Page MenuHomePhabricator

Airflow devenv BashOperator image is lacking libssl1.1
Closed, ResolvedPublic

Description

The symptom is that a BashOperator task fails to link against libcrypto.so.1.1 in an Airflow devenv. The same binary works fine in the SimpleSkeinOperator environment.

Steps to reproduce

  • Create an airflow-devenv
  • Add a BashOperator task which relies on openssl.

What happened

[2026-01-23, 11:02:59 UTC] {subprocess.py:106} INFO - ":load_failed, Failed to load NIF library /tmp/airflowtmp8d6i2bwv/rel/scrape_wiki_dump/lib/crypto-5.4/priv/lib/crypto: 'libcrypto.so.1.1: cannot open shared object file: No such file or directory'"

What should have happened instead

On stat1010, I can compare linkage of the same binaries which fail in the devenv, and they show libcrypto is present in its usual location:

# ldd scrape-wiki-html-dump/rel/scrape_wiki_dump/lib/crypto-5.4/priv/lib/crypto.so
        linux-vdso.so.1 (0x00007ffcc6dc7000)
        libcrypto.so.1.1 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007f6bb1608000)
        libc.so.6 => /usr/lib/x86_64-linux-gnu/libc.so.6 (0x00007f6bb1434000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f6bb1421000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f6bb13ff000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f6bb1925000)

On stat1010, the library comes from the libssl1.1 package:

# dpkg -S /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1
libssl1.1:amd64: /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1

Details

Related Changes in Gerrit:
Related Changes in GitLab:
TitleReferenceAuthorSource BranchDest Branch
feat(docker-images): add libssl1.1 to the prod docker imagerepos/data-engineering/airflow-dags!1966gehellibssl1.1main
Customize query in GitLab

Event Timeline

Gehel changed the task status from Open to In Progress.Jan 30 2026, 10:23 AM
Gehel claimed this task.
Gehel triaged this task as Medium priority.

Reusing the libssl compiled for haproxy and available in the thirdparty/bigtop15 APT component. See T402943#11229515 for more details.

Change #1235757 had a related patch set uploaded (by Gehel; author: Gehel):

[operations/deployment-charts@master] feat(airflow): add libssl1.1 to the airflow docker image

https://gerrit.wikimedia.org/r/1235757

Change #1235757 merged by Gehel:

[operations/deployment-charts@master] feat(airflow): add libssl1.1 to the airflow docker image

https://gerrit.wikimedia.org/r/1235757

@awight : I've pushed a new image with libssl1.1. Can you recreate your dev-env and check that this works as expected?