6

I need a 'for dummies' answer to this question that I know has been asked before.

We're using the Serverless framework for an AWS-hosted application. Runtime=python3.8 Got a nice big yml file that includes 16 functions, 2 of which include layers for Cryptography and for PyNaCl, which we bring in from here - https://github.com/keithrozario/Klayers and have used successfully for quite a while.

Last week, I needed to update a different function, which meant re-testing, which meant finding there's a newer version of the cryptography layer, so I updated it to have Cyptography v.39. Now I have a function that fails with the error, /lib64/libc.so.6: version `GLIBC_2.28' not found (required by /var/task/cryptography/hazmat/bindings/_rust.abi3.so) This function hasn't been used since 07/2022, at which time it was just fine. Apparently it's also been that long since we redeployed from Serverless.

Attempts to fix:

This question Lambda function failing with /lib64/libc.so.6: version `GLIBC_2.18' not found includes the advice to move from Cryptography v.39 all the way back to v.3.4.7 (from 03/2021), which seems like bad advice. Surely the 14 updates between those 2 versions include some important changes.

I'm at a loss. I feel like I'm just running in circles, and meanwhile can't make progress on the actual function I'm trying to update because this is such a block.

Charles Duffy
  • 280,126
  • 43
  • 390
  • 441
A_Wunder
  • 96
  • 1
  • 7
  • Short form: Compile the software you're using for the platform you're using. This comes from using a package built for an older distro on a newer one. – Charles Duffy Feb 08 '23 at 17:42
  • If you want tooling that isn't prone to this class of problem at all, think about installing your dependencies via [Nix](https://nixos.org/), which _never_ reuses software inappropriately: if you want to use program-Y and the available binaries aren't compiled against the same glibc as the rest of your system, Nix will either install an older glibc that program-Y was built against (only for use by program-Y, with everything else still continuing to use the libc that other software was built against), or rebuild program-Y against your newer glibc. – Charles Duffy Feb 08 '23 at 17:42
  • BTW, glib and glibc are two different things; I'm removing the glib tag, since it's the latter that's relevant here. – Charles Duffy Feb 08 '23 at 17:47

1 Answers1

2

I'm using Serverless and https://www.npmjs.com/package/serverless-python-requirements to bundle a Python 3.9 function, and was hitting the same error. I added a couple of pip args to the serverless plugin to specify the target system, which got me past the issue: pipCmdExtraArgs: ['--platform manylinux2014_x86_64', '--only-binary=:all:'] Here is the full config I'm using for the plugin (from my serverless.ts):

pythonRequirements: {
      dockerizePip: false,
      usePoetry: false,
      layer: true,
      useDownloadCache: false,
      useStaticCache: false,
      pipCmdExtraArgs: ['--platform manylinux2014_x86_64', '--only-binary=:all:'],
      slim: true
    }

which results in a pip install command that looks like this (just in case you are calling pip install manually in your pipeline): python3.9 -m pip install --platform manylinux2014_x86_64 --only-binary=:all: -t /someOutputFolder -r requirements.txt

Update: Another option I've found is to use a docker container as the lambda container, and install the python dependencies in the dockerfile, as shown in these docs: https://docs.aws.amazon.com/lambda/latest/dg/images-create.html Serverless makes it really easy to deploy the container image: https://www.serverless.com/blog/container-support-for-lambda

Matt Corwin
  • 61
  • 6
  • This answer solved my issue - those both, additional parameters were necessary. Although, I've been using `pip` command directly: `pip install --platform manylinux2014_x86_64 --only-binary=:all: --upgrade -t python oracledb` – kill3rreaper Aug 13 '23 at 11:51