Skip to content

fix: restore deno compile output support in alpine image#546

Merged
bartlomieju merged 1 commit into
mainfrom
fix/alpine-compile-libdl
Jul 1, 2026
Merged

fix: restore deno compile output support in alpine image#546
bartlomieju merged 1 commit into
mainfrom
fix/alpine-compile-libdl

Conversation

@bartlomieju

Copy link
Copy Markdown
Member

Problem

Running the output of deno compile inside the Alpine image fails since the 2.7.8 image:

error while loading shared libraries: libdl.so.2: cannot open shared object file: No such file or directory

Fixes denoland/deno#35683.

Root cause

This is an image regression, not a deno binary bug. I confirmed the compiled binaries are identical in their ELF dependencies across versions (both need libdl.so.2, no rpath) — the difference is purely the image:

  • A binary compiled by 2.7.8 runs fine on the 2.7.7 image.
  • A binary compiled by 2.7.7 fails on the 2.7.8 image.

Commit 01a6547 (#523, first shipped in the 2.7.8 image) isolated glibc libs into /usr/local/lib/glibc/, dropped ENV LD_LIBRARY_PATH, and rpath-patched only /deno and /tini. A deno compile output binary gets neither the rpath nor LD_LIBRARY_PATH, so its glibc loader can't find libdl.so.2 in the isolated (non-searched) directory.

Re-adding LD_LIBRARY_PATH would reintroduce the exact musl-package conflict #523 fixed, because musl's loader also honors LD_LIBRARY_PATH and would then load the incompatible glibc libgcc_s.so.1.

Fix

Generate a glibc /etc/ld.so.cache pointing at /usr/local/lib/glibc. The glibc loader consults it, so rpath-less compiled binaries resolve their libs — while musl's loader ignores /etc/ld.so.cache entirely, so the isolation from #523 is fully preserved and no conflict returns. The cache is built with the ldconfig already present in the existing tini build stage (no new base image).

Verification (full image build, DENO_VERSION=2.9.0)

  • deno runs
  • deno compile output runs (the reported failure)
  • apk add nodejs + node still runs — no glibc/musl conflict reintroduced

The alpine image isolates glibc libs in /usr/local/lib/glibc and relies on
patchelf rpaths on /deno and /tini to find them. Binaries produced by
`deno compile` are not rpath-patched, so their glibc loader cannot find
libdl.so.2 (and the other isolated libs), failing with:

    error while loading shared libraries: libdl.so.2: cannot open shared
    object file: No such file or directory

This is a regression since the 2.7.8 image (#523), which moved the libs
into the isolated directory and dropped `ENV LD_LIBRARY_PATH`.

Re-adding LD_LIBRARY_PATH would reintroduce the musl-package conflict #523
fixed, since musl's loader also honors it. Instead, generate a glibc
ld.so.cache pointing at /usr/local/lib/glibc: the glibc loader consults it
(so rpath-less compiled binaries resolve their libs), while musl's loader
ignores /etc/ld.so.cache entirely, keeping the isolation intact.

Fixes denoland/deno#35683
@bartlomieju bartlomieju merged commit 0a65c0c into main Jul 1, 2026
6 checks passed
@bartlomieju bartlomieju deleted the fix/alpine-compile-libdl branch July 1, 2026 16:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Deno Version >2.7.7 container image broken with deno compile

1 participant