-
Notifications
You must be signed in to change notification settings - Fork 159
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Images contain *-dev
packages that are used to build HAProxy but which are useless at runtime
#225
Comments
L3n41c
added a commit
to L3n41c/haproxy
that referenced
this issue
Apr 5, 2024
Fixes docker-library#225 The issue comes from the logic that aims at removing the packages that were needed to build `haproxy` but which are not needed at runtime anymore. ```bash find /usr/local -type f -executable -exec ldd '{}' ';' \ | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); print so }' \ | sort -u \ | xargs -r dpkg-query --search \ | cut -d: -f1 \ | sort -u \ | xargs -r apt-mark manual \ ``` The `ldd` looks for the libraries that `haproxy` depends on, among which, `libc.so.6`. The `awk` command reformats the output of `ldd` and produces, among other libraries: ``` lib/x86_64-linux-gnu/libc.so.6 ``` Those files are then passed to `dpkg-query` to find their owning package. And this is where the issue is coming from: ``` root@f6106d13cb42:/# dpkg-query --search lib/x86_64-linux-gnu/libc.so.6 libc6-dev:amd64: /usr/share/gdb/auto-load/lib/x86_64-linux-gnu/libc.so.6-gdb.py libc6:amd64: /lib/x86_64-linux-gnu/libc.so.6 ``` The issue is that the library we are interested in happens to also be a substring of a GDB pretty-printing script that is obviously not needed at runtime by `haproxy`.
L3n41c
added a commit
to L3n41c/haproxy
that referenced
this issue
Apr 5, 2024
Fixes docker-library#225 The issue comes from the logic that aims at removing the packages that were needed to build `haproxy` but which are not needed at runtime anymore. ```bash find /usr/local -type f -executable -exec ldd '{}' ';' \ | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); print so }' \ | sort -u \ | xargs -r dpkg-query --search \ | cut -d: -f1 \ | sort -u \ | xargs -r apt-mark manual \ ``` The `ldd` looks for the libraries that `haproxy` depends on, among which, `libc.so.6`. The `awk` command reformats the output of `ldd` and produces, among other libraries: ``` lib/x86_64-linux-gnu/libc.so.6 ``` Those files are then passed to `dpkg-query` to find their owning package. And this is where the issue is coming from: ``` root@f6106d13cb42:/# dpkg-query --search lib/x86_64-linux-gnu/libc.so.6 libc6-dev:amd64: /usr/share/gdb/auto-load/lib/x86_64-linux-gnu/libc.so.6-gdb.py libc6:amd64: /lib/x86_64-linux-gnu/libc.so.6 ``` The issue is that the library we are interested in happens to also be a substring of a GDB pretty-printing script that is obviously not needed at runtime by `haproxy`.
L3n41c
added a commit
to L3n41c/haproxy
that referenced
this issue
Apr 5, 2024
Fixes docker-library#225 The issue comes from the logic that aims at removing the packages that were needed to build `haproxy` but which are not needed at runtime anymore. ```bash find /usr/local -type f -executable -exec ldd '{}' ';' \ | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); print so }' \ | sort -u \ | xargs -r dpkg-query --search \ | cut -d: -f1 \ | sort -u \ | xargs -r apt-mark manual \ ``` The `ldd` looks for the libraries that `haproxy` depends on, among which, `libc.so.6`. The `awk` command reformats the output of `ldd` and produces, among other libraries: ``` lib/x86_64-linux-gnu/libc.so.6 ``` Those files are then passed to `dpkg-query` to find their owning package. And this is where the issue is coming from: ``` root@f6106d13cb42:/# dpkg-query --search lib/x86_64-linux-gnu/libc.so.6 libc6-dev:amd64: /usr/share/gdb/auto-load/lib/x86_64-linux-gnu/libc.so.6-gdb.py libc6:amd64: /lib/x86_64-linux-gnu/libc.so.6 ``` The issue is that the library we are interested in happens to also be a substring of a GDB pretty-printing script that is obviously not needed at runtime by `haproxy`.
L3n41c
added a commit
to L3n41c/haproxy
that referenced
this issue
Apr 6, 2024
Fixes docker-library#225 The issue comes from the logic that aims at removing the packages that were needed to build `haproxy` but which are not needed at runtime anymore. ```bash find /usr/local -type f -executable -exec ldd '{}' ';' \ | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); print so }' \ | sort -u \ | xargs -r dpkg-query --search \ | cut -d: -f1 \ | sort -u \ | xargs -r apt-mark manual \ ``` The `ldd` looks for the libraries that `haproxy` depends on, among which, `libc.so.6`. The `awk` command reformats the output of `ldd` and produces, among other libraries: ``` lib/x86_64-linux-gnu/libc.so.6 ``` Those files are then passed to `dpkg-query` to find their owning package. And this is where the issue is coming from: ``` root@f6106d13cb42:/# dpkg-query --search lib/x86_64-linux-gnu/libc.so.6 libc6-dev:amd64: /usr/share/gdb/auto-load/lib/x86_64-linux-gnu/libc.so.6-gdb.py libc6:amd64: /lib/x86_64-linux-gnu/libc.so.6 ``` The issue is that the library we are interested in happens to also be a substring of a GDB pretty-printing script that is obviously not needed at runtime by `haproxy`.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The
haproxy
docker images are containing some*-dev
packages:Whereas those packages are needed to build
haproxy
, they contain only header files and static libraries which are useless at runtime.Hence, they shouldn’t be shipped in the final image.
The text was updated successfully, but these errors were encountered: