fix(deploy): disable OpenSSL ARM crypto extensions to avoid SIGILL - #197
Open
stewroux wants to merge 1 commit into
Open
fix(deploy): disable OpenSSL ARM crypto extensions to avoid SIGILL#197stewroux wants to merge 1 commit into
stewroux wants to merge 1 commit into
Conversation
api and celery crash-loop with 'Illegal instruction (core dumped)' (SIGILL, exit 132) on some ARM64 hypervisors — reproduced under Colima using Apple's Virtualization Framework (vz backend). alembic upgrade head triggers it via redis -> PyJWT -> cryptography.hazmat.bindings, which loads cryptography's Rust/OpenSSL extension. Root cause: the guest kernel reports AArch64 crypto-extension HWCAP flags (AES/PMULL/SHA) that the hypervisor's vCPU does not actually support, so OpenSSL's runtime CPU-feature detection picks an accelerated code path that executes an unsupported instruction. OPENSSL_armcap=0 disables that detection, forcing the portable C fallback. It only affects OpenSSL's AArch64 codepath and is a no-op on x86_64 or on hosts where the flags are reported correctly, so it is safe to set unconditionally.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
make prodfails on Apple Silicon under Colima (Apple Virtualization Framework /vzbackend): theapicontainer crash-loops withIllegal instruction (core dumped)(SIGILL, exit 132) duringalembic upgrade head, soflowsint-api-prodnever becomes healthy andmake prodaborts.alembic upgrade head→flowsint_core→redis→ PyJWT →cryptography.hazmat.bindingsloads cryptography's Rust/OpenSSL extension, whose runtime CPU-feature detection picks an accelerated codepath that then executes an unsupported instruction.OPENSSL_armcap=0on theapiandceleryservices to force OpenSSL's portable C fallback. This only affects OpenSSL's AArch64 codepath — it's a no-op on x86_64 and on hosts where the HWCAP flags are reported correctly, so it's safe to set unconditionally.Test plan
import cryptography.hazmat.bindings._rustinside theapiimage, confirmed viadocker compose run --rm -e OPENSSL_armcap=0 ...that the import succeeds with the flag set.docker compose -f docker-compose.prod.yml up -dwith the fix applied:api,celery,postgres,redis,neo4j,appall reachhealthy/Up.curl http://127.0.0.1:5001/healthreturns{"status":"ok"}.🤖 Generated with Claude Code
https://claude.ai/code/session_01R3yAhS1TuD13NwPheDuMv6