Prisma failing on changed OpenSSL path in Alpine 3.21

[sambhav-gore]

I have a project that uses Prisma.
Until few months ago there was no issue with the image but today if I try to build the docker image with following, Prisma fails to build as it does not find openssl

FROM node:20-alpine AS base

RUN npm install -g pnpm

FROM base as dependencies

WORKDIR /app

COPY package.json .
COPY pnpm-lock.yaml .

RUN pnpm install

FROM base as build

WORKDIR /app

COPY . .
COPY --from=dependencies /app/node_modules ./node_modules
RUN pnpm run build

It used to work before so something is broken recently.

installing openssl manually in dockerfile works as a workaround.

Environment

• Platform: Alpine
• Docker Version:
• Node.js Version: 20 / 18
• Image Tag: node:20-alpine / node:18-alpine

Expected Behavior

It should have openssl installed and available.

Current Behavior

No openssl

Possible Solution

Steps to Reproduce

Additional Information

Available workaround:

Add the following in the dockerfile to install openssl in the docker image manually:

RUN apk update \
	&& apk add --no-cache openssl\
	&& rm -rf /var/lib/apt/lists/* \
	&& rm -rf /var/cache/apk/*

[PhilDakin]

Above fix did not work for me, installs 3.3.2 which seems incompatible with Prisma.

24-12-09 21:10:55 /Users/Phil/Documents/Wayside/Code/wayside-core: docker run --rm public.ecr.aws/docker/library/node:20-alpine sh -c "apk update && apk search openssl" | grep -E "^openssl-"
openssl-3.3.2-r4
openssl-dbg-3.3.2-r4
openssl-dev-3.3.2-r4
openssl-doc-3.3.2-r4
openssl-libs-static-3.3.2-r4
openssl-misc-3.3.2-r4

prisma:warn Prisma failed to detect the libssl/openssl version to use, and may not work as expected. Defaulting to "openssl-1.1.x".

UPDATE: Using 3.17 as a workaround worked for me, public.ecr.aws/docker/library/node:20-alpine3.17.

[yujiberra]

FYI, since I ran into the same issue today, it occurs with node:20-alpine3.21 but not with node:20-alpine3.20, and the reason is not that the former doesn't have OpenSSL, it's that the library is stored in a different location.

Specifically, in 3.20 it's in /lib/libssl.so.3 but in 3.21 it's in /usr/lib/libssl.so.3.
(Actually 3.20 also has /usr/lib/libssl.so.3, but the point is that /lib/libssl.so.3 is what is needed).

So adding something like

RUN ln -s /usr/lib/libssl.so.3 /lib/libssl.so.3

to your Dockerfile also works.

(The release notes for Alpine 3.21 talk about moving some stuff to /usr so that's probaly what's going on)

[inhanbyeol]

I have the same case. How can I solve it?

/node_modules/@prisma/client/runtime/library.js:63
${Ze(e)}`}var nd=F("prisma:client:engines:resolveEnginePath"),id=()=>new RegExp("runtime[\\\\/]library\\.m?js$");async function Ca(e,t){let r={binary:process.env.PRISMA_QUERY_ENGINE_BINARY,library:process.env.PRISMA_QUERY_ENGINE_LIBRARY}[e]??t.prismaPath;if(r!==void 0)return r;let{enginePath:n,searchedLocations:i}=await od(e,t);if(nd("enginePath",n),n!==void 0&&e==="binary"&&ii(n),n!==void 0)return t.prismaPath=n;let o=await tt(),s=t.generator?.binaryTargets??[],a=s.some(d=>d.native),l=!s.some(d=>d.value===o),u=__filename.match(id())===null,c={searchedLocations:i,generatorBinaryTargets:s,generator:t.generator,runtimeBinaryTarget:o,queryEngineName:Sa(e,o),expectedLocation:dr.default.relative(process.cwd(),t.dirname),errorStack:new Error().stack},p;throw a&&l?p=va(c):l?p=xa(c):u?p=Pa(c):p=Ta(c),new R(p,t.clientVersion)}async function od(engineType,config){let binaryTarget=await tt(),searchedLocations=[],dirname=eval("__dirname"),searchLocations=[config.dirname,dr.default.resolve(dirname,".."),config.generator?.output?.value??dirname,dr.default.resolve(dirname,"../../../.prisma/client"),"/tmp/prisma-engines",config.cwd];__filename.includes("resolveEnginePath")&&searchLocations.push(Go());for(let e of searchLocations){let t=Sa(engineType,binaryTarget),r=dr.default.join(e,t);if(searchedLocations.push(e),Ra.default.existsSync(r))return{enginePath:r,searchedLocations}}return{enginePath:void 0,searchedLocations}}function Sa(e,t){return e==="library"?Nr(t,"fs"):`query-engine-${t}${t==="windows"?".exe":""}`}var qi=k(fi());function Aa(e){return e?e.replace(/".*"/g,'"X"').replace(/[\s:\[]([+-]?([0-9]*[.])?[0-9]+)/g,t=>`${t[0]}5`):""}function Ia(e){return e.split(`
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ^

