apple / apple/foundationdb

fdbcli segmentation fault in container when FDB_TLS_VERIFY_PEERS envvar is defined

Open
#11,962 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
16.7k
Forks
1.6k
Avg merge
1d 20h
Merged PRs (30d)
126

Description

Hello.

I'm bumping into this when using `fdbcli` inside my `podman` container:
```
bash-5.1# fdbcli
Using cluster file `/etc/foundationdb/fdb.cluster'.
SIGNAL: Segmentation fault (11)
Trace: addr2line -e fdbcli.debug -p -C -f -i 0x7f622e19a6f0 0x179043a 0x17925c8 0x19d103e
Segmentation fault
```

My setup has TLS and I want to define these vars inside my container.
```
-FDB_TLS_VERIFY_PEERS
-FDB_TLS_CA_FILE
-FDB_TLS_KEY_FILE
-FDB_TLS_CERTIFICATE_FILE
-FDB_CLUSTER_FILE
```
These settings are also defined in the `[fdbserver]` config (and the values are the same) but I want to be able to run `fdbcli` without having to add the flags when inside the container.

It looks like this happens when I mount the container and the podman `--envfile` contains the env variable `FDB_TLS_VERIFY_PEERS`.

When I mount an envfile that doesn't contain that var fdbcli works.
When I mount an envfile that doesn't contain that var and I later export it after startup it works.

It might be something I'm overlooking, maybe. Image is `foundationdb:7.3.59`.

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash by running fdbcli from the foundationdb:7.3.59 container with FDB_TLS_VERIFY_PEERS supplied through podman --envfile, then compare it with exporting the variable after startup. Trace the fdbcli segmentation fault and verify that defining the variable in the environment no longer crashes while the TLS settings remain usable.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, docker
Domain
cli, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.