<turbo-stream action="append" target="posts_list"><template>    <div class="postbit" id="226097" data-post-id="226097">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="trkoch" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/trkoch/120/23423_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  trkoch
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>I see. Good point!</p>
<aside class="quote no-group" data-username="banano" data-post="12" data-topic="40496">
<div class="title">
<div class="quote-controls"></div>
<img alt="" width="24" height="24" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/banano/48/6966_2.png" class="avatar"> banano:</div>
<blockquote>
<p>btw, libgcc is not needed, just libstdc++</p>
</blockquote>
</aside>
<p>According to <a href="http://pkgs.alpinelinux.org" rel="noopener nofollow ugc">pkgs.alpinelinux.org</a> libgcc is a dependency of libstdc++. I didn’t immediately make sense to me though why this is the case.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="226097" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/docker-run-error-loading-shared-library-libstdc-so-6-and-libgcc-s-so-1/40496/13">Post #12</a>
	                </div>
	            </div>
              <div id="likers-container-226097" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="226097"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #12"></div>
  </section>
</div>
    <div class="postbit" id="247633" data-post-id="247633">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="Exadra37" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/Exadra37/120/9183_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  Exadra37
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<aside class="quote no-group" data-username="romenigld" data-post="8" data-topic="40496">
<div class="title">
<div class="quote-controls"></div>
<img alt="" width="24" height="24" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/romenigld/48/6200_2.png" class="avatar"> romenigld:</div>
<blockquote>
<pre data-code-wrap="elixir"><code class="lang-elixir">RUN chown nobody:nobody /app

USER nobody:nobody

COPY --from=build --chown=nobody:nobody /app/_build/prod/rel/blog ./
</code></pre>
</blockquote>
</aside>
<p>User nobody is not recommended to use to run any app inside or outside a docker container.</p>
<p>Check this issue I open:</p>
<aside class="onebox githubissue" data-onebox-src="https://github.com/phoenixframework/phoenix/issues/4188">
  <header class="source">

      <a href="https://github.com/phoenixframework/phoenix/issues/4188" target="_blank" rel="noopener nofollow ugc">github.com/phoenixframework/phoenix</a>
  </header>

  <article class="onebox-body">
    <div class="github-row">
  <div class="github-icon-container" title="Issue" data-github-private-repo="false">
	  <svg width="60" height="60" class="github-icon" viewBox="0 0 14 16" aria-hidden="true"><path fill-rule="evenodd" d="M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"></path></svg>
  </div>

  <div class="github-info-container">
    <h4>
      <a href="https://github.com/phoenixframework/phoenix/issues/4188" target="_blank" rel="noopener nofollow ugc">Deployment guide shouldn't use nobody user in the Dockerfile</a>
    </h4>

    <div class="github-info">
      <div class="date">
        opened <span class="discourse-local-date" data-format="ll" data-date="2021-01-29" data-time="11:13:47" data-timezone="UTC">11:13AM - 29 Jan 21 UTC</span>
      </div>

        <div class="date">
          closed <span class="discourse-local-date" data-format="ll" data-date="2021-04-27" data-time="09:48:59" data-timezone="UTC">09:48AM - 27 Apr 21 UTC</span>
        </div>

      <div class="user">
        <a href="https://github.com/Exadra37" target="_blank" rel="noopener nofollow ugc">
          <img alt="" src="https://avatars.githubusercontent.com/u/1745456?v=4" class="onebox-avatar-inline" width="20" height="20">
          Exadra37
        </a>
      </div>
    </div>

    <div class="labels">
    </div>
  </div>
</div>

  <div class="github-row">
    <p class="github-body-container">The [deployment guide](https://github.com/phoenixframework/phoenix/blob/b973280f<span class="show-more-container"><a href="" rel="noopener nofollow" class="show-more">…</a></span><span class="excerpt hidden">33f3403efbab14fa012b53596826d5a1/guides/deployment/releases.md) has a dockerfile example that suggests the use of the `nobody` user, but this user is not recommend to run any programs, it's reserved for use only with NFS, as per the  [Ubuntu wiki](https://wiki.ubuntu.com/nobody):

