Build linux binaries against old glibc (ubuntu:20.04 container) - #5
Merged
Conversation
The linux binaries were built on ubuntu-22.04 (glibc 2.35), so they failed to run on older CI machines: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found ... GLIBCXX_3.4.29 not found ... GitHub's oldest hosted Ubuntu is now 22.04 (20.04 was retired), so a hosted runner can't give us an old glibc. Instead, build the linux legs inside an `ubuntu:20.04` container (glibc 2.31) via `docker run`, which keeps the binary runnable on Ubuntu 20.04+/RHEL8+. All GitHub JS actions (checkout, upload-artifact) stay on the host, so the container only needs a C/C++ toolchain — not a node24-compatible userspace. Split the former single matrix `build` job into `build-linux` (containerized, x86_64 + arm64) and `build-darwin` (native; macOS has no glibc). Force the bfd linker in the container, which both avoids the aarch64 gold erratum-843419 crash and needs no extra package (replacing the previous lld workaround). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Older release scripts always installed a JDK to build Bazel. Modern Bazel uses a downloaded remote JDK plus the embedded JRE, but add default-jdk to the bare ubuntu:20.04 build container so a missing system JDK can't fail the build. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The default workspace status (no --workspace_status_command) never shells out to git, so --stamp embeds --embed_label without git; and Bazel 8 pulls deps from registry archives, not git_repository. So the container needs neither git nor the safe.directory config. Modern Bazel also builds with a downloaded remote JDK + embedded JRE, so drop default-jdk too. Erring on simplicity; re-add only if a run actually fails. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #4. The published linux binaries don't run on older CI:
Cause
We built on
ubuntu-22.04(glibc 2.35 / newer libstdc++), baking in symbols too new for CI (the fingerprint = Ubuntu 20.04 / glibc 2.31).Why not "just use an older runner"
GitHub's oldest hosted Ubuntu is now
ubuntu-22.04— 20.04 was retired (runner-images: only 22.04 / 24.04 / 26.04-preview remain). So a hosted runner can't give us old glibc.Fix
Build the linux legs inside an
ubuntu:20.04container (glibc 2.31) viadocker run, keeping the binary runnable on Ubuntu 20.04+ / RHEL8+.ubuntu2004is a Bazel-supported build platform, so the toolchain is known-good. All GitHub JS actions (checkout, upload-artifact) stay on the host, so the old container never needs a node24-compatible userspace — onlybuild-essential.Considered but rejected the "harder answer" (custom cc toolchain / sysroot targeting an old ABI) — more complex and fragile for the same result.
Structure
buildjob →build-linux(containerized; x86_64 + arm64) andbuild-darwin(native; macOS has no glibc).--linkopt=-fuse-ld=bfdin the container: avoids the aarch64 gold erratum-843419 crash and needs no extra package (replaces the priorlldinstall).Notes
8.6.0-figma2.1ddaab25f9— please confirm the PR shows it before merging.🤖 Generated with Claude Code