Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.
Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upWorkaround "Segmentation fault" when run node on alpine linux #845
Conversation
It's caused by gresec, mongo use jit for js, need exec for mmap, by default, this is not allowed, need add a pax header to disable MPROTECT. original idea @wener: https://jira.mongodb.org/browse/SERVER-31834?focusedCommentId=1720016&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-1720016
|
Should probably change in https://github.com/nodejs/docker-node/blob/master/Dockerfile-alpine.template and then use the update.sh to run the template on the images |
It's caused by gresec, it use jit for js, need exec for mmap, by default, this is not allowed, need add a pax header to disable MPROTECT. original idea @wener: https://jira.mongodb.org/browse/SERVER-31834?focusedCommentId=1720016&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-1720016
|
Hi @nschonni, |
|
If you run the update script it should update node 6 and 10 as well |
yosifkit
commented
Aug 15, 2018
|
Not sure if this is 100% relevant, but this change could have consequences for non-hardened users too:
|
|
I wonder how would this process "fix" the problem, and the fix should be applied to the templates at repository root. |
|
I feel uneasy disabling a protection put on Alpine. What causes this segfault? |
netaskd
changed the title
|
The more I think about this, the more I think this should be applied to downstream images because it's not a change that is universally needed. |
netaskd commentedAug 14, 2018
It's caused by gresec, it use jit for js, need exec for mmap, by default, this is not allowed, need add a pax header to disable MPROTECT.
original idea @wener:
https://jira.mongodb.org/browse/SERVER-31834?focusedCommentId=1720016&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-1720016