From 2a23fe172430ed6c3127aa42187e720af6cf4e71 Mon Sep 17 00:00:00 2001 From: Nico <32375741+nulmete@users.noreply.github.com> Date: Fri, 23 Jan 2026 12:02:03 -0300 Subject: [PATCH] Fix: GLIBC version incompatibility causes orbit agent failure on Ubuntu 20.04 during fleet-desktop update (#38648) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Related issue:** Resolves #35413 Applied the same fix as in https://github.com/fleetdm/fleet/pull/29186/files: - Added musl-tools to the container image. This provides musl-gcc, a compiler that links against musl libc instead of glibc. We use it for static linking as explained below. - Added static linking flags (CGO_ENABLED=1 CC=musl-gcc -linkmode external -extldflags "-static"). This produces a self-contained binary with all C library code embedded, eliminating runtime dependencies on the host system's glibc version. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually Steps: - Started TUF server for the first time. Generated a Linux x86_64 image. ``` SYSTEMS="linux" \ DEB_FLEET_URL=https://nicofleet.ngrok.io \ DEB_TUF_URL=http://nicotuf.ngrok.io \ GENERATE_DEB=1 \ ENROLL_SECRET=tm2CHBEF1I5BVuM1+4hzRRtpC5ZYV8vb \ FLEET_DESKTOP=1 \ DEBUG=1 \ ./tools/tuf/test/main.sh ``` - Installed `fleet-osquery_26.1.46030_amd64.deb` generated by the previous command on a Kubuntu 20.04 x86_64 VM. - Ran `sudo journalctl -u orbit` to debug logs and verified that the GLIBC incompatibility error was raised: ``` tammi 22 15:36:53 nicolas-Standard-PC-i440FX-PIIX-1996 sudo[125623]: pam_unix(sudo:session): session opened for user nicolas by (uid=0) tammi 22 15:36:53 nicolas-Standard-PC-i440FX-PIIX-1996 orbit[125624]: /opt/orbit/bin/desktop/linux/stable/fleet-desktop/fleet-desktop: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.32' not found (required by /opt/orbit/bin/desktop/linux/stable/fleet-desktop/fleet-desktop) tammi 22 15:36:53 nicolas-Standard-PC-i440FX-PIIX-1996 orbit[125624]: /opt/orbit/bin/desktop/linux/stable/fleet-desktop/fleet-desktop: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by /opt/orbit/bin/desktop/linux/stable/fleet-desktop/fleet-desktop) tammi 22 15:36:53 nicolas-Standard-PC-i440FX-PIIX-1996 sudo[125623]: pam_unix(sudo:session): session closed for user nicolas tammi 22 15:37:08 nicolas-Standard-PC-i440FX-PIIX-1996 orbit[125199]: 2026-01-22T15:37:08+02:00 INF killing any pre-existing fleet-desktop instances tammi 22 15:37:09 nicolas-Standard-PC-i440FX-PIIX-1996 orbit[125199]: 2026-01-22T15:37:09+02:00 INF attempting to get user session type and display id=1000 user=nicolas tammi 22 15:37:09 nicolas-Standard-PC-i440FX-PIIX-1996 orbit[125199]: 2026-01-22T15:37:09+02:00 ERR failed to get X11 display, using default :0 error="display not found on who output" ``` - Built a new version of the agent after applying the fixes on this PR and pushed it to the TUF server: ``` # 1. Hardcode orbit to a higher version export ORBIT_VERSION=26.1.46099 #2. Generate new package FLEET_DESKTOP_VERSION=$ORBIT_VERSION make desktop-linux #3. Update to TUF server ./tools/tuf/test/push_target.sh linux desktop desktop.tar.gz $ORBIT_VERSION ``` Screenshot 2026-01-22 at 5 18 25 PM - In the VM, verified that an update for fleet desktop was detected by running `sudo journalctl -u orbit -g "update detected"`: ``` tammi 22 20:33:32 nicolas-Standard-PC-i440FX-PIIX-1996 orbit[4114]: 2026-01-22T20:33:32+02:00 INF update detected target=desktop ``` - Verified the new version is shown both on the desktop icon and the Fleet UI: Screenshot 2026-01-22 at 5 22 17 PM Screenshot 2026-01-22 at 5 22 46 PM ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) --- Dockerfile-desktop-linux | 2 ++ Makefile | 2 +- orbit/changes/35413-fleet-desktop-glibc-incompatibility-fix | 1 + 3 files changed, 4 insertions(+), 1 deletion(-) create mode 100644 orbit/changes/35413-fleet-desktop-glibc-incompatibility-fix diff --git a/Dockerfile-desktop-linux b/Dockerfile-desktop-linux index 21832aa839..e646d6fae8 100644 --- a/Dockerfile-desktop-linux +++ b/Dockerfile-desktop-linux @@ -1,6 +1,8 @@ FROM --platform=linux/amd64 golang:1.25.5-bookworm@sha256:5117d68695f57faa6c2b3a49a6f3187ec1f66c75d5b080e4360bfe4c1ada398c LABEL maintainer="Fleet Developers" +RUN apt-get update && apt-get install -y musl-tools && rm -rf /var/lib/apt/lists/* + RUN mkdir -p /usr/src/fleet RUN mkdir -p /output diff --git a/Makefile b/Makefile index d8eadcdd2e..fb0779192a 100644 --- a/Makefile +++ b/Makefile @@ -763,7 +763,7 @@ desktop-linux: docker build -f Dockerfile-desktop-linux -t desktop-linux-builder . docker run --rm -v $(shell pwd):/output desktop-linux-builder /bin/bash -c "\ mkdir -p /output/fleet-desktop && \ - go build -o /output/fleet-desktop/fleet-desktop -ldflags "-X=main.version=$(FLEET_DESKTOP_VERSION)" /usr/src/fleet/orbit/cmd/desktop && \ + CGO_ENABLED=1 CC=musl-gcc go build -o /output/fleet-desktop/fleet-desktop -ldflags \"-linkmode external -extldflags \\\"-static\\\" -X=main.version=$(FLEET_DESKTOP_VERSION)\" /usr/src/fleet/orbit/cmd/desktop && \ cd /output && \ tar czf desktop.tar.gz fleet-desktop && \ rm -r fleet-desktop" diff --git a/orbit/changes/35413-fleet-desktop-glibc-incompatibility-fix b/orbit/changes/35413-fleet-desktop-glibc-incompatibility-fix new file mode 100644 index 0000000000..21caac674e --- /dev/null +++ b/orbit/changes/35413-fleet-desktop-glibc-incompatibility-fix @@ -0,0 +1 @@ +- Added `musl-tools` to fleet-desktop build process to fix GLIBC incompatibility that caused orbit agent to fail when updating fleet-desktop on Ubuntu 20.04. \ No newline at end of file