Oracle Cloud Infrastructure Documentation

Troubleshooting Oracle Functions

This topic covers common issues related to Oracle Functions and how you can address them.

Using DEBUG=1 to see more details about an error

If you encounter an unexpected error when using an Fn Project CLI command, you can find out more about the problem by starting the command with the string DEBUG=1 and running the command again. For example:

$ DEBUG=1 fn invoke helloworld-app helloworld-func

Note that DEBUG=1 must appear before the command, and that DEBUG must be in upper case.

Using --display-call-id when invoking functions to aid issue resolution

If you encounter an issue when invoking a function, you can engage with Oracle Support. Oracle Support can investigate the issue more efficiently if you provide the call id of the function invocation. You can obtain the call id using the --display-call-id command option. For example:

$ fn invoke helloworld-app helloworld-func --display-call-id

 

Call ID: 01CS23SDG71BT2N9GZJ002DQM5

Hello World !

Creating a new application displays an error message in the New Application dialog

If you've already reached the limit for the number of applications in your tenancy, you might see a message similar to the following in the New Application dialog when trying to create a new application:

Unable to create your app, please try again.

Double-check how many applications already exist in your tenancy. Compare that with the number of applications you're allowed to create. See Oracle Functions Capabilities and Limits.

If you've exceeded the number of applications allowed in your tenancy, consider:

Oracle Functions attempts to interact with docker.io

If you see a message similar to the following when deploying a function, double-check that your development environment doesn't have the FN_REGISTRY environment variable set to your Docker username:

The push refers to repository [docker.io. ...
.
.
.
denied: requested access to the resource is denied
Fn: error running docker push, are you logged into docker?: exit status 1
See fn <command> --help’ for more information.
			

If you have used the open source Fn Project platform, you might have followed instructions in the Fn Project documentation to set the FN_REGISTRY environment variable to your Docker username to enable interaction with the official Docker registry.

The FN_REGISTRY environment variable overrides the value of the registry option in your Fn Project CLI context.

To use the Fn Project CLI with Oracle Functions, do one of the following:

  • Unset the FN_REGISTRY environment variable.
  • Override the FN_REGISTRY environment variable using the --registry global option whenever you enter an Fn Project CLI command that interacts with Oracle Cloud Infrastructure Registry.

Running fn version shows that a more recent version of the Fn Project CLI is available

If you see a message similar to the following when you enter the fn version command, a more recent version of the Fn Project CLI is available:

$ fn version
			
Client version: 0.5.33 is not latest: 0.5.34
Server version: ?

To upgrade the Fn Project CLI to the most recent version, reinstall the Fn Project CLI by following the instructions in 5. Install the Fn Project CLI.

Deploying a function to Oracle Functions returns "Fn: Missing subnets annotation" message

When you deploy a function to Oracle Functions, you might see the following message:

$ fn deploy --app joes-helloworld-app
Deploying helloworld-func to app: joes-helloworld-app
.
.
.
Fn: Missing subnets annotation

If you see the Fn: Missing subnets annotation message, confirm that you entered the correct application name. For example:

  • the application might not be in the compartment currently specified by the Fn Project CLI context
  • the application might have existed previously, but has subsequently been deleted

Running Fn Project CLI commands returns a 401 error

If you see a message similar to the following when running an Fn Project CLI command, double-check that the credentials specified for your current profile in the ~/.oci/config file are authenticating you correctly:

$ fn list apps
			
Fn: [GET /apps][401] ListApps default  &{Fields: Message:Not authenticated}

For example:

  • Does user specify the OCID of your Oracle Cloud Infrastructure user account?
  • Does fingerprint specify the fingerprint of the public API key value uploaded to the Console?
  • Does key_file specify the full path to the private key file?

See 2. Create a Profile in the Oracle Cloud Infrastructure CLI Configuration File. Also see API Errors .

Running Fn Project CLI commands returns a 404 error

If you see a message similar to the following when running an Fn Project CLI command, double-check that you are authorized to access function-related and network resources:

$ fn list apps
			
Fn: [GET /apps][404] ListApps default  &{Fields: Message:Resource is not authorized or not found}

For example:

  • Does oracle.compartment-id in your current context correctly specify the OCID of the compartment that owns deployed functions?
  • Have policies been set up correctly to give group access to function-related and network resources?
  • Does your user account belong to the group to which access to function-related and network resources has been granted?
  • Has a policy been set up to give Oracle Functions access to network resources?

See 6. Create an Fn Project CLI Context to Connect to Oracle Cloud Infrastructure and Create Policies to Control Access to Network and Function-Related Resources. Also see API Errors .

Invoking a function returns a FunctionInvokeSyslogUnavailable message and a 502 error

Oracle Functions enables you to export a function's logs to an external logging destination (like Papertrail) by setting a syslog URL for the application. See Storing and Viewing Function Logs.

