Deployment should go in error or blocked state when docker is not able to start

[cbartz]

Summary

The juju status should indicate an issue, when the deployment is not working due to missing docker container running.

Detailled description

I am having an active / idle deployment with three units, the juju status looks fine

Model           Controller                         Cloud/Region           Version  SLA          Timestamp
<sensitive>  <sensitive>  <sensitive>  3.6.9    unsupported  09:29:35Z

App               Version  Status  Scale  Charm             Channel        Rev  Exposed  Message
tmate-ssh-server           active      3  tmate-ssh-server  latest/stable    4  yes      

Unit                 Workload  Agent  Machine  Public address  Ports      Message
tmate-ssh-server/0*  active    idle   0        <sensitive>  10022/tcp  
tmate-ssh-server/1   active    idle   1        <sensitive>  10022/tcp  
tmate-ssh-server/2   active    idle   2        <sensitive>  10022/tcp  

But the deployment is not functional, because the docker container is not able to start due to missing proxy access

unit-tmate-ssh-server-1: 10:32:43 ERROR unit.tmate-ssh-server/1.juju-log tmate-ssh-server is not running:
 × tmate-ssh-server.service - Docker instance to serve tmate-ssh-server.
     Loaded: loaded (/etc/systemd/system/tmate-ssh-server.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Wed 2025-09-03 10:27:27 UTC; 5min ago
    Process: 20621 ExecStart=docker run --user root --net=host --cap-add SYS_ADMIN -v /home/ubuntu/keys:/keys --entrypoint=/srv/tmate-ssh-server/tmate-ssh-server --env SSH_KEYS_PATH=/keys ghcr.io/canonical/tmate-ssh-server:0.1.1 -A -h <sensitive> -p 10022 -k /keys (code=exited, status=125)
   Main PID: 20621 (code=exited, status=125)
        CPU: 17ms

Sep 03 10:27:25 juju-094025-prod-tmate-ps6-1 systemd[1]: Started Docker instance to serve tmate-ssh-server..
Sep 03 10:27:25 juju-094025-prod-tmate-ps6-1 docker[20621]: Unable to find image 'ghcr.io/canonical/tmate-ssh-server:0.1.1' locally
Sep 03 10:27:27 juju-094025-prod-tmate-ps6-1 docker[20621]: docker: Error response from daemon: Get "https://ghcr.io/v2/": Forbidden.
Sep 03 10:27:27 juju-094025-prod-tmate-ps6-1 docker[20621]: See 'docker run --help'.
Sep 03 10:27:27 juju-094025-prod-tmate-ps6-1 systemd[1]: tmate-ssh-server.service: Main process exited, code=exited, status=125/n/a
Sep 03 10:27:27 juju-094025-prod-tmate-ps6-1 systemd[1]: tmate-ssh-server.service: Failed with result 'exit-code'.

[syncronize-issues-to-jira]

Thank you for reporting your feedback to us!

The internal ticket has been created: https://warthogs.atlassian.net/browse/ISD-4119.

This message was autogenerated

[cbartz]

The issue occurred due to proxy acls not being correctly setup. Thus, docker could not access ghcr.io

docker: Error response from daemon: Get "https://ghcr.io/v2/": Forbidden

In order to reproduce, the issue, one could try the following (e.g. in a vm)

1. Deploy a proxy (e.g. tinyproxy).
2. Set the juju model-config to use this proxy.
3. Forbid access to ghcr.io in proxy acl.
4. Deploy tmate-ssh-server.