Error in oracle instant client in docker with python image

[h30306]

Hi Community,

I'm using FastAPI with Oracle 19c. Recently, I tried migrating to Thick mode.
Initially, I tested it locally by using the Instant Client for macOS (ARM64) version on my MacBook, and it worked fine.

Afterward, I wanted to add the installation steps into my Dockerfile for deployment via Docker on Kubernetes. However, I encountered some issues.
At first, there were path-related problems, but after some digging and fixing, I realized there might be a more fundamental issue:
the base images I tried, such as python:3.12-alpine and python:3.12.2-slim-bookworm, are built with musl instead of glibc.
Because of this, some necessary functionalities expected by the Oracle Instant Client are missing, leading to runtime issues.

Since I'm not very familiar with C-level system differences, I'm not entirely sure if this understanding is accurate. Is there any suggestion of this problem?

• Minimal reproducible example:

FROM python:3.12-alpine

ARG SERVICE_HOME=/opt/backend

USER root

# Install common packages and database drivers
RUN apk add --no-cache \
    bash \
    gcc \
    musl-dev \
    libffi-dev \
    openssl-dev \
    unixodbc \
    libaio

# Download and setup Oracle Instant Client
WORKDIR ${SERVICE_HOME}
RUN wget https://download.oracle.com/otn_software/linux/instantclient/1927000/instantclient-basic-linux.x64-19.27.0.0.0dbru.zip \
    && unzip instantclient-basic-linux.x64-19.27.0.0.0dbru.zip \
    && rm instantclient-basic-linux.x64-19.27.0.0.0dbru.zip \
    && cd instantclient_19_27 \
    && rm -f *jdbc* *occi* *mysql* *README *jar uidrvci genezi adrci \
    && mkdir -p lib \
    && mv *.so* lib/ \
    && mv network lib/ \
    && cd ..

ENV LD_LIBRARY_PATH="${SERVICE_HOME}/instantclient_19_27" \
    ORACLE_HOME="${SERVICE_HOME}/instantclient_19_27" \
    PATH="${SERVICE_HOME}/instantclient_19_27:${PATH}"

# Create application user and working directory
RUN adduser -D -s /bin/bash backend-user \
    && mkdir -p ${SERVICE_HOME} && chown -R backend-user:backend-user ${SERVICE_HOME}

WORKDIR ${SERVICE_HOME}

# Set permissions
RUN chown -R backend-user:backend-user ${SERVICE_HOME}

# Install Python packages
RUN pip3 install oracledb==2.4.0

# Final working directory
WORKDIR ${SERVICE_HOME}

• Installation command (with docker damon on)

docker build -t test-backend .
docker rm -f test-backend && docker run -it --name test-backend test-backend /bin/bash

• After enter shell in container
  activate python

python3

• Python command

import oracledb
oracledb.init_oracle_client()

• Error:

>>> import oracledb
>>> oracledb.init_oracle_client()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "src/oracledb/impl/thick/utils.pyx", line 494, in oracledb.thick_impl.init_oracle_client
  File "src/oracledb/impl/thick/utils.pyx", line 519, in oracledb.thick_impl.init_oracle_client
  File "src/oracledb/impl/thick/utils.pyx", line 446, in oracledb.thick_impl._raise_from_info
oracledb.exceptions.DatabaseError: DPI-1047: Cannot locate a 64-bit Oracle Client library: "Error loading shared library libnnz19.so: No such file or directory (needed by /opt/backend/instantclient_19_27/lib/libclntsh.so)". See https://python-oracledb.readthedocs.io/en/latest/user_guide/initialization.html for help
Help: https://python-oracledb.readthedocs.io/en/latest/user_guide/troubleshooting.html#dpi-1047

I think I have this file under lib

e9e656b9d054:/opt/backend/instantclient_19_27/lib# ls
libccme_asym.so           libccme_ecc.so            libclntsh.so.10.1         libclntsh.so.18.1         libcryptocme.so           libnnz19.so
libccme_base.so           libccme_ecc_non_fips.so   libclntsh.so.11.1         libclntsh.so.19.1         libipc1.so                libociei.so
libccme_base_non_fips.so  libclntsh.so              libclntsh.so.12.1         libclntshcore.so.19.1     libmql1.so                network

Thanks in advance for any advice or suggestions!

Note: Is there any recommendation for a better Docker base image when using FastAPI + Oracle 19c with Instant Client support? (I'v already tried to use oraclelinux:9, but I would like to use python base image instead)

[cjbj]

• What Thick mode features do you need?
• I don't think hacking Alpine to support Instant Client is a good idea; it is an "unknown", likely to be fragile, and not something to put into production.
• Never set ORACLE_HOME when using Instant Client
• Explore the Dockerfiles at https://github.com/oracle/docker-images/tree/main/OracleLinuxDevelopers
• Use OL8 Arm. Or use x86_64 if you need OL9 support.
• With OL8 on x86_64 or Arm:

   sudo dnf install oracle-instantclient-release-23ai-el8
   sudo dnf install oracle-instantclient-basic
  

[h30306]

Hi @cjbj,

sorry for the late reply

1. I'm trying to use NNE to connect to my DB
2. got it, I'll use the oraclelinux base image instead

Thanks for the reply!

[cjbj]

@h30306 Thanks for the info. Sadly we can't support NNE in Thin mode.

The general Oracle recommendation is to move from NNE to TLS. Some resources about this from the DB security team are:

• https://docs.oracle.com/en/database/oracle/oracle-database/23/dbseg/configuring-transport-layer-security-encryption.html
• https://livelabs.oracle.com/pls/apex/f?p=133:100:112306450264738::::SEARCH:TLS
• https://www.youtube.com/watch?v=MvGcGQspg2A

[h30306]

Hi @cjbj

Thank you for the additional resources. I followed the documentation and created a self‑signed certificate to enable TLS, but I’ve run into an issue, could you please take a look? Thanks!
Discussion Link: #491