&gt; User nobody on a Unix system is traditionally user id 65534. This user is used by NFS servers when they cannot trust the client-supplied uids and gids, or when the root-squash option is being used.
&gt;
&gt;See https://www.kernel.org/doc/ols/2006/ols2006v2-pages-59-72.pdf and https://www.oreilly.com/openbook/linag2/book/ch14.html for more information on user nobody.
&gt;
&gt;Some misguided programs or guides suggest that this user should be used for untrusted program execution or handling untrusted data. This is bad advice. Services should have their own, dedicated, user account. Even on sites where NFS is not being used, processes run as user nobody or files owned by user nobody may grant far more privileges than expected, especially if two services have been misconfigured in this fashion.
&gt;
&gt; **Do not use the user nobody for anything. It is for NFS. **

Using `nobody` as the user can even pose a security risk as explained in the above quote from the Ubuntu wiki. So instead a new and dedicated user should be created.

### Environment

N/A

### Expected behavior

```dockerfile
FROM hexpm/elixir:1.11.2-erlang-23.1.2-alpine-3.12.1 as build

# install build dependencies
RUN apk add --no-cache build-base npm git python3

# prepare build dir
WORKDIR /app

# install hex + rebar
RUN mix local.hex --force &amp;&amp; \
    mix local.rebar --force

# set build ENV
ENV MIX_ENV=dev

# install mix dependencies
COPY mix.exs mix.lock ./
RUN mix deps.get --only $MIX_ENV
RUN mkdir config
# Dependencies sometimes use compile-time configuration. Copying
# these compile-time config files before we compile dependencies
# ensures that any relevant config changes will trigger the dependencies
# to be re-compiled.
COPY config/config.exs config/$MIX_ENV.exs config/
RUN mix deps.compile

# build assets
COPY assets/package.json assets/package-lock.json ./assets/
# install all npm dependencies from scratch
RUN npm --prefix ./assets ci --progress=false --no-audit --loglevel=error

COPY priv priv

# Note: if your project uses a tool like https://purgecss.com/,
# which customizes asset compilation based on what it finds in
# your Elixir templates, you will need to move the asset compilation step
# down so that `lib` is available.
COPY assets assets
# use webpack to compile npm dependencies - https://www.npmjs.com/package/webpack-deploy
RUN npm run --prefix ./assets deploy
RUN mix phx.digest

# compile and build the release
COPY lib lib
RUN mix compile
# changes to config/runtime.exs don't require recompiling the code
COPY config/runtime.exs config/
# uncomment COPY if rel/ exists
# COPY rel rel
RUN mix release

# Start a new build stage so that the final image will only contain
# the compiled release and other runtime necessities
FROM alpine:3.12.1 AS app
RUN apk add --no-cache openssl ncurses-libs

ENV USER="phoenix"
ENV HOME=/home/"${USER}"
ENV APP_DIR="${HOME}/app"

# Creates an unprivileged user to be used exclusively to run the Phoenix app
RUN \
  addgroup \
   -g 1000 \
   -S "${USER}" &amp;&amp; \
  adduser \
   -s /bin/sh \
   -u 1000 \
   -G "${USER}" \
   -h "${HOME}" \
   -D "${USER}" &amp;&amp; \

  su "${USER}" sh -c "mkdir ${APP_DIR}"

# Everything from this line onwards will run in the context of the unprivileged user.
USER "${USER}"

WORKDIR "${APP_DIR}"

COPY --from=build --chown="${USER}":"${USER}" /app/_build/prod/rel/my_app ./

ENTRYPOINT ["bin/my_app"]

# Usage:
#  * build: sudo docker build -t phoenix/my_app .
#  * shell: sudo docker run --rm -it --entrypoint "" -p 80:4000 -p 443:4040 phoenix/my_app sh
#  * run:   sudo docker run --rm -it -p 80:4000 -p 443:4040 --name my_app phoenix/my_app
#  * exec:  sudo docker exec -it my_app sh
#  * logs:  sudo docker logs --follow --tail 100 my_app
#
# Extract the production release to your host machine with:
#
# ```
# mkdir archive
# sudo docker run --rm -it --entrypoint "" -v "$PWD/archive:/home/phoenix/archive"  phoenix/my_app sh -c "tar zcf /home/phoenix/archive/app.tar.gz ."
# ls -al archive
# ````
CMD ["start"]
```

Build:

```
sudo docker build -t phoenix/my_app .
```

Check user:

```
$ sudo docker run --rm -it --entrypoint "" phoenix/my_app sh -c "id -u"                                                                     1 ↵
1000

$ sudo docker run --rm -it --entrypoint "" phoenix/my_app sh -c "id -un"
phoenix
```

Now the app will run with an unprivileged user that is not used anywhere else in the system as the `nobody` user his.