If the syslog URL is invalid or unreachable, you will see the following error when you invoke the function:

{"code":"FunctionInvokeSyslogUnavailable","message":"Syslog endpoint unavailable"}

Fn: Error invoking function. status: 502 message: Syslog endpoint unavailable

To confirm that the external logging destination's URL is the cause of the error:

  1. Update the application to unset the syslog URL. For example:
    • Using the Console, click Edit Application on the Application Details page and select None from the Logging Policy options.
    • Using the Fn Project CLI, enter fn update app helloworld-app --syslog-url ""
  2. Deploy the function you want to run. See Creating and Deploying Functions.
  3. Invoke the function. See Invoking Functions.

If the function runs successfully, the external logging destination's URL is not reachable from the subnet in which the function is running. Double-check that:

  • The external logging destination's URL is valid.
  • The external logging destination's URL is publicly accessible.
  • The subnet in which the function is running has outbound access to the public internet.

Invoking a function returns a FunctionInvokeImageNotAvailable message and a 502 error

When you invoke a function, Oracle Functions pulls the corresponding image from Oracle Cloud Infrastructure Registry using the VCN and subnets specified for the application.

If Oracle Functions is unable to pull the image, the following message is returned when you invoke a function:

{"code":"FunctionInvokeImageNotAvailable","message":"Failed to pull function image"} Fn: Error invoking function. status: 502 message: Failed to pull function image

Possible solutions:

  • Double-check that the image specified for the function still exists in the specified location in Oracle Cloud Infrastructure Registry.
  • Double-check that Oracle Cloud Infrastructure is available (this message is returned if Oracle Cloud Infrastructure is unexpectedly unavailable).
  • Double-check that the VCN includes an internet gateway or service gateway. For Oracle Functions to be able to access Oracle Cloud Infrastructure Registry to pull an image, the VCN must include an internet gateway or a service gateway, as follows:

    • If public subnets were specified for the application, the VCN must also include an internet gateway.
    • If private subnets were specified for the application, the VCN must also include a service gateway.

    If an internet gateway or service gateway has not been defined for the VCN already, define one now.

Invoking a function returns a FunctionInvokeSubnetOutOfIPs message and a 502 error

When you invoke a function that you've deployed to Oracle Functions, you might see the following error message:

{"code":"FunctionInvokeSubnetOutOfIPs","message":"subnet ocid1.subnet.oc1.phx.aaaaaaaac... is out of IPs"}
Fn: Error invoking function. status: 502 message: subnet ocid1.subnet.oc1.phx.aaaaaaaac... is out of IPs

If you see this error, double-check that each subnet in the VCN has at least the required minimum number of free IP addresses specified in Create the VCN and Subnets to Use with Oracle Functions, if they don't exist already.

Invoking a function returns a FunctionInvokeSubnetNotAvailable message and a 502 error

When you invoke a function that you've deployed to Oracle Functions, you might see the following error message:

{"code":"FunctionInvokeSubnetNotAvailable","message":"subnet ocid1.subnet.oc1.phx.aaaaaaaac... does not exist or Oracle Functions is not authorized to use it"}
Fn: Error invoking function. status: 502 message: subnet ocid1.subnet.oc1.phx.aaaaaaaac... does not exist or Oracle Functions is not authorized to use it

If you see this error:

Invoking a function returns a Gateway Time-out message and a 504 error

When you invoke a function that you've deployed to Oracle Functions, you might see the following error message:

<html>
<head><title>504 Gateway Time-out</title></head>
<body bgcolor="white">
<center><h1>504 Gateway Time-out</h1></center>
<hr><center></center>
</body>
</html>

If you see this error, it's likely that a policy has not been created to give Oracle Functions access to network resources. See Create a Policy to Give the Oracle Functions Service Access to Network Resources.

Invoking a function returns FunctionInvokeContainerInitFail and 'Container initialization timed out' messages, and a 504 error

When you invoke a function that you've deployed to Oracle Functions, the function execution is subject to a maximum memory threshold. If this limit is exceeded, function execution stops and the following error message is returned:

{"code":"FunctionInvokeContainerInitFail","message":"Container failed to initialize, please ensure you are using the latest fdk and check the logs"}

Fn: Error invoking function. status: 504 message: Container failed to initialize, please ensure you are using the latest fdk and check the logs

If you see this error, increase the maximum memory threshold when you invoke the function. Valid values for the maximum memory threshold are 128MB, 256MB, 512MB, and 1024MB (see Changing Oracle Functions Default Behavior).

For example, to set a function's maximum memory threshold to 256MB, do one of the following:

  • Click Edit Function on the Function Details page in the Console, and select 256 from the Memory (in MBs) drop-down list.
  • Use the following syntax when invoking the function using the Fn Project CLI. This will set the maximum memory threshold to 256MB for the current function invocation:

    $ fn invoke <app-name> <function-name> --memory 256
  • Add the following line to the function's func.yaml file. This will set the maximum memory threshold to 256MB whenever the function is invoked:

    memory: 256

    Note that if you edit the func.yaml file, you must re-deploy the function to Oracle Functions before invoking it again.

