login_challenge decryption fails on Apple Silicon (M2 Max) + Docker Desktop + Apple Virtualization Framework

[jakubnoga]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

Problem

While following 5 minute quickstart on MacBook M2 Max with Docker Desktop using Apple Virtualization Framework and Rosetta I get:

hydra-1          | time=2025-12-19T11:05:58Z level=info msg=started handling request http_request=map[headers:map[accept:*/* accept-encoding:gzip, deflate accept-language:* connection:keep-alive sec-fetch-mode:cors user-agent:node] host:hydra:4445 method:GET path:/admin/oauth2/auth/requests/login query:Value is sensitive and has been redacted. To see the value set config key "log.leak_sensitive_values = true" or environment variable "LOG_LEAK_SENSITIVE_VALUES=true". remote:172.22.0.3:41476 scheme:http]
hydra-1          | time=2025-12-19T11:05:58Z level=info msg=An error occurred while handling a request audience=application error=map[debug: message:Not Found reason: status:Not Found status_code:404] http_request=map[headers:map[accept:*/* accept-encoding:gzip, deflate accept-language:* connection:keep-alive sec-fetch-mode:cors user-agent:node] host:hydra:4445 method:GET path:/admin/oauth2/auth/requests/login query:Value is sensitive and has been redacted. To see the value set config key "log.leak_sensitive_values = true" or environment variable "LOG_LEAK_SENSITIVE_VALUES=true". remote:172.22.0.3:41476 scheme:http] http_response=map[status_code:404] service_name=Ory Hydra service_version=master
hydra-1          | time=2025-12-19T11:05:58Z level=info msg=completed handling request http_request=map[headers:map[accept:*/* accept-encoding:gzip, deflate accept-language:* connection:keep-alive sec-fetch-mode:cors user-agent:node] host:hydra:4445 method:GET path:/admin/oauth2/auth/requests/login query:Value is sensitive and has been redacted. To see the value set config key "log.leak_sensitive_values = true" or environment variable "LOG_LEAK_SENSITIVE_VALUES=true". remote:172.22.0.3:41476 scheme:http] http_response=map[headers:map[cache-control:private, no-cache, no-store, must-revalidate content-type:application/json] size:84 status:404 text_status:Not Found took:2.505459ms]
consent-1        | ResponseError: Response returned an error code
consent-1        |     at OAuth2Api.<anonymous> (/usr/src/app/node_modules/@ory/hydra-client-fetch/dist/runtime.js:166:19)
consent-1        |     at Generator.next (<anonymous>)
consent-1        |     at fulfilled (/usr/src/app/node_modules/@ory/hydra-client-fetch/dist/runtime.js:18:58)
consent-1        |     at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
consent-1        | GET /login?login_challenge=sDsIoGsOD3YKFpD4Mmu-jng7ZZ0nFElWo_wKbJV_FwAy9rR0YOAs5KuhVnbXpetf_V8j5tDAW9tZODpx5MSHkdRCIbUDGTHI88OEZDMr15cWWnFYWXCI9GXEWkWHT2oLVZuU2CKeNACSNHOlvp_uuVz447qCwcwL3U5AEownamFGO320bTkbXOAYwa9Mp-Z0buKGv355LD4-se5721T72fk0E26baarjBoEgfG31taOt-H_r7hlSDUrSl5uBr3Rq0lc4wKaa_4x3DCT25x69MWuo9elr65pfV-cQEAg7JcOAbaM6objdQHrvs_YmJaTLDJAElh4neW6OUqPPudA_l7exEBGIGebv1aLkQuVBsKpBq96b0pivCwF8oiOLtmI3IqG_aBGDHrxQ4wg2kpvChcNMwr7Mq_eTC4_MAE6bD2auiZtEEyKU4umBRWSe8t6Uw4uc-COR7dJ4alVoM3RHKeSbNNbK9bjBcPk95B0w0ObSsgtrQC8ciKXsgfbDaWZHxtU-w_uzBspI0W_VulWcWkto1StetQMx6vR3zNH9Z0uqkBcHUUxJAvJOJpHO6AvmEKXlCxqhkP47gxzJU2_e-MasrLnIpEeG9qAuFhYD_i7KItcFrmamqo9Ds7GtUaFzyNcgLqIskDFqDMM6Mz33lymOIRcNRJwmmlrhVlJSiuDgRyMa2dsRUM8DSUkpBi6QaxHaUIwfLjVZj9xYLuA0ZAfutnXWtXvKlpuRYtRnEzBPa0HjR2G-QIO9B9RC3rpuQ2OmFa3XvO-swoxqohLq3HVAFEaLPePyI1euVDT-Bf6rm01a00c9BzHjdp370sfrQx3s3m2Yzq2DvDbWwtI46H3GtyInB39XUDy4LuW1TnIqSvDwUy47zK7fZgw8sFhTTN0jSbmhoGcyGd2mZwAKm_AqORFof6pKWq0vlCHXgOAu5uGsDKm3zjSI_0jg7_4R4U5pwFANiQUJzB-U_BYBSi46KRA9qzLbNHRBWFsGSM1HvXsRduMvCilN6j473_Ymlba0IvQk1YZuTjMID9Qtcu1vIeoHf8lQ86QImvIbuUnAU55vpLMhnqw6_hXJsavtxaKiRDpQ44sCQ0u6laBqoWNXwG4GRbwEQk49hrfk0703676SU8tWEwvQ8zsJg3k%3D 500 315.645 ms - 155

Summary

aead/xchacha20.go line 78 fails while decrypting login_challenge on said environment

Workaround

Switch off Rosetta or switch to Docker VMM.

Next steps

Please let me know if you want to fix it in Hydra or pass the bug down to dependency maintainers. I think I don't have enough expertise to debug further down the crypto lib and decide whether the bug's in the lib or VM. It affects Hydra so it's easiest for me to report it here.

Reproducing the bug

Follow 5 minut quickstart on Docker Desktop for Mac with following virtualization config:

Relevant log output

Relevant configuration

Version

25.4.0

On which operating system are you observing this issue?

macOS

In which environment are you deploying?

Docker Compose

Additional Context

I pinned bug to enrypt / decrypt with golang.org/x/crypto/chacha20poly1305. I created repo that shows really simple reproduction of this behaviour. You can check it out here:

https://github.com/jakubnoga/docker-desktop-apple-vz-crypto-bug

Important parts:

1. main.go - source code for bug reproduction, exceeding certain length of payload triggers the bug
2. dockerfile - static linking necessary to reproduce
3. environment - docker compose, apple silicon, apple virtualization framework, rosetta