←back to thread

The state of binary compatibility on Linux and how to address it

(jangafx.com)
196 points generichuman | 2 comments | 01 Apr 25 22:22 UTC | HN request time: 0s | source
Show context
Jeaye ◴[02 Apr 25 00:21 UTC] No.43552616[source]▶
I don't understand why they don't just statically link their binaries. First, they said this:

> Even if you managed to statically link GLIBC—or used an alternative like musl—your application would be unable to load any dynamic libraries at runtime.

But then they immediately said they actually statically link all of their deps aside from libc.

> Instead, we take a different approach: statically linking everything we can.

If they're statically linking everything other than libc, then using musl or statically linking glibc will finish the job. Unless they have some need for loading share libs at runtime which they didn't already have linked into their binary (i.e. manual dlopen), this solves the portability problem on Linux.

What am I missing (assuming I know of the security implications of statically linked binaries -- which they didn't mention as a concern)?

replies(6): >>43552647 #>>43552652 #>>43552691 #>>43552703 #>>43552800 #>>43552822 #
masfuerte ◴[02 Apr 25 00:28 UTC] No.43552647[source]▶
Various things including name (DNS) resolution rely on dynamic linking.
replies(1): >>43552651 #
Jeaye ◴[02 Apr 25 00:30 UTC] No.43552651[source]▶
Are you saying that a statically linked binary cannot make an HTTP request to `google.com` because it would be unable to resolve the domain name?

There are entire distros, like alpine, built on musl. I find this very hard to believe.

replies(4): >>43552683 #>>43552699 #>>43552733 #>>43555012 #
1. Spivak ◴[02 Apr 25 00:40 UTC] No.43552699[source]▶
You have to bundle your own resolver into your application. But here's the rub, users expect your application to respect nsswitch which requires loading shared libs which execute arbitrary code. How Go handles this is somewhat awkward. They parse /etc/nsswitch and decide if they can cheat and use their own resolver based on what modules they see[1]. Otherwise they farm out to cgo to go through glibc.

[1] They're playing with fire here because you can't really assume to know for sure how the module 'dns' behaves. A user could replace the lib that backs it with their own that resolves everything to zombo.com. It would be one thing if nsswitch described behavior which was well defined and could be emulated but it doesn't, it specifies a specific implementation.

replies(1): >>43552720 #
2. Jeaye ◴[02 Apr 25 00:45 UTC] No.43552720[source]▶
Fascinating. Thanks for breaking this down more. I think the article could've explained this point further.