Latest path changes on 3.10-slim image leading to errors when building applications with staticx

Hi everyone and thank you for maintaining this project. I have used your docker images heavily over the past years :)

Since this morning I am facing issues when running staticx against one of my Python applications. I have successfully built an image yesterday and have not changed anything in my application, but with the latest 3.10-slim image, I get an error with unsupported RPATH/RUNPATH tags, I believe because of the way the paths in the image have changed to absolute paths.
#785

I know this sounds like a very specific issue outside your scope, but I would like to at least know if this is intended on your side or not.
Please find the link to the issue with staticx here:
JonathonReinhart/staticx#188

Example:

...
/tmp/staticx-pyi-1eb5z08n/lib-dynload/_asyncio.cpython-310-x86_64-linux-gnu.so: DT_RUNPATH='/../lib:$ORIGIN/../lib'
...

Would be great to get a quick comment on this.

Cheers!

@oktavlachs

@oktavlachs I found the same errors on official python images, where dtags/runpaths are used even with venvs.

I could circumvent this by using a SO python version, like python 3.8 on debian 11.

The Dockerfile below doesn't work:

FROM python:3.11-buster as builder
RUN apt-get update && \
    apt-get install scons patchelf upx -y
WORKDIR /usr/src
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY metadata_cleaner.py .
RUN pyinstaller -F metadata_cleaner.py
RUN staticx dist/metadata_cleaner dist/metadata_cleaner_static

FROM debian:10-slim
COPY --from=builder /usr/src/dist/metadata_cleaner_static /usr/local/bin/metadata_cleaner

But this one works:

FROM debian:11 as builder
RUN apt-get update && \
    apt-get install scons patchelf upx python3-minimal python3-pip python3-venv python3-dev python3-wheel gcc --no-install-recommends -y
ENV VIRTUAL_ENV=/usr/src/.venv 
RUN python3 -m venv $VIRTUAL_ENV
ENV PATH="$VIRTUAL_ENV/bin:$PATH"
WORKDIR /usr/src
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY metadata_cleaner.py .
RUN pyinstaller -F metadata_cleaner.py
RUN staticx dist/metadata_cleaner dist/metadata_cleaner_static

FROM debian:11-slim
COPY --from=builder /usr/src/dist/metadata_cleaner_static /usr/local/bin/metadata_cleaner

@c-gabdalla

@c-gabdalla
Fantastic, thanks a lot for this hint! :)

However, I would still appreciate a quick comment on whether this is intended.

Looking at JonathonReinhart/staticx#188, we should be fine because we're only (intending, anyhow) to have rpath values relative to $ORIGIN:

python/3.11/bullseye/Dockerfile

Lines 56 to 60 in 2592ad8

    
           # \$ because of the double quotes in the shell to prevent interpolation 
        
           # $$ for make to not interpret the $O 
        
           # " because it needs the ' around the path, and '"'"' instead is 🤢 
        
           		LDFLAGS="-Wl,-rpath='\$\$ORIGIN/../lib'" \ 
        
           	; \

When I use readelf to verify that, everything looks fine to me?

$ docker run --rm --pull=always python readelf --dynamic /usr/local/bin/python
latest: Pulling from library/python
Digest: sha256:a3c0c6766535f85f18e7304d3a0111de5208d73935bcf1b024217005ad5ce195
Status: Image is up to date for python:latest

Dynamic section at offset 0x2dd8 contains 28 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libpython3.11.so.1.0]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x000000000000001d (RUNPATH)            Library runpath: [$ORIGIN/../lib]
 0x000000000000000c (INIT)               0x1000
 0x000000000000000d (FINI)               0x11b4
 0x0000000000000019 (INIT_ARRAY)         0x3dc8
 0x000000000000001b (INIT_ARRAYSZ)       8 (bytes)
 0x000000000000001a (FINI_ARRAY)         0x3dd0
 0x000000000000001c (FINI_ARRAYSZ)       8 (bytes)
 0x000000006ffffef5 (GNU_HASH)           0x308
 0x0000000000000005 (STRTAB)             0x4d8
 0x0000000000000006 (SYMTAB)             0x358
 0x000000000000000a (STRSZ)              258 (bytes)
 0x000000000000000b (SYMENT)             24 (bytes)
 0x0000000000000015 (DEBUG)              0x0
 0x0000000000000003 (PLTGOT)             0x4000
 0x0000000000000002 (PLTRELSZ)           24 (bytes)
 0x0000000000000014 (PLTREL)             RELA
 0x0000000000000017 (JMPREL)             0x6e0
 0x0000000000000007 (RELA)               0x620
 0x0000000000000008 (RELASZ)             192 (bytes)
 0x0000000000000009 (RELAENT)            24 (bytes)
 0x000000006ffffffb (FLAGS_1)            Flags: PIE
 0x000000006ffffffe (VERNEED)            0x600
 0x000000006fffffff (VERNEEDNUM)         1
 0x000000006ffffff0 (VERSYM)             0x5da
 0x000000006ffffff9 (RELACOUNT)          3
 0x0000000000000000 (NULL)               0x0

