Container returns "openat etc/passwd: path escapes from parent"

[kearisp]

Description

When running the official ngrok Docker image, executing curl inside the container fails with:

openat etc/passwd: path escapes from parent

Steps to reproduce

1. Start container:
   docker run -d --name wocker-ngrok ngrok/ngrok http 3000

2. Execute inside container:
   docker exec wocker-ngrok curl http://localhost:4040/api/tunnels

Expected behavior

Should return JSON with active tunnels.

Actual behavior

Returns:
openat etc/passwd: path escapes from parent

Environment

• Docker version: Docker version 29.2.0, build 0b9d198
• Image: ngrok/ngrok:latest | ngrok/ngrok:3-alpine
• OS: Windows (WSL2)

[gagbo]

We just hit the same issue; it seems that we can fix this by running an older version of containerd? (2.1 vs 2.2)

[kaganjd]

hi @gagbo, jen here from ngrok support! containerd/containerd#12925 should have fixed this issue, and was released as containerd 2.2.2. do you want to see if that version gets you up and running?