Unable to create a dotnet 9 Lambda function

[genifycom]

Describe the bug

Tried following https://docs.aws.amazon.com/lambda/latest/dg/csharp-image.html
with Docker file"

FROM public.ecr.aws/lambda/dotnet:9
WORKDIR /var/task
COPY "bin/Release/lambda-publish"  .
CMD [ "MyFunction::MyFunction.Function::FunctionHandler" ]

ECR container gets created.
When deploying to Lambda

Creating new Lambda function MyFunction
Error creating Lambda function: The image manifest, config or layer media type for the source image 497195724xxx.dkr.ecr.us-east-1.amazonaws.com/myfunction:latest is not supported.

Tried using the command

dotnet lambda deploy-function MyFunction --function-role lambda-role --provenance=false --platform linux/amd64

as per several reports, but same result.

Anyone have a dotnet 9 working sample?

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

We don't have a sample to follow for dotnet 9 so we are guessing. However, something appears to be different between dotnet 8 and dotnet 9.

Current Behavior

Unable to create a dotnet 9 Lambda function from an ECR

Reproduction Steps

Follow the example on https://docs.aws.amazon.com/lambda/latest/dg/csharp-image.html
but change 8 to 9

Possible Solution

Unknown

Additional Information/Context

Please can we have a dotnet 9 example to follow/

AWS .NET SDK and/or Package version used

AWSSDK 1.66.0.0

Targeted .NET Platform

NET Core 9

Operating System and version

Windows 11 Pro 24H2

[ashishdhingra]

@genifycom Good morning. Thanks for opening the issue. Using the instructions on the page https://docs.aws.amazon.com/lambda/latest/dg/csharp-image.html, I was able to deploy the function with the below Dockerfile:

FROM public.ecr.aws/lambda/dotnet:9.2025.04.03.12

WORKDIR /var/task

# This COPY command copies the .NET Lambda project's build artifacts from the host machine into the image. 
# The source of the COPY should match where the .NET Lambda project publishes its build artifacts. If the Lambda function is being built 
# with the AWS .NET Lambda Tooling, the `--docker-host-build-output-dir` switch controls where the .NET Lambda project
# will be built. The .NET Lambda project templates default to having `--docker-host-build-output-dir`
# set in the aws-lambda-tools-defaults.json file to "bin/Release/lambda-publish".
#
# Alternatively Docker multi-stage build could be used to build the .NET Lambda project inside the image.
# For more information on this approach checkout the project's README.md file.
COPY "bin/Release/lambda-publish"  .

Used the latest image tag from https://gallery.ecr.aws/lambda/dotnet.

Running dotnet lambda deploy-function MyFunction works fine:

Amazon Lambda Tools for .NET Core applications (5.12.4)
Project Home: https://github.com/aws/aws-extensions-for-dotnet-cli, https://github.com/aws/aws-lambda-dotnet
	