$ docker run --rm --pull=always python:slim sh -c 'apt-get update -qqq && apt-get install -yqqq binutils && readelf --dynamic /usr/local/bin/python'
slim: Pulling from library/python
Digest: sha256:79095e304e31196bad049e74f666508ac81909d201ec9371f9f3cd68fa365cf6
Status: Image is up to date for python:slim
debconf: delaying package configuration, since apt-utils is not installed
Selecting previously unselected package binutils-common:amd64.
(Reading database ... 7031 files and directories currently installed.)
Preparing to unpack .../0-binutils-common_2.35.2-2_amd64.deb ...
Unpacking binutils-common:amd64 (2.35.2-2) ...
Selecting previously unselected package libbinutils:amd64.
Preparing to unpack .../1-libbinutils_2.35.2-2_amd64.deb ...
Unpacking libbinutils:amd64 (2.35.2-2) ...
Selecting previously unselected package libctf-nobfd0:amd64.
Preparing to unpack .../2-libctf-nobfd0_2.35.2-2_amd64.deb ...
Unpacking libctf-nobfd0:amd64 (2.35.2-2) ...
Selecting previously unselected package libctf0:amd64.
Preparing to unpack .../3-libctf0_2.35.2-2_amd64.deb ...
Unpacking libctf0:amd64 (2.35.2-2) ...
Selecting previously unselected package binutils-x86-64-linux-gnu.
Preparing to unpack .../4-binutils-x86-64-linux-gnu_2.35.2-2_amd64.deb ...
Unpacking binutils-x86-64-linux-gnu (2.35.2-2) ...
Selecting previously unselected package binutils.
Preparing to unpack .../5-binutils_2.35.2-2_amd64.deb ...
Unpacking binutils (2.35.2-2) ...
Setting up binutils-common:amd64 (2.35.2-2) ...
Setting up libctf-nobfd0:amd64 (2.35.2-2) ...
Setting up libbinutils:amd64 (2.35.2-2) ...
Setting up libctf0:amd64 (2.35.2-2) ...
Setting up binutils-x86-64-linux-gnu (2.35.2-2) ...
Setting up binutils (2.35.2-2) ...
Processing triggers for libc-bin (2.31-13+deb11u5) ...

Dynamic section at offset 0x2dd8 contains 28 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libpython3.11.so.1.0]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x000000000000001d (RUNPATH)            Library runpath: [$ORIGIN/../lib]
 0x000000000000000c (INIT)               0x1000
 0x000000000000000d (FINI)               0x11b4
 0x0000000000000019 (INIT_ARRAY)         0x3dc8
 0x000000000000001b (INIT_ARRAYSZ)       8 (bytes)
 0x000000000000001a (FINI_ARRAY)         0x3dd0
 0x000000000000001c (FINI_ARRAYSZ)       8 (bytes)
 0x000000006ffffef5 (GNU_HASH)           0x308
 0x0000000000000005 (STRTAB)             0x4d8
 0x0000000000000006 (SYMTAB)             0x358
 0x000000000000000a (STRSZ)              258 (bytes)
 0x000000000000000b (SYMENT)             24 (bytes)
 0x0000000000000015 (DEBUG)              0x0
 0x0000000000000003 (PLTGOT)             0x4000
 0x0000000000000002 (PLTRELSZ)           24 (bytes)
 0x0000000000000014 (PLTREL)             RELA
 0x0000000000000017 (JMPREL)             0x6e0
 0x0000000000000007 (RELA)               0x620
 0x0000000000000008 (RELASZ)             192 (bytes)
 0x0000000000000009 (RELAENT)            24 (bytes)
 0x000000006ffffffb (FLAGS_1)            Flags: PIE
 0x000000006ffffffe (VERNEED)            0x600
 0x000000006fffffff (VERNEEDNUM)         1
 0x000000006ffffff0 (VERSYM)             0x5da
 0x000000006ffffff9 (RELACOUNT)          3
 0x0000000000000000 (NULL)               0x0