### Actual behavior

```
$ sudo docker run --rm -it --entrypoint "" phoenix/my_app sh -c "id -u" 
65534

$ sudo docker run --rm -it --entrypoint "" phoenix/my_app sh -c "id -un"
nobody
```

While `nobody` is still a unprivileged user, its a user that may be used by other parts of the system.</span></p>
  </div>

  </article>

  <div class="onebox-metadata">
    
    
  </div>

  <div style="clear: both"></div>
</aside>

<p>The fixed Dockerfile on the issue:</p>
<pre data-code-wrap="elixir"><code class="lang-elixir">FROM hexpm/elixir:1.11.2-erlang-23.1.2-alpine-3.12.1 as build

# install build dependencies
RUN apk add --no-cache build-base npm git python3

# prepare build dir
WORKDIR /app

# install hex + rebar
RUN mix local.hex --force &amp;&amp; \
    mix local.rebar --force

# set build ENV
ENV MIX_ENV=dev

# install mix dependencies
COPY mix.exs mix.lock ./
RUN mix deps.get --only $MIX_ENV
RUN mkdir config
# Dependencies sometimes use compile-time configuration. Copying
# these compile-time config files before we compile dependencies
# ensures that any relevant config changes will trigger the dependencies
# to be re-compiled.
COPY config/config.exs config/$MIX_ENV.exs config/
RUN mix deps.compile

# build assets
COPY assets/package.json assets/package-lock.json ./assets/
# install all npm dependencies from scratch
RUN npm --prefix ./assets ci --progress=false --no-audit --loglevel=error

COPY priv priv

# Note: if your project uses a tool like https://purgecss.com/,
# which customizes asset compilation based on what it finds in
# your Elixir templates, you will need to move the asset compilation step
# down so that `lib` is available.
COPY assets assets
# use webpack to compile npm dependencies - https://www.npmjs.com/package/webpack-deploy
RUN npm run --prefix ./assets deploy
RUN mix phx.digest

# compile and build the release
COPY lib lib
RUN mix compile
# changes to config/runtime.exs don't require recompiling the code
COPY config/runtime.exs config/
# uncomment COPY if rel/ exists
# COPY rel rel
RUN mix release

# Start a new build stage so that the final image will only contain
# the compiled release and other runtime necessities
FROM alpine:3.12.1 AS app

RUN apk add --no-cache openssl ncurses-libs libstdc++

ENV USER="phoenix"
ENV HOME=/home/"${USER}"
ENV APP_DIR="${HOME}/app"

# Creates an unprivileged user to be used exclusively to run the Phoenix app
RUN \
  addgroup \
   -g 1000 \
   -S "${USER}" &amp;&amp; \
  adduser \
   -s /bin/sh \
   -u 1000 \
   -G "${USER}" \
   -h "${HOME}" \
   -D "${USER}" &amp;&amp; \

  su "${USER}" sh -c "mkdir ${APP_DIR}"

# Everything from this line onwards will run in the context of the unprivileged user.
USER "${USER}"

WORKDIR "${APP_DIR}"

COPY --from=build --chown="${USER}":"${USER}" /app/_build/prod/rel/my_app ./

ENTRYPOINT ["bin/my_app"]