It's a good idea to use the latest version of the Fn Project CLI when creating a helloworld Python function. When you enter the fn init --runtime python <function-name> command to create the helloworld function, the line memory: 256 is added to the func.yaml file automatically.

Invoking a function returns a FunctionInvokeTimeout message and a 504 error

When you invoke a function that you've deployed to Oracle Functions, the function is only allowed to run for a certain amount of time. If this time limit is exceeded, function execution stops and the following error message is returned:

{"code":"FunctionInvokeTimeout","message":"Timed out"}

Fn: Error invoking function. status: 504 message: Timed out

If you see this error, increase the maximum time a function is allowed to run for. For example, to set the maximum time to 120 seconds, do one of the following:

  • Click Edit Function on the Function Details page in the Console, and enter 120 in the Timeout field.
  • Use the following syntax when invoking the function using the Fn Project CLI. This will set the time limit to 120 seconds for the current function invocation:

    $ fn invoke <app-name> <function-name> --timeout 120
  • Add the following line to the function's func.yaml file. This will set the maximum time limit to 120 seconds whenever the function is invoked:

    timeout: 120

    Note that if you edit the func.yaml file, you must re-deploy the function to Oracle Functions before invoking it again.

Running Fn Project CLI commands returns an X509: decryption password incorrect error

If you see a message similar to the following when running an Fn Project CLI command, double-check that the pass_phrase specified for your current profile in the ~/.oci/config file is correct:

$ fn list apps
			
Fn: x509: decryption password incorrect

See 2. Create a Profile in the Oracle Cloud Infrastructure CLI Configuration File.

Deploying an application returns an "unauthorized: incorrect username or password" message

When deploying an application, you might see a message similar to the following:

$ fn -v deploy --app acme-app

Deploying go-app to app: acme-app
Bumped to version 0.0.2
Building image phx.ocir.io/ansh81vru1zp/acme-repo/go-app:0.0.2
FN_REGISTRY: phx.ocir.io/ansh81vru1zp/acme-repo
Current Context: acme-functions-compartment
Sending build context to Docker daemon 5.12kB
Step 1/10 : FROM fnproject/go:dev as build-stage
Get https://registry-1.docker.io/v2/fnproject/go/manifests/dev: unauthorized: incorrect username or password

The message indicates an unnecessary and unsuccessful attempt to log in to Docker Hub. To resolve this situation, log out from Docker using the following command:

$ docker logout

Having logged out from Docker, re-run the command to deploy the application.

When running Oracle Functions on Ubuntu, Docker login returns an "error getting credentials - err: exit status 1..." message

When you configure your development environment for Oracle Functions, you have to install Docker (see 4. Install Docker for Use with Oracle Functions). If your development environment is running Ubuntu, when you follow the subsequent instructions to log in to Oracle Cloud Infrastructure Registry using Docker (see 10. Log in to Oracle Cloud Infrastructure Registry), you might see a message similar to the following:

error getting credentials - err: exit status 1, out: Error spawning command line 'dbus-launch --autolaunch=d7159335070ef1c0854c75de55c8f588 --binary-syntax --close-stderr': Child process exited with code 1

For more information about this Docker issue, including likely causes and possible resolutions, see https://github.com/docker/docker-credential-helpers/issues/60.

Deploying a function returns a ListTriggers message and a 500 error

When deploying a function that you've previously created using an earlier version of the Fn Project CLI, you might see a message similar to the following:

Fn: [GET /triggers][500] ListTriggers default  &{Fields: Message:Internal server error}

This message indicates that the function's func.yaml file contains one or more HTTP trigger definitions. Oracle Functions does not currently support HTTP triggers. To deploy the function, remove the triggers: section from the func.yaml file.

To avoid creating new func.yaml files containing trigger definitions, follow the instructions in 5. Install the Fn Project CLI to upgrade the Fn Project CLI to the most recent version.

Performing Docker-related operations with the Fn Project CLI displays an "Error response from daemon... unknown: Unauthorized" message

To enable the Fn Project CLI to access the Docker registry specified in the Fn Project CLI context, the local Docker client (the Docker daemon on Linux) in your development environment must be logged in to that Docker registry. If the Docker client is not logged in to the Docker registry, you see a message similar to the following:

Error response from daemon: Get https://phx.ocir.io/v2/: unknown: Unauthorized

Follow the instructions in 10. Log in to Oracle Cloud Infrastructure Registry to log the Docker client in to the appropriate Oracle Cloud Infrastructure Registry, an Oracle-managed Docker registry available in a number of different regions.