ocaml-ci: arm64 linking error

From https://ci.ocamllabs.io/github/moby/vpnkit/commit/d91517547a11f97700d544387a6d292651db37d1/variant/debian-11-4.14_arm64_opam-2.1

To reproduce locally:

git clone --recursive "https://github.com/moby/vpnkit.git" && cd "vpnkit" && git fetch origin "refs/pull/595/head" && git reset --hard d9151754
cat > Dockerfile <<'END-OF-DOCKERFILE'
FROM ocaml/opam@sha256:58d77022f1f399d105d5f398d409c6eb5bf95e77dd201ddae6018d86d8eb7501
# debian-11-4.14_arm64_opam-2.1
USER 1000:1000
RUN sudo ln -f /usr/bin/opam-2.1 /usr/bin/opam
WORKDIR /src
RUN sudo chown opam /src
RUN cd ~/opam-repository && (git cat-file -e bc8df14f0d08de7b76d0d43a043cbd0c5f356dec || git fetch origin master) && git reset -q --hard bc8df14f0d08de7b76d0d43a043cbd0c5f356dec && git log --no-decorate -n1 --oneline && opam update -u
COPY --chown=1000:1000 vpnkit.opam ./
RUN opam pin add -yn vpnkit.dev './'
ENV DEPS="alcotest.1.5.0 angstrom.0.15.0 arp.3.0.0 astring.0.8.5 base.v0.14.3 base-bigarray.base base-bytes.base base-threads.base base-unix.base base64.3.5.0 bigarray-compat.1.1.0 bigstringaf.0.9.0 camlp-streams.5.0.1 charrua.1.5.0 charrua-client.1.5.0 charrua-server.1.5.0 cmdliner.1.0.4 cohttp.5.0.0 cohttp-lwt.5.0.0 conf-pkg-config.2 cppo.1.6.9 csexp.1.5.1 cstruct.6.1.1 cstruct-lwt.6.1.1 cstruct-sexp.6.1.1 ctypes.0.20.1 domain-name.0.4.0 dune.3.4.1 dune-configurator.3.4.1 duration.0.2.0 ethernet.3.0.0 ezjsonm.1.3.0 fd-send-recv.2.0.1 fmt.0.9.0 functoria-runtime.3.1.2 hex.1.5.0 hvsock.3.0.0 integers.0.7.0 io-page.2.3.0 io-page-unix.2.3.0 ipaddr.5.3.1 ipaddr-sexp.5.3.1 jane-street-headers.v0.14.0 jsonm.1.0.1 jst-config.v0.14.1 logs.0.7.0 lru.0.3.0 luv.0.5.11 luv_unix.0.5.0 lwt.5.6.1 lwt-dllist.1.0.1 macaddr.5.3.1 macaddr-cstruct.5.3.1 macaddr-sexp.5.3.1 menhir.20220210 menhirLib.20220210 menhirSdk.20220210 metrics.0.4.0 mirage-channel.4.1.0 mirage-clock.4.2.0 mirage-clock-unix.4.2.0 mirage-entropy.0.5.0 mirage-flow.3.0.0 mirage-flow-combinators.3.0.0 mirage-kv.4.0.1 mirage-net.4.0.0 mirage-profile.0.9.1 mirage-random.3.0.0 mirage-random-stdlib.0.1.0 mirage-runtime.3.10.8 mirage-stack.4.0.0 mirage-time.3.0.0 mirage-vnetif.0.6.0 num.1.4 ocaml.4.14.0 ocaml-base-compiler.4.14.0 ocaml-compiler-libs.v0.12.4 ocaml-config.2 ocaml-options-vanilla.1 ocaml-syntax-shims.1.0.0 ocamlbuild.0.14.1 ocamlfind.1.9.5 ocb-stubblr.0.1.1-1 ocplib-endian.1.2 octavius.1.2.2 ounit.2.2.6 ounit2.2.2.6 parsexp.v0.14.2 pcap-format.0.6.0 ppx_assert.v0.14.0 ppx_base.v0.14.0 ppx_cold.v0.14.0 ppx_compare.v0.14.0 ppx_cstruct.6.1.1 ppx_derivers.1.2.1 ppx_enumerate.v0.14.0 ppx_hash.v0.14.0 ppx_here.v0.14.0 ppx_inline_test.v0.14.1 ppx_js_style.v0.14.1 ppx_optcomp.v0.14.3 ppx_sexp_conv.v0.14.3 ppxlib.0.25.1 protocol-9p.2.0.2 psq.0.2.0 randomconv.0.1.3 re.1.10.4 result.1.5 rresult.0.7.0 seq.base sexplib.v0.14.0 sexplib0.v0.14.0 sha.1.15.2 stdio.v0.14.0 stdlib-shims.0.3.0 stringext.1.6.0 tar.2.0.1 tcpip.7.1.2 time_now.v0.14.0 topkg.1.0.5 uchar.0.0.2 uri.4.2.0 uri-sexp.4.2.0 uuidm.0.9.7 uutf.1.0.3 win-error.1.0"
RUN opam update --depexts && opam install --cli=2.1 --depext-only -y vpnkit.dev $DEPS
RUN opam install $DEPS
COPY --chown=1000:1000 . /src/
RUN opam exec -- dune build @install @check @runtest && rm -rf _build

