Issue with shared libraries (libcrypto, libssl) causing symbolic link loop during Docker build using custom Kaniko image

[kraghupathi]

Issue with shared libraries (libcrypto, libssl) causing symbolic link loop during Docker build using custom Kaniko image

Description:
I'm encountering a problem while building a Docker image using a custom Kaniko image. When using the custom-built Kaniko image, the build process fails with the following errors related to shared libraries (libcrypto.so.3, libssl.so.3), indicating a symbolic link loop:

INFO[0008] Running: [/bin/sh -c apk update] Error loading shared library libcrypto.so.3: Symbolic link loop (needed by /usr/sbin/apk) Error loading shared library libssl.so.3: Symbolic link loop (needed by /lib/libapk.so.2.14.0) Error loading shared library libcrypto.so.3: Symbolic link loop (needed by /lib/libapk.so.2.14.0) Error relocating /lib/libapk.so.2.14.0: SSL_get1_peer_certificate: symbol not found Error relocating /lib/libapk.so.2.14.0: SSL_CTX_use_certificate_chain_file: symbol not found Error relocating /lib/libapk.so.2.14.0: OPENSSL_init_ssl: symbol not found Error relocating /lib/libapk.so.2.14.0: SSL_free: symbol not found Error relocating /lib/libapk.so.2.14.0: SSL_CTX_set_verify: symbol not found Error relocating /lib/libapk.so.2.14.0: EVP_get_digestbyname: symbol not found Error relocating /lib/libapk.so.2.14.0: SSL_shutdown: symbol not found

However, if I directly use the base gcr.io/kaniko-project/executor:debug image, everything works fine. I believe the problem might be due to how libraries are being copied or linked in the custom-built image (registry.gitlab.com/test:9.2 is a rhel ubi image).

1. below is my custom kaniko image dockerfile

`FROM gcr.io/kaniko-project/executor:debug as kaniko
COPY certs/ca.pem kaniko/ssl/certs/ca-certificates.crt

FROM registry.gitlab.com/test:9.2
RUN rm -rf /var/mail
COPY --from=kaniko /kaniko /kaniko
ENV DOCKER_CONFIG /kaniko/.docker/
ENV DOCKER_CREDENTIAL_GCR_CONFIG /kaniko/.config/gcloud/docker_credential_gcr_config.json
`
2. Create another Dockerfile using the custom-built Kaniko image (from Step 1):

FROM docker:26.1.2 RUN apk update CMD ["echo", "This is a 'Purpose-Built Container', It is not meant to be ran this way. Please review the documentation on usage."]

Can someone help me here? Is this the right way to build a custom Kaniko image? Do custom Kaniko image builds work in this manner, or are there any suggestions to resolve the issue?

[vladaurosh]

Did you check readme file?
kaniko is meant to be run as an image: gcr.io/kaniko-project/executor. We do not recommend running the kaniko executor binary in another image, as it might not work as you expect - see [Known Issues](https://github.com/GoogleContainerTools/kaniko#known-issues).