Creating image tag from project: myfunction
Executing publish command
... invoking 'dotnet publish', working folder '/Users/<<USER>>/dev/repros/LambdaNET8ImageTest/MyFunction/src/MyFunction/./bin/Release/lambda-publish'
... dotnet publish "/Users/<<USER>>/dev/repros/LambdaNET8ImageTest/MyFunction/src/MyFunction" --output "/Users/<<USER>>/dev/repros/LambdaNET8ImageTest/MyFunction/src/MyFunction/./bin/Release/lambda-publish" --configuration "Release" /p:GenerateRuntimeConfigurationFiles=true --runtime linux-x64 --self-contained False 
... publish:   Determining projects to restore...
... publish:   Restored /Users/<<USER>>/dev/repros/LambdaNET8ImageTest/MyFunction/src/MyFunction/MyFunction.csproj (in 377 ms).
... publish:   MyFunction -> /Users/<<USER>>/dev/repros/LambdaNET8ImageTest/MyFunction/src/MyFunction/bin/Release/net9.0/linux-x64/MyFunction.dll
... publish:   MyFunction -> /Users/<<USER>>/dev/repros/LambdaNET8ImageTest/MyFunction/src/MyFunction/bin/Release/lambda-publish/
Changed permissions on published file (chmod +rx Amazon.Lambda.Serialization.SystemTextJson.dll).
Changed permissions on published file (chmod +rx MyFunction.dll).
Changed permissions on published file (chmod +rx MyFunction.deps.json).
Changed permissions on published file (chmod +rx Amazon.Lambda.Core.dll).
Changed permissions on published file (chmod +rx MyFunction.pdb).
Changed permissions on published file (chmod +rx MyFunction.runtimeconfig.json).
Inspecting Dockerfile to figure how to build project and docker image
Executing docker build
... invoking 'docker build', working folder '/Users/<<USER>>/dev/repros/LambdaNET8ImageTest/MyFunction/src/MyFunction, docker file /Users/<<USER>>/dev/repros/LambdaNET8ImageTest/MyFunction/src/MyFunction/Dockerfile, image name myfunction:latest'
... docker build  -f "/Users/<<USER>>/dev/repros/LambdaNET8ImageTest/MyFunction/src/MyFunction/Dockerfile" -t myfunction:latest .
... docker build: #0 building with "desktop-linux" instance using docker driver
... docker build: #1 [internal] load build definition from Dockerfile
... docker build: #1 transferring dockerfile: 882B done
... docker build: #1 DONE 0.0s
... docker build: #2 [internal] load metadata for public.ecr.aws/lambda/dotnet:9.2025.04.03.12
... docker build: #2 DONE 0.4s
... docker build: #3 [internal] load .dockerignore
... docker build: #3 transferring context: 2B done
... docker build: #3 DONE 0.0s
... docker build: #4 [1/3] FROM public.ecr.aws/lambda/dotnet:9.2025.04.03.12@sha256:af68dd8bfdfaf71c9706db3c3279514690ac13ecbaedd8fdeaeb2c77bbcbb6e3
... docker build: #4 DONE 0.0s
... docker build: #5 [internal] load build context
... docker build: #5 transferring context: 75.27kB 0.0s done
... docker build: #5 DONE 0.0s
... docker build: #6 [2/3] WORKDIR /var/task
... docker build: #6 CACHED
... docker build: #7 [3/3] COPY bin/Release/lambda-publish  .
... docker build: #7 CACHED
... docker build: #8 exporting to image
... docker build: #8 exporting layers done
... docker build: #8 writing image sha256:78bcf8fbc72e3a09053ae97c8860d012839bb453ce7a672ac3e47c8f442198e1 done
... docker build: #8 naming to docker.io/library/myfunction:latest done
... docker build: #8 DONE 0.0s
... docker build: View build details: docker-desktop://dashboard/build/desktop-linux/desktop-linux/eyhre8b3wabzabuxalscxtwua
Fetching ECR authorization token to use to login with the docker CLI
Executing docker CLI login command
... invoking 'docker login'
... docker login: WARNING! Using --password via the CLI is insecure. Use --password-stdin.
... docker login: WARNING! Your credentials are stored unencrypted in '/Users/<<USER>>/.docker/config.json'.
... docker login: Configure a credential helper to remove this warning. See
... docker login: https://docs.docker.com/go/credential-store/
... docker login: Login Succeeded
Creating ECR Repository myfunction
Taging image myfunction:latest with myfunction:latest
... invoking 'docker tag'
Pushing image to ECR repository
... invoking 'docker push'
The push refers to repository [139480602983.dkr.ecr.us-east-1.amazonaws.com/myfunction]
aad1bc31b2e6: Pushed 
5f70bf18a086: Pushed 
ae5c51ff4663: Pushed 
7c3e44939436: Pushed 
360c68da0dee: Pushed 
28d61d9de478: Pushed 
9d593d33b85c: Pushed 
80edb2f916bd: Pushed 
bf66d6154a9b: Pushed 
dc0ed6cd33b9: Pushed 
latest: digest: sha256:d7679df7fd8a2ee9901c84312339039b24297c498c11afa761b47c08ae8c7e46 size: 2412
Image 139480602983.dkr.ecr.us-east-1.amazonaws.com/myfunction:latest Push Complete. 
Creating new Lambda function MyFunction
Select IAM Role that to provide AWS credentials to your code:
    1) customResourceRole
    2) FUNCTION-role-8ikmsw2j
    3) lambda_exec_APIGatewayCustomRuntimeNET8
    4) TestFunction-role-kx73xmoa
    5) *** Create new IAM Role ***
4
New Lambda function created

However, when I execute dotnet lambda invoke-function MyFunction --payload "Testing the function", it gives below error:

Amazon Lambda Tools for .NET Core applications (5.12.4)
Project Home: https://github.com/aws/aws-extensions-for-dotnet-cli, https://github.com/aws/aws-lambda-dotnet
	