END-OF-DOCKERFILE
docker build .

File "src/bin/dune", line 2, characters 7-11:
2 |  (name main)
           ^^^^
/usr/bin/ld: /home/opam/.opam/4.14/lib/luv/c/libuv.a(libuv_la-dl.o): in function `uv_dlopen':
/home/opam/.opam/4.14/.opam-switch/build/luv.0.5.11/_build/default/src/c/vendor/libuv/src/unix/dl.c:36: warning: Using 'dlopen' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/ocaml/libunix.a(initgroups.o): in function `unix_initgroups':
/home/opam/.opam/4.14/.opam-switch/build/ocaml-base-compiler.4.14.0/otherlibs/unix/initgroups.c:35: warning: Using 'initgroups' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/ocaml/libunix.a(getgr.o): in function `unix_getgrgid':
/home/opam/.opam/4.14/.opam-switch/build/ocaml-base-compiler.4.14.0/otherlibs/unix/getgr.c:65: warning: Using 'getgrgid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/ocaml/libunix.a(getgr.o): in function `unix_getgrnam':
/home/opam/.opam/4.14/.opam-switch/build/ocaml-base-compiler.4.14.0/otherlibs/unix/getgr.c:50: warning: Using 'getgrnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/lwt/unix/liblwt_unix_stubs.a(unix_get_pw_gr_nam_id_job.o): in function `worker_getgrgid':
/home/opam/.opam/4.14/.opam-switch/build/lwt.5.6.1/_build/default/src/unix/unix_get_pw_gr_nam_id_job.c:132: warning: Using 'getgrgid_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/lwt/unix/liblwt_unix_stubs.a(unix_get_pw_gr_nam_id_job.o): in function `worker_getgrnam':
/home/opam/.opam/4.14/.opam-switch/build/lwt.5.6.1/_build/default/src/unix/unix_get_pw_gr_nam_id_job.c:126: warning: Using 'getgrnam_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/ocaml/libunix.a(getpw.o): in function `unix_getpwnam':
/home/opam/.opam/4.14/.opam-switch/build/ocaml-base-compiler.4.14.0/otherlibs/unix/getpw.c:57: warning: Using 'getpwnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/ocaml/libunix.a(getpw.o): in function `unix_getpwuid':
/home/opam/.opam/4.14/.opam-switch/build/ocaml-base-compiler.4.14.0/otherlibs/unix/getpw.c:72: warning: Using 'getpwuid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/lwt/unix/liblwt_unix_stubs.a(unix_get_pw_gr_nam_id_job.o): in function `worker_getpwnam':
/home/opam/.opam/4.14/.opam-switch/build/lwt.5.6.1/_build/default/src/unix/unix_get_pw_gr_nam_id_job.c:123: warning: Using 'getpwnam_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/lwt/unix/liblwt_unix_stubs.a(unix_get_pw_gr_nam_id_job.o): in function `worker_getpwuid':
/home/opam/.opam/4.14/.opam-switch/build/lwt.5.6.1/_build/default/src/unix/unix_get_pw_gr_nam_id_job.c:129: warning: Using 'getpwuid_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/lwt/unix/liblwt_unix_stubs.a(unix_getaddrinfo_job.o): in function `worker_getaddrinfo':