PrismaClientInitializationError: Prisma Client could not locate the Query Engine for runtime "linux-musl-openssl-3.0.x".

This happened because Prisma Client was generated for "linux-musl", but the actual deployment required "linux-musl-openssl-3.0.x".
Add "linux-musl-openssl-3.0.x" to `binaryTargets` in the "schema.prisma" file and run `prisma generate` after saving it:

generator client {
  provider      = "prisma-client-js"
  binaryTargets = ["native", "linux-musl-openssl-3.0.x"]
}

The following locations have been searched:
  /node_modules/.prisma/client
  /node_modules/@prisma/client
  /usr/src/app/node_modules/@prisma/client
  /tmp/prisma-engines
    at Ca (/node_modules/@prisma/client/runtime/library.js:63:805)
    at async Object.loadLibrary (/node_modules/@prisma/client/runtime/library.js:110:10060)
    at async Cr.loadEngine (/node_modules/@prisma/client/runtime/library.js:111:448)
    at async Cr.instantiateLibrary (/node_modules/@prisma/client/runtime/library.js:110:12575) {
  clientVersion: '5.19.0',
  errorCode: undefined
}

Node.js v20.18.1

[9z]

I have the same case. How can I solve it?

/node_modules/@prisma/client/runtime/library.js:63
${Ze(e)}`}var nd=F("prisma:client:engines:resolveEnginePath"),id=()=>new RegExp("runtime[\\\\/]library\\.m?js$");async function Ca(e,t){let r={binary:process.env.PRISMA_QUERY_ENGINE_BINARY,library:process.env.PRISMA_QUERY_ENGINE_LIBRARY}[e]??t.prismaPath;if(r!==void 0)return r;let{enginePath:n,searchedLocations:i}=await od(e,t);if(nd("enginePath",n),n!==void 0&&e==="binary"&&ii(n),n!==void 0)return t.prismaPath=n;let o=await tt(),s=t.generator?.binaryTargets??[],a=s.some(d=>d.native),l=!s.some(d=>d.value===o),u=__filename.match(id())===null,c={searchedLocations:i,generatorBinaryTargets:s,generator:t.generator,runtimeBinaryTarget:o,queryEngineName:Sa(e,o),expectedLocation:dr.default.relative(process.cwd(),t.dirname),errorStack:new Error().stack},p;throw a&&l?p=va(c):l?p=xa(c):u?p=Pa(c):p=Ta(c),new R(p,t.clientVersion)}async function od(engineType,config){let binaryTarget=await tt(),searchedLocations=[],dirname=eval("__dirname"),searchLocations=[config.dirname,dr.default.resolve(dirname,".."),config.generator?.output?.value??dirname,dr.default.resolve(dirname,"../../../.prisma/client"),"/tmp/prisma-engines",config.cwd];__filename.includes("resolveEnginePath")&&searchLocations.push(Go());for(let e of searchLocations){let t=Sa(engineType,binaryTarget),r=dr.default.join(e,t);if(searchedLocations.push(e),Ra.default.existsSync(r))return{enginePath:r,searchedLocations}}return{enginePath:void 0,searchedLocations}}function Sa(e,t){return e==="library"?Nr(t,"fs"):`query-engine-${t}${t==="windows"?".exe":""}`}var qi=k(fi());function Aa(e){return e?e.replace(/".*"/g,'"X"').replace(/[\s:\[]([+-]?([0-9]*[.])?[0-9]+)/g,t=>`${t[0]}5`):""}function Ia(e){return e.split(`
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ^

PrismaClientInitializationError: Prisma Client could not locate the Query Engine for runtime "linux-musl-openssl-3.0.x".

