search

GoogleContainerTools / kaniko

Build Container Images In Kubernetes
Apache License 2.0
14.86k stars 1.44k forks source link

Issue with shared libraries (libcrypto, libssl) causing symbolic link loop during Docker build using custom Kaniko image #3321

Open kraghupathi opened 1 month ago

kraghupathi commented 1 month ago

Issue with shared libraries (libcrypto, libssl) causing symbolic link loop during Docker build using custom Kaniko image

Description: I'm encountering a problem while building a Docker image using a custom Kaniko image. When using the custom-built Kaniko image, the build process fails with the following errors related to shared libraries (libcrypto.so.3, libssl.so.3), indicating a symbolic link loop:

INFO[0008] Running: [/bin/sh -c apk update] Error loading shared library libcrypto.so.3: Symbolic link loop (needed by /usr/sbin/apk) Error loading shared library libssl.so.3: Symbolic link loop (needed by /lib/libapk.so.2.14.0) Error loading shared library libcrypto.so.3: Symbolic link loop (needed by /lib/libapk.so.2.14.0) Error relocating /lib/libapk.so.2.14.0: SSL_get1_peer_certificate: symbol not found Error relocating /lib/libapk.so.2.14.0: SSL_CTX_use_certificate_chain_file: symbol not found Error relocating /lib/libapk.so.2.14.0: OPENSSL_init_ssl: symbol not found Error relocating /lib/libapk.so.2.14.0: SSL_free: symbol not found Error relocating /lib/libapk.so.2.14.0: SSL_CTX_set_verify: symbol not found Error relocating /lib/libapk.so.2.14.0: EVP_get_digestbyname: symbol not found Error relocating /lib/libapk.so.2.14.0: SSL_shutdown: symbol not found

However, if I directly use the base gcr.io/kaniko-project/executor:debug image, everything works fine. I believe the problem might be due to how libraries are being copied or linked in the custom-built image (registry.gitlab.com/test:9.2 is a rhel ubi image).

  1. below is my custom kaniko image dockerfile

`FROM gcr.io/kaniko-project/executor:debug as kaniko COPY certs/ca.pem kaniko/ssl/certs/ca-certificates.crt

FROM registry.gitlab.com/test:9.2 RUN rm -rf /var/mail COPY --from=kaniko /kaniko /kaniko ENV DOCKER_CONFIG /kaniko/.docker/ ENV DOCKER_CREDENTIAL_GCR_CONFIG /kaniko/.config/gcloud/docker_credential_gcr_config.json `

  1. Create another Dockerfile using the custom-built Kaniko image (from Step 1):

FROM docker:26.1.2 RUN apk update CMD ["echo", "This is a 'Purpose-Built Container', It is not meant to be ran this way. Please review the documentation on usage."]

Can someone help me here? Is this the right way to build a custom Kaniko image? Do custom Kaniko image builds work in this manner, or are there any suggestions to resolve the issue?

vladaurosh commented 1 month ago

Did you check readme file? kaniko is meant to be run as an image: gcr.io/kaniko-project/executor. We do not recommend running the kaniko executor binary in another image, as it might not work as you expect - see [Known Issues](https://github.com/GoogleContainerTools/kaniko#known-issues).