Apline binary for AWS CloudHSM

Question

Hi,

We are going to use AWS CloudHSM in a Java application. For this we are using the [JCE provider](https://docs.aws.amazon.com/cloudhsm/latest/userguide/java-library.html).

Everything is going fine in our dev environment as our laptop are under Ubuntu.
However, when we deploy the application on kubernetes we have missing symbole error as our Docker images are based on Alpine.

```
Caused by: java.lang.UnsatisfiedLinkError: /tmp/CloudHsmNativeLibraryTemporaryDir4971426869798385317/libcloudhsm_jce.so: Error relocating /tmp/CloudHsmNativeLibraryTemporaryDir4971426869798385317/libcloudhsm_jce.so: __fgets_chk: symbol not found
```

By doing a LDD on the `libcloudhsm_jce.so` file, we have this output:

```
	/lib/ld-musl-x86_64.so.1 (0x7f82ea5a3000)
	libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x7f82e8d31000)
	libpthread.so.0 => /lib/ld-musl-x86_64.so.1 (0x7f82ea5a3000)
	libm.so.6 => /lib/ld-musl-x86_64.so.1 (0x7f82ea5a3000)
	libdl.so.2 => /lib/ld-musl-x86_64.so.1 (0x7f82ea5a3000)
	libc.so.6 => /lib/ld-musl-x86_64.so.1 (0x7f82ea5a3000)
	ld-linux-x86-64.so.2 => /lib/ld-linux-x86-64.so.2 (0x7f82e8d2a000)
Error relocating libcloudhsm_jce.so: __fprintf_chk: symbol not found
Error relocating libcloudhsm_jce.so: swapcontext: symbol not found
Error relocating libcloudhsm_jce.so: __fdelt_chk: symbol not found
Error relocating libcloudhsm_jce.so: __memcpy_chk: symbol not found
Error relocating libcloudhsm_jce.so: __register_atfork: symbol not found
Error relocating libcloudhsm_jce.so: __strcpy_chk: symbol not found
Error relocating libcloudhsm_jce.so: __vfprintf_chk: symbol not found
Error relocating libcloudhsm_jce.so: __memset_chk: symbol not found
Error relocating libcloudhsm_jce.so: makecontext: symbol not found
Error relocating libcloudhsm_jce.so: __sprintf_chk: symbol not found
Error relocating libcloudhsm_jce.so: __snprintf_chk: symbol not found
Error relocating libcloudhsm_jce.so: getcontext: symbol not found
Error relocating libcloudhsm_jce.so: gnu_get_libc_version: symbol not found
Error relocating libcloudhsm_jce.so: __res_init: symbol not found
```

We tried to install `[gcompat](https://pkgs.alpinelinux.org/packages?name=gcompat)` and/or `[libc6-compat](https://pkgs.alpinelinux.org/package/v3.15/main/x86_64/libc6-compat)` in our image withtout success.

Do you know how to make this lib working under Alpine ?
If this is not possible, is there any plan to make it compatible with Alpine in a near future ?

As additional information, our docker image needs to support 2 architecture (x86_64 and ARM).

Thanks you for your feedback

re:Post Agent · Answer

I apologize, but based on the information available, there is currently no direct support for running the AWS CloudHSM JCE provider on Alpine Linux. The AWS CloudHSM JCE provider is primarily designed for use with specific Linux distributions, and Alpine Linux is not among the officially supported platforms.

The error messages you're encountering are related to missing symbols that are typically provided by glibc, which is not present in Alpine Linux as it uses musl libc instead. While you've attempted to use gcompat and libc6-compat, these solutions don't appear to be sufficient for the AWS CloudHSM JCE provider.

Given your requirements, you have a few potential options to consider:

1. Use a different base image: Instead of Alpine, consider using a supported Linux distribution as your base image, such as Amazon Linux, Ubuntu, or CentOS. This would ensure compatibility with the AWS CloudHSM JCE provider.

2. Multi-stage build: You could use a multi-stage Docker build where you use a supported distribution to install and set up the AWS CloudHSM JCE provider, and then copy the necessary files to your Alpine-based final image. However, this approach may still face compatibility issues due to the different libc implementations.

3. Contact AWS Support: If using Alpine Linux is a strict requirement for your project, you may want to reach out to AWS Support to inquire about potential future support for Alpine or alternative solutions.

4. Alternative implementation: Consider if it's possible to implement the required functionality using a different AWS service or approach that doesn't rely on the CloudHSM JCE provider.

Regarding support for both x86_64 and ARM architectures, the AWS CloudHSM JCE provider does offer support for both. However, the compatibility issue with Alpine Linux would need to be resolved first before addressing multi-architecture support.

It's important to note that there is no publicly available information about plans to make the AWS CloudHSM JCE provider compatible with Alpine Linux in the near future. For the most up-to-date and accurate information, it would be best to consult with AWS Support or check the official AWS CloudHSM documentation for any updates.  
**Sources**  
[JCE provider for AWS CloudHSM Client SDK 5 - AWS CloudHSM](https://docs.aws.amazon.com/cloudhsm/latest/userguide/java-library.html)  
[Install the JCE provider for AWS CloudHSM Client SDK 5 - AWS CloudHSM](https://docs.aws.amazon.com/cloudhsm/latest/userguide/java-library-install_5.html)  
[Compare AWS CloudHSM Client SDK component support - AWS CloudHSM](https://docs.aws.amazon.com/cloudhsm/latest/userguide/sdk3-compare.html)  
[Features | AWS CloudHSM | Amazon Web Services (AWS)](https://aws.amazon.com/cloudhsm/features/)

Didier Durand · Answer

Hi,

Alpine is known to be extremely optimized in terms of weight: https://mohibulalam75.medium.com/exploring-lightweight-docker-base-images-alpine-slim-and-debian-releases-bookworm-bullseye-688f88067f4b

Its authors try to remove all what they can to make it slimmer.  It is known to require lots of low-level customization (add packages, etc.) when you've an advanced use case, which is your situation with HSM. It seems that you are missing some libraries or at least personally part of them with the missing symbol(s)

So, I would personally start with a thicker / richer base image like Ubuntu or AmazonLinux 2023 to see if I can deliver my use case on those. And then, move back to Alpine to guide its customization (via additions to the Dockerfile for the rich Linux)  based on experience with thicker one.

Best,

Didier

Apline binary for AWS CloudHSM

Add your answer

Relevant content