotePath: “dfirintake”
    mountPath: “/tmp/dfirintake”
  • gcs: #maps to Bucket to write output file to
    remotePath: “dfirprocessed”
    mountPath: “/tmp/dfirprocessed”
    allocationPolicy:
    instances:
  • policy:
    provisioningModel: STANDARD
    machineType: c2d-standard-8
    logsPolicy:
    destination: CLOUD_LOGGING
    result: createAndRunBatchJobResponse
1 Like
2

The issue was caused by not splitting up- “–storage_file /dataout/test1.plaso” across two commands lines.

the correct runnable config is as follows:

  • container:
    imageUri: ${imageUri}
    commands:
  • “log2timeline.py”
    - “–storage_file”
    - “/data/test1.plaso”
  • “/data/hostfiles”
    volumes:
  • “/tmp:/data”
    volumes:
  • gcs: #maps to Bucket and used to copy zip file from
    remotePath: “dfirdata”
    mountPath: “/tmp/raw”
  • gcs: #maps to Bucket folder to write output files (plaso) to
    remotePath: “dfirdata-out”
    mountPath: “/tmp/processed”