This happened because Prisma Client was generated for "linux-musl", but the actual deployment required "linux-musl-openssl-3.0.x".
Add "linux-musl-openssl-3.0.x" to `binaryTargets` in the "schema.prisma" file and run `prisma generate` after saving it:

generator client {
  provider      = "prisma-client-js"
  binaryTargets = ["native", "linux-musl-openssl-3.0.x"]
}

The following locations have been searched:
  /node_modules/.prisma/client
  /node_modules/@prisma/client
  /usr/src/app/node_modules/@prisma/client
  /tmp/prisma-engines
    at Ca (/node_modules/@prisma/client/runtime/library.js:63:805)
    at async Object.loadLibrary (/node_modules/@prisma/client/runtime/library.js:110:10060)
    at async Cr.loadEngine (/node_modules/@prisma/client/runtime/library.js:111:448)
    at async Cr.instantiateLibrary (/node_modules/@prisma/client/runtime/library.js:110:12575) {
  clientVersion: '5.19.0',
  errorCode: undefined
}

Node.js v20.18.1

In my case, modifying the base image in the Dockerfile to node:20-alpine3.17 worked well.
Please try changing the base image in your Dockerfile to node:20-alpine3.17.

FROM node:20-alpine3.17

[inhanbyeol]

thx. i solved it by specifying node:20-alpine3.20 version

[yujiberra]

Y'all, I literally already posted a solution in #2175 (comment) lmao

There are two easy ways to solve this: either change the base image to node:20-alpine3.20 (you don't need to go all the way back to 3.17)

FROM node:20-alpine3.20

or, you can create a symlink so that apps like Prisma can find libssl where they're expecting it:

RUN ln -s /usr/lib/libssl.so.3 /lib/libssl.so.3

[JefferMarcelino]

I was having the same issue, and I manually installed openssl by running RUN apk add --no-cache openssl.

My Dockerfile now looks like this:

FROM node:20-alpine AS builder

RUN apk add --no-cache openssl # Here

WORKDIR /usr/src/app

COPY package*.json ./

RUN npm install --frozen-lockfile

COPY . .

RUN npx prisma generate

RUN npm run build

FROM node:20-alpine AS production

RUN apk add --no-cache openssl # And here

WORKDIR /usr/src/app

COPY --from=builder /usr/src/app/package*.json ./
COPY --from=builder /usr/src/app/node_modules ./node_modules
COPY --from=builder /usr/src/app/dist ./dist
COPY --from=builder /usr/src/app/prisma ./prisma
COPY --from=builder /usr/src/app/logo.png logo.png
COPY --from=builder /usr/src/app/tsconfig.json ./tsconfig.json
COPY --from=builder /usr/src/app/tsconfig.build.json ./tsconfig.build.json

ENV NODE_ENV=production

EXPOSE 3000

CMD ["sh", "-c", "npx prisma migrate deploy && node dist/main.js"]

[antongildebrand]

Don't know if it's related but I just assumed that the package missing has something to do with the critical vulnerability in OpenSSL as shown on DockerHub
https://hub.docker.com/layers/library/node/22-alpine/images/sha256-3a4802e64ab5181c7870d6ddd8c824c2efc42873baae37d1971451668659483b

We solved it by installing OpenSSL as part of our build Dockerfile.

[LaurentGoderre]

The image does have openssl. As per @yujiberra it seems the location where it is installed changed in the latest alpine.

[Marlrus]

FYI, since I ran into the same issue today, it occurs with node:20-alpine3.21 but not with node:20-alpine3.20, and the reason is not that the former doesn't have OpenSSL, it's that the library is stored in a different location.

Specifically, in 3.20 it's in /lib/libssl.so.3 but in 3.21 it's in /usr/lib/libssl.so.3. (Actually 3.20 also has /usr/lib/libssl.so.3, but the point is that /lib/libssl.so.3 is what is needed).

So adding something like

RUN ln -s /usr/lib/libssl.so.3 /lib/libssl.so.3

to your Dockerfile also works.

(The release notes for Alpine 3.21 talk about moving some stuff to /usr so that's probaly what's going on)

I would say this is the best solution. It worked on our clusters that experienced the same issue. Cheers @yujiberra !