fix(docker): switch runtime base to ubuntu:22.04 (glibc 2.35)
CI / Build Native (push) Has been cancelled

The native binary is built against glibc 2.35 (Ubuntu jammy in CI) but
quarkus-micro-image:2.0 ships glibc 2.34 (UBI 9), hence the
'GLIBC_2.35 not found' at runtime. Switching to ubuntu:22.04 as the
runtime base matches glibc exactly and lets us stop fighting with
musl / static binaries.

Dockerfile:
- FROM ubuntu:22.04 (was quarkus-micro-image:2.0)
- install curl + ca-certificates via apt (apt + bash are present, so
  chmod/echo securerandom run in-line again)
- single-stage: no more curl-builder multi-stage
- useradd UID 1001 (matches the in-container USER)

CI:
- drop binary-type=STATIC and --libc=musl (binary is dynamic again)
- drop the rm -f target/*-runner (cache invalidate)
- 'Stage binary for Docker' is now just 'cp'
- verify step is informational only

Image is ~5 MB larger than quarkus-micro-image but the runtime now
matches the build glibc, so the container starts cleanly.
This commit is contained in:
2026-08-14 15:45:05 -04:00
parent 6e3db41ba4
commit 2833e76914
2 changed files with 13 additions and 33 deletions
+9 -13
View File
@@ -1,18 +1,14 @@
FROM registry.access.redhat.com/ubi9/ubi-minimal AS curl-builder
RUN microdnf install -y curl-minimal && microdnf clean all \
&& mkdir -p /out/etc/pki /out/etc \
&& install -D -m 0755 /usr/bin/curl /out/usr/bin/curl \
&& for lib in $(ldd /usr/bin/curl | awk '/=>/ {print $3}' | sort -u); do \
dest="/out$(echo "$lib" | sed 's|^/lib64|/usr/lib64|; s|^/lib|/usr/lib|')"; \
install -D -m 0755 "$lib" "$dest"; \
done \
&& cp -rP /etc/pki/ca-trust /out/etc/pki/ \
&& cp -rP /etc/ssl /out/etc/
FROM quay.io/quarkus/quarkus-micro-image:2.0
FROM ubuntu:22.04
RUN apt-get update \
&& apt-get install -y --no-install-recommends curl ca-certificates \
&& rm -rf /var/lib/apt/lists/* \
&& useradd -u 1001 -U -M -s /usr/sbin/nologin app \
&& mkdir -p /work \
&& chown 1001:1001 /work
WORKDIR /work/
COPY --chown=1001:1001 build-output/*-runner /work/application
COPY --from=curl-builder /out/ /
RUN chmod 775 /work /work/application \
&& echo "securerandom.source=file:/dev/urandom" >> /work/application
EXPOSE 8080
USER 1001