I’m trying to build a Splunk forwarder in a Docker container.

Just for background, the Splunk forwarder container is going to run alongside a Snort 3 Docker container and share a Docker volume on /var/log/snort to get the Snort logs. Then the forwarder output will be sent to the Splunk receiver in another container, which I know very little about at this point, haven’t gotten there yet. And to boot, this all runs in a Ubuntu 24.04 VM. This is for a cybersecurity class project, not a production setup!

I have this Dockerfile that has an ENTRYPOINT that calls a startupSplunk.sh script I have ADDed to the container.

When I build and run the container, I use these commands:
docker build -t firewallsplunk .
docker run -it --mount 'type=volume,source=snortlogs,dst=/var/log/snort' firewallsplunk

I get this error:
exec /tmp/startupSplunk.sh: exec format error

So, assuming my shell script isn’t throwing the exec format error, I look at what my script does, it calls the /opt/splunkforwarder/bin/splunk executable. So, it must be that I downloaded the wrong package or something? Remember I installed splunk with dpkg -i so I’d think that would catch a wrong platform error.

But when I startup the container with a CMD ["bash"] in the Dockerfile and poke around, I can directly run the /opt/splunkforwarder/bin/splunk executable without any exec format errors.

root@CS6035-24:/home/machine/firewallProject/firewallSplunk# ./run.sh 
splunkfwd@2c6d93f04e2e:/$ /opt/splunkforwarder/bin/splunk -help     
Warning: Attempting to revert the SPLUNK_HOME ownership
Warning: Executing "chown -R splunkfwd:splunkfwd /opt/splunkforwarder"
SPLUNK GENERAL TERMS

Last Updated: August 12, 2021
...

To restate the question, why am I getting the exec format error when I try to run my script through an ENTRYPOINT in the Dockerfile, but when I run the same commands directly in the container in bash, it works fine? I thought for a second maybe it was a bash vs sh thing, but I launch my container with sh instead of bash and can still run the command without the annoying exec format error.

Thanks for any help.