Building nginx with extra module breaks because of setfattr

[Monokai]

Following the instructions of building nginx with extra modules, I'm including the geoip2 module. I'm using the Alpine version.

This all works fine locally, but when building the same Dockerfile in a Gitlab CI setup, it breaks.

I've narrowed it down to this step:

>>> nginx-module-geoip2-dbg: Running split function dbg...
setfattr: ngx_http_geoip2_module-debug.so: Not supported
>>> ERROR: nginx-module-geoip2-dbg: dbg failed
>>> ERROR: nginx-module-geoip2: prepare_subpackages failed
>>> ERROR: nginx-module-geoip2: rootpkg failed

Seems abuild uses setfattr, which isn't supported on every environment by the looks of this error.

Any ideas on how to fix this?

[thresheek]

Hi @Monokai!

How do you run the Gitlab CI runner, is it under your control? If no, I dont think there is anything we can do except file a FR for abuild to skip the getfattr/setfattr calls if not supported. If you do have control, can you share the config.toml of a runner so I can try and reproduce?

Thanks!

[Monokai]

Thank for your quick reply.

I'm using a shared runner and the relevant part of gitlab-ci.yml is this:

stages:
  - build
  - deploy

.docker: &docker
  image: docker:latest
  services:
    - docker:dind
  variables:
    DOCKER_DRIVER: overlay2
  before_script:
    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY

.build-nginx:
  <<: [*docker]
  stage: build
  variables:
    IMAGE: "${CI_REGISTRY_IMAGE}:nginx-${CI_COMMIT_REF_SLUG}"
  script:
    - docker pull $IMAGE-latest || true

    - >
      docker build
      --build-arg ENABLED_MODULES=geoip2
      --cache-from $IMAGE-latest
      --tag $IMAGE
      --tag $IMAGE-latest
      --file ./components/nginx/build/Dockerfile .

    - docker push $IMAGE
    - docker push $IMAGE-latest

[thresheek]

In fact, I also see locally that setfattr fails on any file inside a container; however the error you're seeing suggests getfattr actually gets some extended file attributes from a file - I presume that something on a gitlab.com shared runner sets those attributes. This definitely doesnt happen for me when using docker-in-docker locally.

Anyway, I guess we can try not building a -dbg package, but the same issue is likely to hit us if there would be a binary that abuild needs to strip. Not sure what to do about it.

Just to test the theory, can you apply a following patch to disable debug packages to ./components/nginx/build/Dockerfile (which I assume is derived from /modules/Dockerfile.alpine in this repo):

diff --git a/modules/Dockerfile.alpine b/modules/Dockerfile.alpine
index ec64282..857f7fd 100644
--- a/modules/Dockerfile.alpine
+++ b/modules/Dockerfile.alpine
@@ -47,6 +47,7 @@ RUN set -ex \
         elif make -C /pkg-oss/alpine list | grep -E "^$module\s+\d+" > /dev/null; then \
             echo "Building $module from pkg-oss sources"; \
             cd /pkg-oss/alpine; \
+            sed -i 's,subpackages="$pkgname-dbg",,' APKBUILD-module.in; \
             make abuild-module-$module BASE_VERSION=$NGINX_VERSION NGINX_VERSION=$NGINX_VERSION; \
             apk add $(. ./abuild-module-$module/APKBUILD; echo $makedepends;); \
             make module-$module BASE_VERSION=$NGINX_VERSION NGINX_VERSION=$NGINX_VERSION; \

[Monokai]

Thanks. Still got a setfattr error, but another one it seems:

>>> nginx-module-geoip2: Running postcheck for nginx-module-geoip2
>>> nginx-module-geoip2: Preparing package nginx-module-geoip2...
>>> nginx-module-geoip2: Stripping binaries
setfattr: usr/lib/nginx/modules/ngx_http_geoip2_module-debug.so: Not supported
>>> ERROR: nginx-module-geoip2: prepare_package failed
>>> ERROR: nginx-module-geoip2: rootpkg failed

[thresheek]

Yeah, just as I thought. You can also try the following:

diff --git a/modules/Dockerfile.alpine b/modules/Dockerfile.alpine
index ec64282..3c4c309 100644
--- a/modules/Dockerfile.alpine
+++ b/modules/Dockerfile.alpine
@@ -47,6 +47,8 @@ RUN set -ex \
         elif make -C /pkg-oss/alpine list | grep -E "^$module\s+\d+" > /dev/null; then \
             echo "Building $module from pkg-oss sources"; \
             cd /pkg-oss/alpine; \
+            sed -i 's,subpackages="$pkgname-dbg",,' APKBUILD-module.in; \
+            sed -i 's,options="!check",options="!check !strip",' APKBUILD-module.in; \
             make abuild-module-$module BASE_VERSION=$NGINX_VERSION NGINX_VERSION=$NGINX_VERSION; \
             apk add $(. ./abuild-module-$module/APKBUILD; echo $makedepends;); \
             make module-$module BASE_VERSION=$NGINX_VERSION NGINX_VERSION=$NGINX_VERSION; \

While we can do something sane about disabling debug packages builds, not stripping the binaries means the resulting files will be much larger, and that definitely wouldnt go into pkg-oss or similar fixes.

For your usecase I guess it would be OK to utilize this patch for now, but I suggest filing a bug on abuild upstream to not fail doing the build process.

Or switch to Debian?

[Monokai]

Thank you, that works perfectly. I've filed an issue here as well: https://gitlab.alpinelinux.org/alpine/abuild/-/issues/10027

[thresheek]

I've just pushed a suggested fix to the repo. I hope this fixes the build issues for you.