From ca21416efca302e99de0f1cd71f339a4d586e4f5 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Sun, 15 Feb 2026 16:02:23 -0600 Subject: [PATCH] fix: switch Docker images from Alpine to Debian slim for native addon compatibility Alpine (musl libc) is incompatible with matrix-sdk-crypto-nodejs native binary which requires glibc's ld-linux-x86-64.so.2. Switched all Node.js Dockerfiles to node:24-slim (Debian/glibc). Also fixed docker-compose.matrix.yml network naming from undefined mosaic-network to mosaic-internal. Co-Authored-By: Claude Opus 4.6 --- apps/api/Dockerfile | 11 +++++++---- apps/orchestrator/Dockerfile | 10 ++++++---- apps/web/Dockerfile | 11 +++++++---- docker/docker-compose.matrix.yml | 20 +++++++------------- 4 files changed, 27 insertions(+), 25 deletions(-) diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile index b97b06e..b4ae23d 100644 --- a/apps/api/Dockerfile +++ b/apps/api/Dockerfile @@ -2,7 +2,9 @@ # Enable BuildKit features for cache mounts # Base image for all stages -FROM node:24-alpine AS base +# Uses Debian slim (glibc) instead of Alpine (musl) because native Node.js addons +# (matrix-sdk-crypto-nodejs, Prisma engines) require glibc-compatible binaries. +FROM node:24-slim AS base # Install pnpm globally RUN corepack enable && corepack prepare pnpm@10.27.0 --activate @@ -53,16 +55,17 @@ RUN pnpm turbo build --filter=@mosaic/api --force # ====================== # Production stage # ====================== -FROM node:24-alpine AS production +FROM node:24-slim AS production # Remove npm (unused in production — we use pnpm) to reduce attack surface RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx # Install dumb-init for proper signal handling -RUN apk add --no-cache dumb-init +RUN apt-get update && apt-get install -y --no-install-recommends dumb-init \ + && rm -rf /var/lib/apt/lists/* # Create non-root user -RUN addgroup -g 1001 -S nodejs && adduser -S nestjs -u 1001 +RUN groupadd -g 1001 nodejs && useradd -m -u 1001 -g nodejs nestjs WORKDIR /app diff --git a/apps/orchestrator/Dockerfile b/apps/orchestrator/Dockerfile index 4909902..1ec9d4e 100644 --- a/apps/orchestrator/Dockerfile +++ b/apps/orchestrator/Dockerfile @@ -2,7 +2,8 @@ # Enable BuildKit features for cache mounts # Base image for all stages -FROM node:24-alpine AS base +# Uses Debian slim (glibc) instead of Alpine (musl) for native addon compatibility. +FROM node:24-slim AS base # Install pnpm globally RUN corepack enable && corepack prepare pnpm@10.27.0 --activate @@ -57,7 +58,7 @@ RUN find ./apps/orchestrator/dist \( -name '*.spec.js' -o -name '*.spec.js.map' # ====================== # Production stage # ====================== -FROM node:24-alpine AS production +FROM node:24-slim AS production # Add metadata labels LABEL maintainer="mosaic-team@mosaicstack.dev" @@ -72,10 +73,11 @@ LABEL org.opencontainers.image.description="Agent orchestration service for Mosa RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx # Install wget and dumb-init -RUN apk add --no-cache wget dumb-init +RUN apt-get update && apt-get install -y --no-install-recommends wget dumb-init \ + && rm -rf /var/lib/apt/lists/* # Create non-root user -RUN addgroup -g 1001 -S nodejs && adduser -S nestjs -u 1001 +RUN groupadd -g 1001 nodejs && useradd -m -u 1001 -g nodejs nestjs WORKDIR /app diff --git a/apps/web/Dockerfile b/apps/web/Dockerfile index 84a66e5..7caec12 100644 --- a/apps/web/Dockerfile +++ b/apps/web/Dockerfile @@ -2,7 +2,9 @@ # Enable BuildKit features for cache mounts # Base image for all stages -FROM node:24-alpine AS base +# Uses Debian slim (glibc) for consistency with API/orchestrator and to prevent +# future native addon compatibility issues with Alpine's musl libc. +FROM node:24-slim AS base # Install pnpm globally RUN corepack enable && corepack prepare pnpm@10.27.0 --activate @@ -75,7 +77,7 @@ RUN mkdir -p ./apps/web/public # ====================== # Production stage # ====================== -FROM node:24-alpine AS production +FROM node:24-slim AS production # Remove npm (unused in production — we use pnpm) to reduce attack surface RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx @@ -84,10 +86,11 @@ RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx RUN corepack enable && corepack prepare pnpm@10.27.0 --activate # Install dumb-init for proper signal handling -RUN apk add --no-cache dumb-init +RUN apt-get update && apt-get install -y --no-install-recommends dumb-init \ + && rm -rf /var/lib/apt/lists/* # Create non-root user -RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001 +RUN groupadd -g 1001 nodejs && useradd -m -u 1001 -g nodejs nextjs WORKDIR /app diff --git a/docker/docker-compose.matrix.yml b/docker/docker-compose.matrix.yml index b850458..1062111 100644 --- a/docker/docker-compose.matrix.yml +++ b/docker/docker-compose.matrix.yml @@ -60,7 +60,7 @@ services: postgres: condition: service_healthy networks: - - mosaic-network + - mosaic-internal # ====================== # Synapse (Matrix Homeserver) @@ -76,9 +76,9 @@ services: - "${SYNAPSE_CLIENT_PORT:-8008}:8008" - "${SYNAPSE_FEDERATION_PORT:-8448}:8448" volumes: - - ./matrix/synapse/homeserver.yaml:/data/homeserver.yaml:ro - - synapse_data:/data/media_store - - synapse_signing_key:/data/keys + - /opt/mosaic/synapse/homeserver.yaml:/data/homeserver.yaml:ro + - /opt/mosaic/synapse/media_store:/data/media_store + - /opt/mosaic/synapse/keys:/data/keys depends_on: postgres: condition: service_healthy @@ -91,7 +91,7 @@ services: retries: 5 start_period: 30s networks: - - mosaic-network + - mosaic-internal labels: com.mosaic.service: "matrix-synapse" com.mosaic.description: "Matrix homeserver (dev)" @@ -106,7 +106,7 @@ services: ports: - "${ELEMENT_PORT:-8501}:80" volumes: - - ./matrix/element/config.json:/app/config.json:ro + - /opt/mosaic/synapse/element-config.json:/app/config.json:ro depends_on: synapse: condition: service_healthy @@ -117,13 +117,7 @@ services: retries: 3 start_period: 10s networks: - - mosaic-network + - mosaic-internal labels: com.mosaic.service: "matrix-element" com.mosaic.description: "Element Web client (dev)" - -volumes: - synapse_data: - name: mosaic-synapse-data - synapse_signing_key: - name: mosaic-synapse-signing-key