/home/opam/.opam/4.14/.opam-switch/build/lwt.5.6.1/_build/default/src/unix/unix_getaddrinfo_job.c:66: warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/lwt/unix/liblwt_unix_stubs.a(unix_gethostbyaddr_job.o): in function `worker_gethostbyaddr':
/home/opam/.opam/4.14/.opam-switch/build/lwt.5.6.1/_build/default/src/unix/unix_gethostbyaddr_job.c:41: warning: Using 'gethostbyaddr_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/lwt/unix/liblwt_unix_stubs.a(unix_gethostbyname_job.o): in function `worker_gethostbyname':
/home/opam/.opam/4.14/.opam-switch/build/lwt.5.6.1/_build/default/src/unix/unix_gethostbyname_job.c:42: warning: Using 'gethostbyname_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/lwt/unix/liblwt_unix_stubs.a(unix_getprotoby_getservby_job.o): in function `worker_getprotobynumber':
/home/opam/.opam/4.14/.opam-switch/build/lwt.5.6.1/_build/default/src/unix/unix_getprotoby_getservby_job.c:234: warning: Using 'getprotobynumber' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/lwt/unix/liblwt_unix_stubs.a(unix_getprotoby_getservby_job.o): in function `worker_getprotobyname':
/home/opam/.opam/4.14/.opam-switch/build/lwt.5.6.1/_build/default/src/unix/unix_getprotoby_getservby_job.c:231: warning: Using 'getprotobyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/lwt/unix/liblwt_unix_stubs.a(unix_getprotoby_getservby_job.o): in function `worker_getservbyname':
/home/opam/.opam/4.14/.opam-switch/build/lwt.5.6.1/_build/default/src/unix/unix_getprotoby_getservby_job.c:237: warning: Using 'getservbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/bin/ld: /home/opam/.opam/4.14/lib/lwt/unix/liblwt_unix_stubs.a(unix_getprotoby_getservby_job.o): in function `worker_getservbyport':
/home/opam/.opam/4.14/.opam-switch/build/lwt.5.6.1/_build/default/src/unix/unix_getprotoby_getservby_job.c:241: warning: Using 'getservbyport' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/usr/lib/gcc/aarch64-linux-gnu/10/../../../aarch64-linux-gnu/libc.a(abort.o): in function `abort':
(.text.unlikely+0x24): relocation truncated to fit: R_AARCH64_LD64_GOTPAGE_LO15 against symbol `__stack_chk_guard' defined in .data.rel.ro section in /usr/lib/gcc/aarch64-linux-gnu/10/../../../aarch64-linux-gnu/libc.a(libc-start.o)
/usr/bin/ld: (.text.unlikely+0x24): warning: too many GOT entries for -fpic, please recompile with -fPIC
collect2: error: ld returned 1 exit status
File "caml_startup", line 1:
Error: Error during linking (exit code 1)

Reproduce the failure with the provided Dockerfile and docker build .; the reported failure occurs while building src/bin/dune. Read that dune entry point alongside the arm64 linker output, then verify completion with opam exec -- dune build @install @check @runtest on the specified Debian 11 arm64 environment.