ref(build): Use DHI static base image and statically link libstdc++#6131
Draft
oioki wants to merge 2 commits into
Draft
ref(build): Use DHI static base image and statically link libstdc++#6131oioki wants to merge 2 commits into
oioki wants to merge 2 commits into
Conversation
Switch the release container from gcr.io/distroless/cc-debian13 to the mirrored Docker Hardened Image us-docker.pkg.dev/sentryio/dhi-mirror/static. The static image has no shell, so the volume dirs are seeded from its own pre-existing nonroot-owned /home/nonroot instead of a busybox mkdir stage. Unlike the distroless "cc" image, the static image does not ship libstdc++.so.6, which relay-crash depends on (sentry-native/breakpad is C++). Link the C++ standard library statically on Linux so the binary runs on the minimal image. This must come after the breakpad/sentry static libs (static archive linking is order-sensitive), and needs libstdc++.a's gcc-internal directory on the link search path, queried via `cc -print-file-name`. Add g++ to the release build container so that archive is present. Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switch the release container base image from
gcr.io/distroless/cc-debian13to the mirrored Docker Hardened Imageus-docker.pkg.dev/sentryio/dhi-mirror/static:20250419-glibc-debian13.What
Dockerfile.release: new base image, and the builder stage is dropped entirely. The static image has no shell (nobusybox), so the/workand/etc/relayvolume directories are seeded from the image's own pre-existing, empty, nonroot-owned (uid/gid 65532)/home/nonrootdirectory viaCOPY --from. No external builder image is needed.relay-crash/build.rs: linklibstdc++statically on Linux (static=stdc++).build_binary.yml: addg++to the release build container solibstdc++.ais present.Why
Unlike the distroless
ccimage, thestaticimage does not shiplibstdc++.so.6.relay-crashdepends on it becausesentry-native/breakpad is C++ (cargo:rustc-link-lib=dylib=stdc++), so the dynamically-linked binary fails to start on the static image with:Linking the C++ runtime statically keeps the minimal
staticbase usable. relay is a leaf binary andsentry-nativeis already fully static, so the usual multi-runtime hazard of staticlibstdc++does not apply here.Two non-obvious details worth a careful look:
static=stdc++directive must be emitted after thebreakpad_client/sentrystatic libs — static archive linking is order-sensitive (the olddylibposition only worked because dynamic linking ignores order).static=stdc++makes rustc resolvelibstdc++.aitself, but it lives in a gcc-internal, arch/version-specific directory not on rustc's default search path. The build script queriescc -print-file-name=libstdc++.ato add it.Verification
Built
relaywith--features crash-handlerin anubuntu:20.04container (matching the release toolchain).readelf -don the result shows nolibstdc++.so.6inNEEDED(onlylibc,libm,libgcc_s,libpthread,libdl,ld-linux), all of which are present in the static image, and ~85 C++ symbols are statically baked in. Verified on arm64 locally; CI covers x86_64 via the same code path.Supersedes #6117.