Queryable Encryption with Docker

Donovan_Cotter · 2024-07-31T03:29:58.606Z

I’m implementing Automatic Queryable Encryption and have it working locally on my Macbook with the MacOS version

I’m trying to deploy it in a Docker container and currently using “mongo_crypt_shared_v1-linux-x86_64-enterprise-ubuntu2204-7.0.12”

It keeps failing when trying to access the mongo_crypt_v1.so file and saying “GLIBC_2.32”.

“TypeError: A crypt_shared override path was specified [/app/lib/mongo_crypt_shared_v1-linux-x86_64-enterprise-ubuntu2204-7.0.12/lib/mongo_crypt_v1.so], but we failed to open a dynamic library at that location. Load error: [Error while opening candidate for CSFLE dynamic library [/app/lib/mongo_crypt_shared_v1-linux-x86_64-enterprise-ubuntu2204-7.0.12/lib/mongo_crypt_v1.so]: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.32’ not found (required by /app/lib/mongo_crypt_shared_v1-linux-x86_64-enterprise-ubuntu2204-7.0.12/lib/mongo_crypt_v1.so”

I’m currently using ubuntu:22.04 in my Dockerfile and then installing node manually. I’ve tried different variations of this and different versions of ubuntu with no luck

FROM ubuntu:22.04

RUN apt-get update && apt-get install -y curl gnupg

RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash -

RUN apt-get install -y nodejs

What do I need in my Dockerfile to get this to match up with the correct version of the Automatic Queryable Encryption Shared Library? so that it can open the file?

Anna_Henningsen · 2024-08-01T13:12:48.162Z

@Donovan_Cotter Hi, thanks for reaching out!

This is indeed unexpected. I used the Dockerfile excerpt you provided here and did not run into any issues loading the crypt_shared library. Also, Ubuntu 22.04 uses glibc 2.35, which should be just fine for this use case.

Chances are that something else is happening here as part of your docker container setup that’s not part of the Dockerfile that you shared here, and that, whatever it is, it is overwriting your glibc with an older version for some reason. (You can verify this by manually invoking /lib/x86_64-linux-gnu/libc.so.6 as a shell command.)

You should probably try to identify what that is, since it may not just affect the crypt_shared library, but also other parts of your container.

All that being said, if you’re really just looking for a quick and dirty solution, you may be able to just use the crypt_shared library for another Linux distribution with a low glibc requirement (e.g. RHEL7). While we don’t generally recommend using components that were built for other distributions than the one that is actually in use, there’s nothing that should keep it from working if you need it to.

Donovan_Cotter · 2024-08-05T15:26:36.787Z

Thanks for the quick reply! You’re right and it was my Docker container setup. I wasn’t using the correct base image and also wasn’t specifying LD_LIBRARY_PATH to tell it where libraries can be found

Ruben_Martin · 2024-11-19T19:59:45.594Z

Hi, I’m getting the same error but locally in my Mac. I tried different locations for the library but nothing seems to work. Where did you put the library in your local environment?

Joel_Odom · 2024-11-20T13:35:48.550Z

It really doesn’t matter where you put the library, as long as it’s accessible. Here’s what I have on my local Mac environment:

CRYPT_SHARED_LIB = “/Users/joel.odom/lib/mongo_crypt_v1.dylib”

The f irst time you try to run it on a local Mac environment it may be blocked by your security settings, in which case you have to go into System Settings and allow the library.