Support OpenSSL 3.0 for Alpine Linux

[carlocorradini]

OpenSSL 3.0 is currently the default OpenSSL version in Alpine Linux 3.17 (see CHANGELOG).
For Alpine Linux, Prisma only supports OpenSSL 1.X at this time.
As a result, the following error is generated:

Error: Unable to establish a connection to query-engine-node-api library. It seems there is a problem with your OpenSSL installation!
Details: Unable to require(`OMITTED/node_modules/prisma/libquery_engine-linux-musl.so.node`)
 Error loading shared library libssl.so.1.1: No such file or directory (needed by OMITTED/node_modules/prisma/libquery_engine-linux-musl.so.node)
[Context: getDmmf]

Suggested solution

Add OpenSSL 3.0 support to Alpine Linux

Workaround

Install openssl1.1-compat:

apk add openssl1.1-compat

Note that this is only a temporary fix until the Prisma team adds support for OpenSSL 3.0.

[rene-demonsters]

Running into the same issue here. Our gitlab-ci started failing because the docker:latest base image got updated to Alpine 3.17.

[carlocorradini]

Running into the same issue here. Our gitlab-ci started failing because the docker:latest base image got updated to Alpine 3.17.

Yes, errors are beginning to appear 😅

[rene-demonsters]

I probably need to swap out docker:latest for docker:20.10.21-dind-alpine3.16 or docker:20.10.21-alpine3.16. Currently trying the former. Will update this message once I've figured it out but this might help people already in the mean time.

Tags from: https://hub.docker.com/_/docker/tags?page=1&name=alpine3.16

(Note: Our gitlab runners are Docker based, hence Docker in Docker image)

Edit: For us docker:20.10.21-dind-alpine3.16 works, but as mentioned our runners are Docker based, so might have to try both. Good luck!

[carlocorradini]

Workaround, install openssl1.1-compat

apk add openssl1.1-compat

[claudiowilson]

Running into this as well!

[CooperBills]

We're hitting this as well. The official docker node image just bumped all their alpine images to Alpine v3.17 a few hours ago, which bundles OpenSSL 3.0 instead of 1.1

[solarisn]

We're hitting this as well. The official docker node image just bumped all their alpine images to Alpine v3.17 a few hours ago, which bundles OpenSSL 3.0 instead of 1.1

Same issue here. This broke our CI today and took some time to track down. Now that the Alpine version of the official docker node image uses Alpine v3.17 (as of today) I think a lot of people are going to start running into this issue.

[tkuye]

Just ran into this as well.

[carlocorradini]

What I feared... 😅

[Martinsos]

Same here, some extra information for context:

Error: Unable to establish a connection to query-engine-node-api library. It seems there is a problem with your OpenSSL installation!
Details: Unable to require(`/app/server/node_modules/prisma/libquery_engine-linux-musl.so.node`)
 Error loading shared library libssl.so.1.1: No such file or directory (needed by /app/server/node_modules/prisma/libquery_engine-linux-musl.so.node)
[Context: getConfig]

Prisma CLI Version : 4.5.0

OpenSSL 3.0.7 1 Nov 2022 (Library: OpenSSL 3.0.7 1 Nov 2022)

node:18-alpine

[dgreen-ledger]

Hit the same problem also today
node_version=16-alpine

[nilennoct]

Use FROM node:XX-alpine3.16 to temporarily fix.

[Suniron]

Use apk add openssl1.1-compat In the Dockerfile or the CI steps fix the problem for me

[screamcha]

Use apk add openssl1.1-compat In the Dockerfile or the CI steps fix the problem for me

This unfortunately didn't help, prisma performed migrations but threw error on attempt to call prisma.$queryRaw(...). Binding alpine version to 3.16 fixed the issue for me.

[aqrln]

@screamcha

This unfortunately didn't help, prisma performed migrations but threw error on attempt to call prisma.$queryRaw(...). Binding alpine version to 3.16 fixed the issue for me.

Did you get the same error as in the original post when running prisma.$queryRaw after installing openssl1.1-compat or a different error?

[aqrln]

@screamcha also, which database are you using?

[bobbylkchao]

By adding RUN apk add --update --no-cache openssl1.1-compat to docker file, it works to us. Thanks @carlocorradini 👍

prisma: 4.1.1
@prisma/client: 4.1.1
Docker image we are using: FROM marketplace.gcr.io/google/centos7:latest
Database: postgresql
Prisma configurations:

generator client {
  provider      = "prisma-client-js"
  output        = "client"
  binaryTargets = ["native", "linux-musl"]
}
datasource db {
  provider = "postgresql"
  url      = env("xx")
}

[jkomyno]

Update: as of prisma@4.8.0 (released on December 20th 2022), the procedure below is no longer needed, as Prisma now supports OpenSSL 3 on Linux Alpine out of the box.

---

Hey everyone, Alberto from Prisma here.

Prisma currently needs OpenSSL 1.1.x being installed as a system library on Linux Alpine.
For many of you, Prisma suddenly stopped working when run on the node:alpine / node:lts-alpine Docker images. This is because these images are now based on alpine:3.17 (which comes with OpenSSL 3.0.x) rather than alpine:3.16 (which comes with OpenSSL 1.1.x).

