reqwest::Client builder error inside Fly Machines — TLS fails in firecracker VM

Open
#4,803 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Quiet
Tech stack
docker, rust
Domain
cloud, networking

Research direction

No flyctl file, test, or entry point is identified in the report. Start by reproducing the reqwest rustls client build with the supplied image and Fly Machine settings, then compare it with the successful local Docker run; done requires identifying the environment-specific cause and documenting an actionable fix or confirmed limitation.

Written by the indexing model from the issue text.

Description

Summary

reqwest::Client::builder().use_rustls_tls().build() returns a generic "builder error" when running inside a Fly Machine. The same binary works correctly in Docker locally (both arm64 and amd64).

Environment

  • Region: cdg (Paris)
  • Machine: shared-cpu-1x, 512MB
  • Base image: debian:bookworm-slim and also rust:1.91-bookworm (single-stage)
  • Rust: 1.91.0
  • reqwest: 0.12.28 with default-features = false, features = ["json", "rustls-tls", "http2", "charset"]

Reproduction

  1. Simple Axum server with a health endpoint that creates a reqwest client and makes an HTTPS POST:
let client = reqwest::Client::builder()
    .use_rustls_tls()
    .build()
    .map_err(|e| format!("client build: {e}"))?; // <-- fails here with "builder error"

let resp = client
    .post("https://api.mailersend.com/v1/email")
    .header("Authorization", "Bearer xxx")
    .header("Content-Type", "application/json")
    .body(r#"{"test": true}"#.to_string())
    .send()
    .await?;
  1. Build with Docker: docker build --platform linux/amd64 -t test .
  2. Run locally: works, returns HTTP 202
  3. Deploy to Fly: same image, returns "builder error"
  4. Tested with --depot=false --no-cache, --local-only, and manually pushing to registry.fly.io — same result every time

What works

  • The binary itself starts fine (health check passes, PostgreSQL connects, MongoDB connects, Solana RPC connects)
  • Only outbound HTTPS via reqwest fails
  • ca-certificates is installed in the image

Expected

reqwest::Client::builder().use_rustls_tls().build() should succeed, as it does in the identical Docker image run locally.

Workaround

None found. Trying Shuttle as alternative hosting.

Dominant language
Go
Stars
1.7k
Forks
311
Avg merge
12h 50m
Merged PRs (30d)
78

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from superfly/flyctl

All issues in superfly/flyctl

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.