Arm64 docker image not working on an Arm64 VM

[rgasper]

I'm using an AWS r8a.metal instance with AMI: al2023-ami-2023.9.20251208.0-kernel-6.1-arm64

uname -m
aarch64

I see an arm64 platform image available:

~ docker buildx imagetools inspect steveltn/https-portal:1.25
dockerName:      docker.io/steveltn/https-portal:1.25
MediaType: application/vnd.oci.image.index.v1+json
Digest:    sha256:945b1a6fe1e2496fc8f0535a4121b2ab8e68b187b8fcdc50dacc2faf6589edd3
           
Manifests: 
...
               
  Name:        docker.io/steveltn/https-portal:1.25@sha256:c401a86f9a62bb1b860c999405f618abdaeb8f72c559e5894e6fe2ab035f07af
  MediaType:   application/vnd.oci.image.manifest.v1+json
  Platform:    linux/arm/v7
               
  Name:        docker.io/steveltn/https-portal:1.25@sha256:3fc8180b72306dd18768f8b765ec037df4d1f7c558c72e225835d38aa1f836c5
  MediaType:   application/vnd.oci.image.manifest.v1+json
  Platform:    linux/arm64

...

my compose spec I'm using to run the container:

services:
  https-portal:
    image: steveltn/https-portal:1.25
    container_name: https-portal
    platform: linux/arm64
    ports:
      - "80:80"
      - "443:443"
    restart: always
    volumes:
      - https-portal-data:/var/lib/https-portal
      - /var/run/docker.sock:/var/run/docker.sock:ro # required to auto-detect new host containers w/ VIRTUAL_HOST and VIRTUAL+_PORT
    environment:
      # NOTE: Instead of extending "DOMAINS", set VIRTUAL_HOST and VIRTUAL_PORT in each container.
      STAGE: "production"
      CLIENT_MAX_BODY_SIZE: "3000M" 
      PROXY_CONNECT_TIMEOUT: 300 
      PROXY_SEND_TIMEOUT: 300 
      PROXY_READ_TIMEOUT: 300 
      DOMAINS: '${NODE_USERNAME}:${NODE_PASSWORD}@<redacted domain> -> http://node-exporter:9100'

volumes:
  https-portal-data:

where the VIRTUAL_HOST and VIRTUAL_PORT in my webserver container are:

    environment:
      VIRTUAL_HOST: <redacted domain>
      VIRTUAL_PORT: 8000

If I pull and run it, it dies- with exec issues, suggesting binaries installed are incompatible with Arm64

docker-compose logs https-portal | head -n 1000
docker-composehttps-portal  | s6-rc: info: service s6rc-oneshot-runner: starting
https-portal  | s6-rc: info: service s6rc-oneshot-runner successfully started
https-portal  | s6-rc: info: service fix-attrs: starting
https-portal  | s6-rc: info: service fix-attrs successfully started
https-portal  | s6-rc: info: service legacy-cont-init: starting
https-portal  | cont-init: info: running /etc/cont-init.d/00-welcome
https-portal  | 
https-portal  | ========================================
https-portal  | HTTPS-PORTAL v1.25.2
https-portal  | ========================================
https-portal  | 
https-portal  | cont-init: info: /etc/cont-init.d/00-welcome exited 0
https-portal  | cont-init: info: running /etc/cont-init.d/20-setup
https-portal  | Generating dummy certificate for default fallback server
https-portal  | ....+.+........+.......+.........+......+...+........+...+..........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...+......+.....+................+......+.....+.........+.............+..+.............+..+.+.....+....+.....+...+......+.+...+...........+.........+.+...........+.+.....+....+........+...+..........+........+.......+.........+.....+...+..........+...+.....+.......+.....+.+.....+......+...+......+......+.+...............+..............+...+.+..+....+...+...........+.+.........+..+.......+..+.+.........+......+........+.+.....+..........+......+...+..+............+..........+.....+.+......+......+..+...+........................+.+..+.+.....+............+....+.....+....+.....+....+...+...+...........+....+..+...+.......+..+.......+..............+.+.....+...+.+...........+......+...+.+.......................+.+..+.......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
https-portal  | ...........+.....+...+...+......+......+.........+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+...+...+............+..+.+........+......+.+...+..+............+...+....+..............+......+...+.......+...+..+...+...+....+..............+....+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+.+.........+......+.....+.+.....+.......+......+...........+.............+..+......+...+.....................+...+.+..............+...+..........+.....+..........+........+.........+.+.........+..+...+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
https-portal  | -----
https-portal  | Generating DH parameters, 2048 bit long safe prime
https-portal  | .................... ... lots of crypto printing redacted ... ....................................+................................................................................................................................................................................................................................................................................................................................+...........................................................................................................................+....................................++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*
https-portal  | Adding password for user <redacted user>
https-portal  | Signing certificates from https://acme-v02.api.letsencrypt.org/directory ...
https-portal  | Parsing account key...
https-portal  | Parsing CSR...
https-portal  | Found domains: <redacted domain>
https-portal  | Getting directory...
https-portal  | Directory found!
https-portal  | Registering account...
https-portal  | Registered! Account ID: https://acme-v02.api.letsencrypt.org/acme/acct/2892796376
https-portal  | Creating new order...
https-portal  | Order created!
https-portal  | Verifying <redacted domain>...
https-portal  | <redacted domain> verified!
https-portal  | Signing certificate...
https-portal  | Certificate signed!
https-portal  | Signed certificate for <redacted domain>
https-portal  | cont-init: info: /etc/cont-init.d/20-setup exited 0
https-portal  | cont-init: info: running /etc/cont-init.d/30-set-docker-gen-status
https-portal  | cont-init: info: /etc/cont-init.d/30-set-docker-gen-status exited 0
https-portal  | s6-rc: info: service legacy-cont-init successfully started
https-portal  | s6-rc: info: service legacy-services: starting
https-portal  | services-up: info: copying legacy longrun 00-nginx (no readiness notification)
https-portal  | services-up: info: copying legacy longrun 10-docker-gen (no readiness notification)
https-portal  | services-up: info: copying legacy longrun 20-crond (no readiness notification)
https-portal  | services-up: info: copying legacy longrun 30-dynamic-env (no readiness notification)
https-portal  | s6-rc: info: service legacy-services successfully started
https-portal  | ./run: 3: docker-gen: Exec format error
https-portal  | s6-svscanctl: fatal: unable to control /var/run/s6/services: No such file or directory
... these last two then repeat forever, without the container dying

inspect confirms I pulled the arm64 image:

docker inspect 2685392ab293 | grep -i arch                 
"Architecture": "arm64",