You currently have two alternatives:

• Use a Node.js Docker image based on Alpine 3.16, like node:alpine3.16, node:lts-alpine3.16, node:18.12.1-alpine3.16 (encouraged)

• Install OpenSSL 1.1.x via the openssl1.1-compat package, e.g., by adding

  RUN apk add --update --no-cache openssl1.1-compat

  to your Dockerfile before installing Prisma

We're also working on a solution on our side to provide native compatibility with OpenSSL 3, which will close this issue altogether. We thank you for your patience.

---

About the original error listed at the top of this issue:

Error: Unable to establish a connection to query-engine-node-api library. It seems there is a problem with your OpenSSL installation!
Details: Unable to require(`OMITTED/node_modules/prisma/libquery_engine-linux-musl.so.node`)
 Error loading shared library libssl.so.1.1: No such file or directory (needed by OMITTED/node_modules/prisma/libquery_engine-linux-musl.so.node)
[Context: getDmmf]

• The error Unable to establish a connection to query-engine-node-api library. It seems there is a problem with your OpenSSL installation! means that Prisma cannot interact with its own engines (which are compiled libraries or binaries compatible), most likely due to Prisma not being able to find OpenSSL on your system.
• The Error loading shared library libssl.so.1.1 error indeed shows that Prisma cannot find OpenSSL 1.1 in the system, which prevents commands like prisma generate and the Prisma Client from working as expected.

---

Here is a minimal Dockerfile example based on node:alpine you can use to run Prisma!

# Dockerfile for running Prisma on Linux Alpine 3.17+

# change with the Node.js version of your choice
ARG NODE_VERSION="18.12.1"

# change with the Linux Alpine version of your choice
ARG ALPINE_VERSION="3.17"

FROM node:${NODE_VERSION}-alpine${ALPINE_VERSION} AS base

# install OpenSSL 1.1.x, needed for Linux Alpine 3.17+
RUN apk update \
  && apk add openssl1.1-compat

ENV DATABASE_URL ""
WORKDIR /app

# install your project dependencies
COPY package.json ./
RUN npm i

# copy your project files and Prisma schema
COPY . ./

RUN npx prisma version

Notes:

• we recommend you to always pin Docker images to a specific version, to ensure reproducible builds
• we've noticed some comments in similar issues suggesting to install libc on Linux Alpine to fix the problem. Please DON'T do this, as it could cause other unexpected errors.

[aqrln]

Support for OpenSSL 3 in Alpine Linux for x86_64 will be released today (CET) in Prisma 4.8.0. Please let us know if you still run into any issues with 4.8.0!

[Jolg42]

https://github.com/prisma/prisma/releases/tag/4.8.0 is published on npm

Let us know if it solves your problems, if you still have a problem after upgrading, please create a new issue, we'll be interested to check that!

[EyadAlghamdi]

it worked perfectly for me,
but i had to add linux-musl-openssl-3.0.x to my binaryTargets to make it work.

[aqrln]

@EyadAlghamdi

but i had to add linux-musl-openssl-3.0.x to my binaryTargets to make it work.

Do you generate the client on a different system before deploying it on Alpine?

[capaj]

@aqrln does that mean we can omit the openssl step like this in dockerfile now?

# Dockerfile for running Prisma on Linux Alpine 3.17+

# change with the Node.js version of your choice
ARG NODE_VERSION="18.12.1"

# change with the Linux Alpine version of your choice
ARG ALPINE_VERSION="3.17"

FROM node:${NODE_VERSION}-alpine${ALPINE_VERSION} AS base

ENV DATABASE_URL ""
WORKDIR /app

# install your project dependencies
COPY package.json ./
RUN npm i

# copy your project files and Prisma schema
COPY . ./

RUN npx prisma version

[aqrln]

@capaj yes

[jkomyno]

@EyadAlghamdi could you please open a new issue posting your Prisma schema, describing the steps you took to run Prisma on your system, and why the binaryTargets attribute was needed?

[devdrqgon]

Support for OpenSSL 3 in Alpine Linux for x86_64 will be released today (CET) in Prisma 4.8.0. Please let us know if you still run into any issues with 4.8.0!

Unfortunately still running in the same issu. I tried many node versions. I also tried RUN apk add --update --no-cache openssl1.1-compat

Error: Unable to establish a connection to query-engine-node-api library. It seems that the current architecture arm64 is not supported, or that libc is missing from the system. #9 1.651 Details: Unable to require(/app/node_modules/prisma/libquery_engine-linux-arm64-openssl-1.1.x.so.node) #9 1.651 Error loading shared library ld-linux-aarch64.so.1: No such file or directory (needed by /app/node_modules/prisma/libquery_engine-linux-arm64-openssl-1.1.x.so.node) #9 1.651 [Context: getDmmf] #9 1.651 #9 1.651 Prisma CLI Version : 4.8.0

[jkomyno]

Hey @devdrqgon, you're seeing that error because you're trying to run Prisma on Linux Alpine running on the arm64 architecture. For Linux Alpine, only the amd64 / x86_64 architecture is supported natively.

You can still run Prisma by asking Docker to handle the architecture emulation for you, by running this command on your arm64 system (which I guess is a macOS with M1/M2 CPU):

docker buildx build --load -f Dockerfile --platform=linux/amd64 .

Please refer to this comment for additional context.