# Usage:
#  * build: sudo docker build -t phoenix/my_app .
#  * shell: sudo docker run --rm -it --entrypoint "" -p 80:4000 -p 443:4040 phoenix/my_app sh
#  * run:   sudo docker run --rm -it -p 80:4000 -p 443:4040 --name my_app phoenix/my_app
#  * exec:  sudo docker exec -it my_app sh
#  * logs:  sudo docker logs --follow --tail 100 my_app
#
# Extract the production release to your host machine with:
#
# ```
# mkdir archive
# sudo docker run --rm -it --entrypoint "" -v "$PWD/archive:/home/phoenix/archive"  phoenix/my_app sh -c "tar zcf /home/phoenix/archive/app.tar.gz ."
# ls -al archive
# ````
CMD ["start"]
</code></pre> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="247633" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/docker-run-error-loading-shared-library-libstdc-so-6-and-libgcc-s-so-1/40496/14">Post #13</a>
	                </div>
	            </div>
              <div id="likers-container-247633" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="247633"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #13"></div>
  </section>
</div>
    <div class="postbit" id="247761" data-post-id="247761">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="romenigld" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/romenigld/120/6200_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  romenigld
                    <span class="op-star" title="Thread Starter">
                      <img alt="OP" class="op-star-icon" src="/assets/thread-icons/thread-icon-thread-starter-df91e872.png" />
                    </span>
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p><a class="mention" href="/u/exadra37" rel="nofollow">@Exadra37</a>,<br>
Thank you for the information, have a good day!</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="247761" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/docker-run-error-loading-shared-library-libstdc-so-6-and-libgcc-s-so-1/40496/15">Post #14</a>
	                </div>
	            </div>
              <div id="likers-container-247761" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="247761"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #14"></div>
  </section>
</div>
    <div class="postbit" id="251230" data-post-id="251230">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="te_chris" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/te_chris/120/6142_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  te_chris
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>I’ve followed the update Debian based guide, but am still getting errors on OTP 24 relating to libstdc++6.so.</p>
<pre data-code-wrap="elixir"><code class="lang-elixir"># start a new build stage so that the final image will only contain
# the compiled release and other runtime necessities
FROM ${RUNNER_IMAGE} as cms

ARG SHORT_SHA

# Assign version number for AppSignal
ENV APP_REVISION=$SHORT_SHA

RUN apt-get update -y &amp;&amp; apt-get install -y libstdc++6 openssl libncurses5 locales \
	&amp;&amp; apt-get clean &amp;&amp; rm -f /var/lib/apt/lists/*_*

# Set the locale
RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen &amp;&amp; locale-gen

ENV LANG en_US.UTF-8
ENV LANGUAGE en_US:en
ENV LC_ALL en_US.UTF-8

WORKDIR "/app"
RUN chown nobody /app

# set runner ENV
ENV MIX_ENV="prod"

# Only copy the final release from the build stage
COPY --from=builder --chown=nobody:root /app/_build/${MIX_ENV}/rel/cms ./

USER nobody

ENV HOME=/app

CMD ["bin/cms", "start"]
</code></pre>
<p>Has anyone else come across this and fixed it?</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="251230" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/docker-run-error-loading-shared-library-libstdc-so-6-and-libgcc-s-so-1/40496/16">Post #15</a>
	                </div>
	            </div>
              <div id="likers-container-251230" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="251230"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #15"></div>
  </section>
</div>
    <div class="postbit" id="253395" data-post-id="253395">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="i-n-g-m-a-r" src="/assets/icons/user-9f439610.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  i-n-g-m-a-r
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>I’m having the same issues.<br>
My gitlab build passes but the docker image won’t run anymore.</p>
<p>I tried updating <code>elixir:1.11.4-alpine</code> to <code>elixir:1.12.3-alpine </code> and then to <code>elixir:1.13.4-alpine</code></p>
<p>I tried <code>libgcc libstdc++ ncurses-libs</code> just <code>libstdc++</code> and <code>libc6-compat</code></p>
<p>Nothing’s working.</p>
<hr>
<p>Update: I just noticed it’s <code>erts-12.3.2.1/bin/beam.smp</code> in my case instead of <code>erts-12.0.2/bin/beam.smp</code></p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="253395" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/docker-run-error-loading-shared-library-libstdc-so-6-and-libgcc-s-so-1/40496/17">Post #16</a>
	                </div>
	            </div>
              <div id="likers-container-253395" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="253395"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-last-post cat-last-post" title="Last post!"></div>
  </section>
</div>
</template></turbo-stream><turbo-stream action="replace" target="load-more-container"><template><div id="load-more-container" class="load-more-container">
    <span class="all-loaded">— All posts loaded —</span>
</div></template></turbo-stream>