Missing libssl.so.x.x symlink in final docker image

[MattTimms]

This only affects newly built images; docker pull lycheeverse/lychee as per the README fetches a working image ("Created": "2024-03-22T23:29:28.775271855Z").

Due to the floating versions of the base images used in the Dockerfile, i.e. rust:latest & debian:bullseye-slim, there is a issue between the libssl-dev version of the builder stage & that of the final base image. This causes the following error when running a freshly built container:

lychee: error while loading shared libraries: libssl.so.3: cannot open shared object file: No such file or directory

As of time of writing, building the Dockerfile fetches:

> docker pull rust:latest
latest: Pulling from library/rust
...
Digest: sha256:00e330d2e2cdada2b75e9517c8359df208b3c880c5e34cb802c120083d50af35
...

> docker pull debian:bullseye-slim
bullseye-slim: Pulling from library/debian
...
Digest: sha256:a165446a88794db4fec31e35e9441433f9552ae048fb1ed26df352d2b537cb96
...

The contents of /usr/lib/x86_64-linux-gnu/ for each of these images is: libssl.so, libssl.so.3 for rust:latest, & libssl.so.1.1 for debian:bullseye-slim. Hence, the lychee from builder is expected libssl.so.3 where the final image contains only libssl.so.1.1.

Solutions could be to:

• add a step to the Dockerfile to create a symlink for the expected libssl.so.x.x file, assuming its compatible across base-images.
• fix the base images to revision tags that are known to be compatible, e.g. FROM rust@sha256:...
• use the same base image for both builder & final stages

[mre]

Thanks.

From the options you presented, we'd ideally use the same image. Maybe we could change it to rust:slim-buster, which would ensure that the image stays small?

[MattTimms]

The current lychee docker image (available via docker pull lycheeverse/lychee) weighs 107MB & uses rust:latest & debian:bullseye-slim. That rust:latest aliases to rust:bookworm (docker) which is Debian 12 (releases). However, debian:bullseye-slim is Debian 11 - I believe that's why there's different libssl.so.x.x files present.

I think the best solution is to, instead, ensure the two base images use the same Debian version. I tested the Dockerfile with both the same base images, separately, as rust:slim-bullseye & rust:slim-buster (despite being Debian 10) as you suggested. In short, rust images are b i g (~1GB).

I'd suggest using rust:bookworm & debian:bookworm-slim, which produces a 375MB image & appears to work as expected. I cannot account for the difference in lychee executable size between this new image & the original (~292MB vs. 84MB)

[MattTimms]

I cannot account for the difference in lychee executable size between this new image & the original (~292MB vs. 84MB)

Yes, I can. The executable isn't stripped in Dockerfile as it is in the GitHub Releases here. I have realised that the Dockerfile isn't used for the public image release.

[mre]

As far as I can see, this can be closed because of the excellent work by @MattTimms.
Thanks for looking into this and fixing it so cleanly and thoroughly. Props!

(The libssl issues should be resolved now; please reopen in case that's incorrect.)