opa: linux binary (0.29.0+) depends on glibc, won't run on alpine as-is

Let me know if you reach Oslo and I’ll offer you a cold one (🍺).

Considering the price of a beer in Oslo, that’s an extremely generous offer @johanneslarsson 😆

@srenatus I see that I forgot to answer the image question, without going into details, let’s say that it would be more work than replacing the FROM in the Dockerfile.

So, I think the only sweet spot is building the OPA binary with musl linked in. It’ll run on any linux system (🤞), and we can still keep wasm enabled. A prerequisite is musl support in wasmtime and wasmtime-go. I’m looking into that… 🔍

👉 bytecodealliance/wasmtime-go#21

So, here’s a cross road:

North: Wait for wasmtime to build a musl version, and use that for extra musl binaries (stretch: do the same thing ourselves) East: Disable wasm for the linux binaries West: Publish extra linux binaries without wasm

@johanneslarsson this is probably a problem for a few folks, but since you’ve come across it first: How strongly are you attached to using the alpine image? The one we’re using to build the docker container is pretty slim, too: gcr.io/distroless/cc.

There seems to be an alpine-glibc image, too, as another workaround:

$ docker run -it -v $(pwd):/src frolvlad/alpine-glibc
Unable to find image 'frolvlad/alpine-glibc:latest' locally
latest: Pulling from frolvlad/alpine-glibc
540db60ca938: Already exists
d777323df2e1: Pull complete
Digest: sha256:2435a13068b6e9331b91c200dcba33e0f0c06cdbbc689fa856a753e3f093246a
Status: Downloaded newer image for frolvlad/alpine-glibc:latest
/ # /src/_release/0.30.0-dev/opa_linux_amd64
An open source project to policy-enable your service.

Usage:
  opa_linux_amd64 [command]

Available Commands:
  bench       Benchmark a Rego query
  build       Build an OPA bundle
  check       Check Rego source files
  deps        Analyze Rego query dependencies
  eval        Evaluate a Rego query
  fmt         Format Rego source files
  help        Help about any command
  parse       Parse Rego source file
  run         Start OPA in interactive or server mode
  sign        Generate an OPA bundle signature
  test        Execute Rego test cases
  version     Print the version of OPA

Flags:
  -h, --help   help for opa_linux_amd64

Use "opa_linux_amd64 [command] --help" for more information about a command.
/ #

Since I haven’t got the sales pitch for WASM, (yet). I would just say: https://www.youtube.com/watch?v=LNBjMRvOB5M&ab_channel=PetShopBoysParlophone

👉 https://github.com/bytecodealliance/wasmtime-go/issues/21

So, here’s a cross road:

North: Wait for wasmtime to build a musl version, and use that for extra musl binaries (stretch: do the same thing ourselves) East: Disable wasm for the linux binaries West: Publish extra linux binaries without wasm

@johanneslarsson this is probably a problem for a few folks, but since you’ve come across it first: How strongly are you attached to using the alpine image? The one we’re using to build the docker container is pretty slim, too: gcr.io/distroless/cc.

There seems to be an alpine-glibc image, too, as another workaround:

$ docker run -it -v $(pwd):/src frolvlad/alpine-glibc
Unable to find image 'frolvlad/alpine-glibc:latest' locally
latest: Pulling from frolvlad/alpine-glibc
540db60ca938: Already exists
d777323df2e1: Pull complete
Digest: sha256:2435a13068b6e9331b91c200dcba33e0f0c06cdbbc689fa856a753e3f093246a
Status: Downloaded newer image for frolvlad/alpine-glibc:latest
/ # /src/_release/0.30.0-dev/opa_linux_amd64
An open source project to policy-enable your service.

Usage:
  opa_linux_amd64 [command]

Available Commands:
  bench       Benchmark a Rego query
  build       Build an OPA bundle
  check       Check Rego source files
  deps        Analyze Rego query dependencies
  eval        Evaluate a Rego query
  fmt         Format Rego source files
  help        Help about any command
  parse       Parse Rego source file
  run         Start OPA in interactive or server mode
  sign        Generate an OPA bundle signature
  test        Execute Rego test cases
  version     Print the version of OPA

Flags:
  -h, --help   help for opa_linux_amd64

Use "opa_linux_amd64 [command] --help" for more information about a command.
/ #