ModuleNotFound error: No module named '_ssl' for python 3.10.x and 3.11.x in amazonlinux:2 Docker

[jerryhxu]

Description

Hi, I use the following dockerfile to create a docker image.

FROM amazonlinux:2

USER root
ENV HOME="/root"
WORKDIR /
ENTRYPOINT []
CMD ["/bin/bash"]

# Install required packages
RUN yum update -y && \
    yum install -y \
    git \
    gcc \
    zlib-devel \
    bzip2 \
    bzip2-devel \
    readline-devel \
    sqlite \
    sqlite-devel \
    openssl \
    openssl-devel \
    tk-devel \
    libffi-devel \
    xz-devel \
    tar \
    make \
    patch

# Install pyenv
RUN curl https://pyenv.run | bash

# Set environment variables for pyenv
ENV PYENV_ROOT /root/.pyenv
ENV PATH $PYENV_ROOT/shims:$PYENV_ROOT/bin:$PATH

RUN pyenv install 3.10.1

# Set working directory
WORKDIR /app

The issue I am having is that this file has successfully installed python 3.8.11 and 3.9.16. However it encountered the error if I tried to install version 3.10.x and 3.11.x. The following is the error message for python version 3.10.1:

7 Traceback (most recent call last):                                                                                                                                                                                          
322.7   File "<string>", line 1, in <module>
322.7   File "/root/.pyenv/versions/3.10.1/lib/python3.10/ssl.py", line 98, in <module>
322.7     import _ssl             # if we can't import it, let the error propagate
322.7 ModuleNotFoundError: No module named '_ssl'
322.7 ERROR: The Python ssl extension was not compiled. Missing the OpenSSL lib?

I did look at the the common problems here [https://github.com/pyenv/pyenv/wiki/Common-build-problems]. But it is not very helpful in my case since this dockerfile is good for both python 3.8.x and 3.9.x. Can anyone help take a look at it? Thanks.

[native-api]

$ openssl version
OpenSSL 1.0.2k-fips 26 Jan 2017

Python 3.10+ requires OpenSSL 1.1.1+

[ryan-williams]

It seems like this works:

yum remove openssl-devel
yum install openssl11-devel
pyenv install 3.9

I've also had this saved for years, to install OpenSSL 1.1.1 from source, under ~, :

wget https://github.com/openssl/openssl/archive/OpenSSL_1_1_1.tar.gz
tar -xvzf OpenSSL_1_1_1.tar.gz
cd openssl-OpenSSL_1_1_1/
./config --prefix=$HOME
make
make install
cd ..
CFLAGS="-I$HOME/include" LDFLAGS="-L$HOME/lib" pyenv install 3.7.4

hopefully that's not necessary anymore(?).

This is my full script for Amazon Linux, updated to specify openssl11-devel:

curl https://pyenv.run | bash
sudo yum update -y
sudo yum install -y gcc git zlib-devel openssl11-devel libffi-devel bzip2-devel ncurses-devel readline-devel xz-devel sqlite-devel
pyenv install 3.11.6

Is there an easier way?

---

Update: today (on more recent AZLinux? 6.1.77-99.164?) openssl11-devel above doesn't resolve, and I used openssl-devel successfully:

curl https://pyenv.run | bash
sudo yum update -y
sudo yum install -y gcc git zlib-devel openssl-devel libffi-devel bzip2-devel ncurses-devel readline-devel xz-devel sqlite-devel
pyenv install 3.11.8

[native-api]

@ryan-williams Since about 3.9, CPython supports OpenSSL 3, the support is official since 3.11.5 . So you don't need 1.1 anymore.

[FANGOD]

@ryan-williams Since about 3.9, CPython supports OpenSSL 3, the support is official since 3.11.5 . So you don't need 1.1 anymore.

Are you serious? That's mean windows builds and macOS installers.

[FANGOD]

It seems like this works:

yum remove openssl-devel
yum install openssl11-devel
pyenv install 3.9

I've also had this saved for years, to install OpenSSL 1.1.1 from source, under ~, :

wget https://github.com/openssl/openssl/archive/OpenSSL_1_1_1.tar.gz
tar -xvzf OpenSSL_1_1_1.tar.gz
cd openssl-OpenSSL_1_1_1/
./config --prefix=$HOME
make
make install
cd ..
CFLAGS="-I$HOME/include" LDFLAGS="-L$HOME/lib" pyenv install 3.7.4

hopefully that's not necessary anymore(?).

This is my full script for Amazon Linux, updated to specify openssl11-devel:

curl https://pyenv.run | bash
sudo yum update -y
sudo yum install -y gcc git zlib-devel openssl11-devel libffi-devel bzip2-devel ncurses-devel readline-devel xz-devel sqlite-devel
pyenv install 3.11.6

Is there an easier way?

Not works on el7

[native-api]

@ryan-williams Since about 3.9, CPython supports OpenSSL 3, the support is official since 3.11.5 . So you don't need 1.1 anymore.

Are you serious? That's mean windows builds and macOS installers.

They never made any kind of official announcement about OpenSSL 3.0 support stage (when it was first added, it was considered experimental and one of the core devs told us about a year ago that it still was) so we have to guess. Starting to ship their prebuilt releases with this version is the closest thing to an official announcement.