Missing `libssl.so.x.x` symlink in final docker image
MattTimms opened this issue · comments
This only affects newly built images; docker pull lycheeverse/lychee
as per the README fetches a working image ("Created": "2024-03-22T23:29:28.775271855Z"
).
Due to the floating versions of the base images used in the Dockerfile
, i.e. rust:latest
& debian:bullseye-slim
, there is a issue between the libssl-dev
version of the builder
stage & that of the final base image. This causes the following error when running a freshly built container:
lychee: error while loading shared libraries: libssl.so.3: cannot open shared object file: No such file or directory
As of time of writing, building the Dockerfile
fetches:
> docker pull rust:latest
latest: Pulling from library/rust
...
Digest: sha256:00e330d2e2cdada2b75e9517c8359df208b3c880c5e34cb802c120083d50af35
...
> docker pull debian:bullseye-slim
bullseye-slim: Pulling from library/debian
...
Digest: sha256:a165446a88794db4fec31e35e9441433f9552ae048fb1ed26df352d2b537cb96
...
The contents of /usr/lib/x86_64-linux-gnu/
for each of these images is: libssl.so
, libssl.so.3
for rust:latest
, & libssl.so.1.1
for debian:bullseye-slim
. Hence, the lychee from builder is expected libssl.so.3
where the final image contains only libssl.so.1.1
.
Solutions could be to:
- add a step to the
Dockerfile
to create a symlink for the expectedlibssl.so.x.x
file, assuming its compatible across base-images. - fix the base images to revision tags that are known to be compatible, e.g.
FROM rust@sha256:...
- use the same base image for both builder & final stages
Thanks.
From the options you presented, we'd ideally use the same image. Maybe we could change it to rust:slim-buster, which would ensure that the image stays small?
The current lychee docker image (available via docker pull lycheeverse/lychee
) weighs 107MB & uses rust:latest
& debian:bullseye-slim
. That rust:latest
aliases to rust:bookworm
(docker) which is Debian 12 (releases). However, debian:bullseye-slim
is Debian 11 - I believe that's why there's different libssl.so.x.x
files present.
I think the best solution is to, instead, ensure the two base images use the same Debian version. I tested the Dockerfile
with both the same base images, separately, as rust:slim-bullseye
& rust:slim-buster
(despite being Debian 10) as you suggested. In short, rust images are b i g (~1GB).
I'd suggest using rust:bookworm
& debian:bookworm-slim
, which produces a 375MB image & appears to work as expected. I cannot account for the difference in lychee executable size between this new image & the original (~292MB vs. 84MB)
I cannot account for the difference in lychee executable size between this new image & the original (~292MB vs. 84MB)
Yes, I can. The executable isn't stripped in Dockerfile as it is in the GitHub Releases here. I have realised that the Dockerfile
isn't used for the public image release.
As far as I can see, this can be closed because of the excellent work by @MattTimms.
Thanks for looking into this and fixing it so cleanly and thoroughly. Props!
(The libssl issues should be resolved now; please reopen in case that's incorrect.)