Payload:
{"errorType":"Runtime.InvalidEntrypoint","errorMessage":"RequestId: feb3543b-1902-4fd9-95db-9167c9743521 Error: fork/exec /lambda-entrypoint.sh: exec format error"}

Log Tail:
INIT_REPORT Init Duration: 2.08 ms	Phase: init	Status: error	Error Type: Runtime.InvalidEntrypoint
INIT_REPORT Init Duration: 0.52 ms	Phase: invoke	Status: error	Error Type: Runtime.InvalidEntrypoint
START RequestId: feb3543b-1902-4fd9-95db-9167c9743521 Version: $LATEST
RequestId: feb3543b-1902-4fd9-95db-9167c9743521 Error: fork/exec /lambda-entrypoint.sh: exec format error
Runtime.InvalidEntrypoint
END RequestId: feb3543b-1902-4fd9-95db-9167c9743521
REPORT RequestId: feb3543b-1902-4fd9-95db-9167c9743521	Duration: 1.97 ms	Billed Duration: 2 ms	Memory Size: 512 MB	Max Memory Used: 3 MB

EDIT: I was on Apple Mac M2 and had to use --function-architecture arm64 argument while deploying my function. Thereafter, it worked.

Amazon Lambda Tools for .NET Core applications (5.12.4)
Project Home: https://github.com/aws/aws-extensions-for-dotnet-cli, https://github.com/aws/aws-lambda-dotnet
	
An update is currently in progress for Lambda function MyFunction. Waiting till update completes.
Payload:
{"Lower":"testing the function","Upper":"TESTING THE FUNCTION"}

Log Tail:
START RequestId: c657df8e-f295-4b99-ba79-c15f84b8d7d0 Version: $LATEST
END RequestId: c657df8e-f295-4b99-ba79-c15f84b8d7d0
REPORT RequestId: c657df8e-f295-4b99-ba79-c15f84b8d7d0	Duration: 242.19 ms	Billed Duration: 1167 ms	Memory Size: 512 MB	Max Memory Used: 76 MB	Init Duration: 924.71 ms

[genifycom]

Thanks Ashish,

I changed to your docker file image.

Using your publish command (with a profile as I have multiple profiles).
I deleted my original container.

dotnet lambda deploy-function MyFunction --profile MyProfile

Amazon Lambda Tools for .NET Core applications (5.12.4)
Project Home: https://github.com/aws/aws-extensions-for-dotnet-cli, https://github.com/aws/aws-lambda-dotnet