$ docker run --rm --pull=always python:alpine sh -c 'apk add --no-cache --quiet binutils && readelf --dynamic /usr/local/bin/python'
alpine: Pulling from library/python
Digest: sha256:625383c19a9a14824e6b89b5bbadc5138d5c2ad5adcc67d8ee4e3527cf35ffe0
Status: Image is up to date for python:alpine

Dynamic section at offset 0x2dd0 contains 26 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libpython3.11.so.1.0]
 0x0000000000000001 (NEEDED)             Shared library: [libc.musl-x86_64.so.1]
 0x000000000000000f (RPATH)              Library rpath: [$ORIGIN/../lib]
 0x000000000000000c (INIT)               0x1000
 0x000000000000000d (FINI)               0x11b5
 0x0000000000000019 (INIT_ARRAY)         0x3dc0
 0x000000000000001b (INIT_ARRAYSZ)       8 (bytes)
 0x000000000000001a (FINI_ARRAY)         0x3dc8
 0x000000000000001c (FINI_ARRAYSZ)       8 (bytes)
 0x000000006ffffef5 (GNU_HASH)           0x330
 0x0000000000000005 (STRTAB)             0x4e0
 0x0000000000000006 (SYMTAB)             0x378
 0x000000000000000a (STRSZ)              250 (bytes)
 0x000000000000000b (SYMENT)             24 (bytes)
 0x0000000000000015 (DEBUG)              0x0
 0x0000000000000003 (PLTGOT)             0x3fb0
 0x0000000000000002 (PLTRELSZ)           48 (bytes)
 0x0000000000000014 (PLTREL)             RELA
 0x0000000000000017 (JMPREL)             0x6a0
 0x0000000000000007 (RELA)               0x5e0
 0x0000000000000008 (RELASZ)             192 (bytes)
 0x0000000000000009 (RELAENT)            24 (bytes)
 0x0000000000000018 (BIND_NOW)           
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000006ffffff9 (RELACOUNT)          3
 0x0000000000000000 (NULL)               0x0

I also can't seem to reproduce:

$ docker run --rm --pull=always python sh -c 'apt-get update -qq && apt-get install -yqq patchelf && pip3 install staticx && staticx /usr/local/bin/python /usr/local/bin/python-static && python-static --version'
latest: Pulling from library/python
Digest: sha256:a3c0c6766535f85f18e7304d3a0111de5208d73935bcf1b024217005ad5ce195
Status: Image is up to date for python:latest
debconf: delaying package configuration, since apt-utils is not installed
Selecting previously unselected package patchelf.
(Reading database ... 23422 files and directories currently installed.)
Preparing to unpack .../patchelf_0.12-1_amd64.deb ...
Unpacking patchelf (0.12-1) ...
Setting up patchelf (0.12-1) ...
Collecting staticx
  Downloading staticx-0.13.8-py3-none-manylinux1_x86_64.whl (177 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 177.6/177.6 kB 7.7 MB/s eta 0:00:00
Collecting pyelftools
  Downloading pyelftools-0.29-py2.py3-none-any.whl (174 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 174.3/174.3 kB 35.1 MB/s eta 0:00:00
Installing collected packages: pyelftools, staticx
Successfully installed pyelftools-0.29 staticx-0.13.8
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv
Python 3.11.1

I wasn't able to reproduce the issue, but if it was still reproducible it's hopefully long-since fixed via #790 👍

Navigation Menu

Repository navigation

Latest path changes on 3.10-slim image leading to errors when building applications with staticx #786

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	# \$ because of the double quotes in the shell to prevent interpolation
	# $$ for make to not interpret the $O
	# " because it needs the ' around the path, and '"'"' instead is 🤢
	LDFLAGS="-Wl,-rpath='\$\$ORIGIN/../lib'" \
	; \

Latest path changes on 3.10-slim image leading to errors when building applications with staticx #786

Description

Activity

c-gabdalla commented on Jan 18, 2023

oktavlachs commented on Jan 18, 2023

tianon commented on Jan 18, 2023

tianon commented on Jan 18, 2023

tianon commented on Dec 19, 2023

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions