Alpine 2.6.8 Docker image ships glibc libraries that break apk

[ljagiello]

Summary

The denoland/deno:alpine-2.6.8 Docker image ships glibc-compiled libraries in /usr/local/lib/ that conflict with Alpine's musl-based system tools. This breaks common operations like apk add.

Quick Reproduction (no build required)

# 2.6.7 works:
docker run --rm denoland/deno:alpine-2.6.7 apk add --no-cache curl
# SUCCESS

# 2.6.8 fails:
docker run --rm denoland/deno:alpine-2.6.8 apk add --no-cache curl
# Error relocating /usr/local/lib/libz.so.1: __snprintf_chk: symbol not found
# Error relocating /usr/local/lib/libssl.so.3: __memcpy_chk: symbol not found
# ... etc

Root Cause

The 2.6.8 Alpine image added ~270 new files to /usr/local/lib/, including glibc-compiled versions of common libraries:

# 2.6.7: 20 files in /usr/local/lib/
docker run --rm denoland/deno:alpine-2.6.7 sh -c "ls /usr/local/lib/ | wc -l"
# 20

# 2.6.8: 289 files in /usr/local/lib/
docker run --rm denoland/deno:alpine-2.6.8 sh -c "ls /usr/local/lib/ | wc -l"
# 289

The problematic libraries added in 2.6.8:

• libcrypto.so.3
• libssl.so.3
• libz.so.1
• libzstd.so.1

These are glibc builds that expect symbols like __snprintf_chk, __memcpy_chk, makecontext, etc. which don't exist in Alpine's musl libc.

Impact

Any Dockerfile that:

1. Uses FROM denoland/deno:alpine-2.6.8
2. Runs apk add to install additional packages

...will fail with library relocation errors.

Workaround

Remove the conflicting libraries before running apk:

FROM denoland/deno:alpine-2.6.8

RUN rm -rf /usr/local/lib/*.so* && \
    apk add --no-cache curl

Or revert to 2.6.7:

FROM denoland/deno:alpine-2.6.7

Environment

• Docker: any recent version
• Host: tested on macOS arm64 and Linux amd64
• Affected image: denoland/deno:alpine-2.6.8
• Working image: denoland/deno:alpine-2.6.7

Minimal Dockerfile PoC

# Minimal reproduction: glibc/musl conflict in denoland/deno:alpine-2.6.8
#
# Quick test (no build needed):
#   docker run --rm denoland/deno:alpine-2.6.8 apk add --no-cache curl
#
# Or build this file:
#   docker build -t deno-alpine-bug .

# Works: FROM denoland/deno:alpine-2.6.7
# Fails: FROM denoland/deno:alpine-2.6.8
FROM denoland/deno:alpine-2.6.8

# This fails - apk tries to load glibc libs from /usr/local/lib/
RUN apk add --no-cache curl

[arthur-ver]

can confirm

[mpcref]

rm -rf /usr/local/lib/*.so* will also remove libraries that deno depends on. For example deno cache will break. Better to only remove those library files that are causing problems. E.g.:

RUN cd /usr/local/lib && rm -rf libcrypto.* libssl.* libz.*

(alpine so no brace expansion)

[bartlomieju]

Done in denoland/deno_docker#511, this will be fixed by 2.6.9 release next week.