Creating image tag from project: myfunction
Executing publish command
Deleted previous publish folder
... invoking 'dotnet publish', working folder 'C:\Dev\MyFunction\src\MyFunction\./bin/Release/lambda-publish'
... dotnet publish "C:\Dev\MyFunction\src\MyFunction" --output "C:\Dev\MyFunction\src\MyFunction\./bin/Release/lambda-publish" --configuration "Release" /p:GenerateRuntimeConfigurationFiles=true --runtime linux-x64 --self-contained False 
... publish:   Determining projects to restore...
... publish:   All projects are up-to-date for restore.
... publish: C:\Program Files\dotnet\sdk\9.0.202\Current\SolutionFile\ImportAfter\Microsoft.NET.Sdk.Solution.targets(36,5): warning NETSDK1194: The "--output" option isn't supported when building a solution. Specifying a solution-level output path results in all projects copying outputs to the same directory, which can lead to inconsistent builds. [C:\Dev\MyFunction\src\MyFunction\MyFunction.sln]
... publish:   MyFunction -> C:\Dev\MyFunction\src\MyFunction\bin\Release\net8.0\linux-x64\MyFunction.dll
... publish:   MyFunction -> C:\Dev\MyFunction\src\MyFunction\bin\Release\lambda-publish\
... publish: Workload updates are available. Run `dotnet workload list` for more information.
Inspecting Dockerfile to figure how to build project and docker image
Executing docker build
... invoking 'docker build', working folder 'C:\Dev\MyFunction\src\MyFunction, docker file C:\Dev\MyFunction\src\MyFunction\Dockerfile, image name myfunction:latest'
... docker build  -f "C:\Dev\MyFunction\src\MyFunction\Dockerfile" -t myfunction:latest .
... docker build: #0 building with "desktop-linux" instance using docker driver
... docker build: #1 [internal] load build definition from Dockerfile
... docker build: #1 transferring dockerfile: 1.14kB 0.0s done
... docker build: #1 DONE 0.0s
... docker build: #2 [internal] load metadata for public.ecr.aws/lambda/dotnet:9.2025.04.03.12
... docker build: #2 DONE 0.9s
... docker build: #3 [internal] load .dockerignore
... docker build: #3 transferring context: 2B done
... docker build: #3 DONE 0.0s
... docker build: #4 [internal] load build context
... docker build: #4 transferring context: 531B 0.0s done
... docker build: #4 DONE 0.1s
... docker build: #5 [1/3] FROM public.ecr.aws/lambda/dotnet:9.2025.04.03.12@sha256:af68dd8bfdfaf71c9706db3c3279514690ac13ecbaedd8fdeaeb2c77bbcbb6e3
... docker build: #5 resolve public.ecr.aws/lambda/dotnet:9.2025.04.03.12@sha256:af68dd8bfdfaf71c9706db3c3279514690ac13ecbaedd8fdeaeb2c77bbcbb6e3
... docker build: #5 resolve public.ecr.aws/lambda/dotnet:9.2025.04.03.12@sha256:af68dd8bfdfaf71c9706db3c3279514690ac13ecbaedd8fdeaeb2c77bbcbb6e3 0.1s done
... docker build: #5 DONE 0.1s
... docker build: #6 [2/3] WORKDIR /var/task
... docker build: #6 CACHED
... docker build: #7 [3/3] COPY bin/Release/lambda-publish  .
... docker build: #7 CACHED
... docker build: #8 exporting to image
... docker build: #8 exporting layers 0.0s done
... docker build: #8 exporting manifest sha256:dcd72b0626679f9f8bb634bc23cbf61b7fa16802eddeb3e97b401e2f758de5fc done
... docker build: #8 exporting config sha256:7409d887b26be19826e31071981ec8a65cc833fbae462a1982960e7e6df39c67
... docker build: #8 exporting config sha256:7409d887b26be19826e31071981ec8a65cc833fbae462a1982960e7e6df39c67 done
... docker build: #8 exporting attestation manifest sha256:b62eacd7d59ef76f4b6679775dd4de668738fcf982699ba7ca430b2713f70f28 0.1s done
... docker build: #8 exporting manifest list sha256:65a4076464d501eaa19521c5be076eb29c87a33b7e2b4e359463b5a26cf9501b
... docker build: #8 exporting manifest list sha256:65a4076464d501eaa19521c5be076eb29c87a33b7e2b4e359463b5a26cf9501b 0.1s done
... docker build: #8 naming to docker.io/library/myfunction:latest done
... docker build: #8 unpacking to docker.io/library/myfunction:latest 0.0s done
... docker build: #8 DONE 0.3s
... docker build: View build details: docker-desktop://dashboard/build/desktop-linux/desktop-linux/d5ub615xubrw6v9aa57urd1fv
Fetching ECR authorization token to use to login with the docker CLI
Executing docker CLI login command
... invoking 'docker login'
... docker login: WARNING! Using --password via the CLI is insecure. Use --password-stdin.
... docker login: Login Succeeded
Creating ECR Repository myfunction
Taging image myfunction:latest with myfunction:latest
... invoking 'docker tag'
Pushing image to ECR repository
... invoking 'docker push'
The push refers to repository [497195724695.dkr.ecr.us-east-1.amazonaws.com/myfunction]
4f4fb700ef54: Pushed
1d602d5f0468: Pushed
d0e349514c12: Pushed
109c72034836: Pushed
a28e2b82756d: Pushed
631468185388: Pushed
ee57ad442533: Pushed
610feeba0f6c: Pushed
da1e1ac2403b: Pushed
8a623801c286: Pushed
dce188672bf5: Pushed
latest: digest: sha256:65a4076464d501eaa19521c5be076eb29c87a33b7e2b4e359463b5a26cf9501b size: 856
Image 497195724695.dkr.ecr.us-east-1.amazonaws.com/myfunction:latest Push Complete. 
Creating new Lambda function MyFunction
Select IAM Role that to provide AWS credentials to your code:
    1) bv-lambda-role
    2) *** Create new IAM Role ***
1
Error creating Lambda function: The image manifest, config or layer media type for the source image 497195724695.dkr.ecr.us-east-1.amazonaws.com/myfunction:latest is not supported.

I am using Windows BTW.

[ashishdhingra]

@genifycom Could you please share your Dockerfile?

[genifycom]

FROM public.ecr.aws/lambda/dotnet:9.2025.04.03.12

WORKDIR /var/task

COPY "bin/Release/lambda-publish" .

[genifycom]

Hi Ashish,

Any updates?

Thanks,
Dave