Deploying a docker scratch container to CloudFoundry PaaS

I'm trying to deploy a Docker image as a Pivotal CloudFoundry app.

My image doesn't contain a Linux distribution, just a single binary that runs my web app. This is its entire filesystem:

drwxr-xr-x         0:0     502 kB  ├─⊕ etc
-rwxr-xr-x         0:0      25 MB  └── service

When I cf push it to CloudFoundry, it crashes:

[API/1] OUT Process has crashed with type: "web"
[API/1] OUT App instance exited with guid f334fc62-fc66-4d77-80bd-39a213ebbac2 payload: 
{"instance"=>"fabd4f14-902b-4970-51d0-845d", "index"=>0,
"cell_id"=>"67d596a0-891f-4969-b305-cbaeaa144481", "reason"=>"CRASHED",
"exit_description"=>"exec failed: container_linux.go:346: starting container process caused \"exec: \\\"sh\\\": executable file not found in $PATH\"",
"crash_count"=>3, "crash_timestamp"=>1587646358111493168,
"version"=>"c30771cb-38ab-4691-83fc-ec6996dc537f"}

The error sugggests that something is trying to run sh.

If I inspect the crashed app, its start command is /service, as expected. This should just run the binary, no shell. (edit: although there is a trailing space in there for some reason, I'm not sure if it matters).

$ cf curl /v3/processes/$(cf app --guid my-service)
{
   "guid": "f334fc62-fc66-4d77-80bd-39a213ebbac2",
   "type": "web",
   "command": "/service ", <-- 
…

I don't know where the sh comes from. Does CloudFoundry require a shell inside the image in order to run it? I can't find any docs about this.

NOTE: I'm deploying to CloudFoundry v2.6

$ cf curl /v2/info | jq -r .build
2.6.19-build.6

edit: the ENTRYPOINT portion of my Dockerfile looks like this:

# … earlier layers omitted

FROM scratch
COPY --from=build /etc/ssl               /etc/ssl
COPY --from=build /project/build/service /service
EXPOSE 8080
ENTRYPOINT ["/service"]

Solution

Yes, it requires a few things from your Docker image:

The Docker image must contain an /etc/passwd file with an entry for the root user.
The home directory and the shell for that root user must be present in the image file system.
The total size of the Docker image file system layers must not exceed the disk quota for the app.

Reference: https://docs.cloudfoundry.org/devguide/deploy-apps/push-docker.html#requirements