Unable to move past Ubuntu 22.04 #17359

weaversa · 2025-04-09T17:55:21Z

weaversa
Apr 9, 2025

I'm having an issue related to #15825. As in #15825, I am unable to start a Coder workspace using an Ubuntu image newer than 22.04, but (per #15423) the remediation seems to be to "Improve agent connection troubleshooting". The issue (for me) runs deeper in that, when using a working Coder image, I also cannot curl or wget an https url when docker running a newer Ubuntu image.

For example:

Ubuntu 22.04 (success)

$ docker run --rm -it ubuntu:22.04
# apt update && apt install -y curl ; curl --version ; curl https://www.google.com > /dev/null ; echo $?
...
curl 7.81.0 (x86_64-pc-linux-gnu) libcurl/7.81.0 OpenSSL/3.0.2 zlib/1.2.11 brotli/1.0.9 zstd/1.4.8 libidn2/2.3.2 libpsl/0.21.0 (+libidn2/2.3.2) libssh/0.9.6/openssl/zlib nghttp2/1.43.0 librtmp/2.3 OpenLDAP/2.5.18
Release-Date: 2022-01-05
...
0

Ubuntu 24.04 (failure)

$ docker run --rm -it ubuntu:24.04
# apt update && apt install -y curl ; curl https://www.google.com > /dev/null ; echo $?
...
curl 8.5.0 (x86_64-pc-linux-gnu) libcurl/8.5.0 OpenSSL/3.0.13 zlib/1.3 brotli/1.1.0 zstd/1.5.5 libidn2/2.3.7 libpsl/0.21.2 (+libidn2/2.3.7) libssh/0.10.6/openssl/zlib nghttp2/1.59.0 librtmp/2.3 OpenLDAP/2.6.7
Release-Date: 2023-12-06, security patched: 8.5.0-2ubuntu10.6
...
curl: (35) Insufficient randomness
35

Ubuntu 24.10 (failure)

$ docker run --rm -it ubuntu:24.10
# apt update && apt install -y curl ; curl https://www.google.com > /dev/null ; echo $?
...
curl 8.9.1 (x86_64-pc-linux-gnu) libcurl/8.9.1 OpenSSL/3.3.1 zlib/1.3.1 brotli/1.1.0 zstd/1.5.6 libidn2/2.3.7 libpsl/0.21.2 libssh2/1.11.0 nghttp2/1.62.1 librtmp/2.3 OpenLDAP/2.6.8
Release-Date: 2024-07-31, security patched: 8.9.1-2ubuntu2.2
...
curl: (35) Insufficient randomness
35

And an example wget failure:

# wget https://www.google.com
--2025-04-09 17:05:46--  https://www.google.com/
Could not seed PRNG; consider using --random-file.
OpenSSL: error:12800067:DSO support routines::could not load the shared library
OpenSSL: error:12800067:DSO support routines::could not load the shared library
OpenSSL: error:07880025:common libcrypto routines::reason(37)
OpenSSL: error:0308010C:digital envelope routines::unsupported
OpenSSL: error:12000090:random number generator::unable to fetch drbg
Disabling SSL due to encountered errors.

Per the curl discussion here: curl/curl#11022
@anthonyryan1 reported success recompiling curl using version 3.1.1 of OpenSSL. @nhorman resolved a partner issue for OpenSSL here: openssl/openssl#20826 with the message

associated curl discussion seems to have resolved this with a libcurl update

marking as inactive, will be closed at the completion of 3.4 dev without further input

Some issues with this resolution:

I assume that since both curl and wget are affected, anything that uses OpenSSL is affected. None of the newer Ubuntu images use PPAs with packages where apt install contains a fix. It is onerous to require individuals to recompile every affected tool off of OpenSSL 3.1.1 (I did not verify @anthonyryan1's fix works).
If a fix was made in OpenSSL 3.1.1, it has since regressed. The ubuntu:24.10 test above shows curl failing even though compiled with OpenSSL 3.3.1.

I'm not claiming the problem is inherently a Coder problem, nor an AWS, OpenSSL, curl, or wget, etc. problem. But, I want to raise this issue somewhere, and I would like to be able to use newer versions of Ubuntu with Coder, so I made the issue here. All that said, I understand fixing the underlying issue is a bit of a Hail Mary.

Answered by podhrmic

Sep 1, 2026

FYI the issue seems to be resolved now (tested with Ubuntu 24.04)

View full answer

matifali · 2025-04-09T17:59:29Z

matifali
Apr 9, 2025
Maintainer

@mafredri I think you faced a similar issue.

0 replies

mafredri · 2025-04-10T15:35:48Z

mafredri
Apr 10, 2025
Collaborator

@matifali I haven't seen this myself. And I can't reproduce it either so I'm guessing this is related to the environment or host Docker is running on.

Just in case, it might be worth doing docker pull ubuntu:24.04; docker pull ubuntu:24.10 to ensure the latest image is used, but other than that I don't know what we can do about this.

Since I can't reproduce, I can't try this out, but what happens if you use busybox instead of curl @weaversa?

apt update
apt install --yes busybox ca-certificates
busybox wget -O- https://www.google.com

0 replies

matifali · 2025-04-11T10:41:40Z

matifali
Apr 11, 2025
Maintainer

I will move this to a discussion it's not a Coder issue.

0 replies

tonyj13 · 2025-10-13T19:48:22Z

tonyj13
Oct 13, 2025

Just want to add a datapoint: I'm experiencing the exact same problem. Host is RHEL 10 (fresh install) with FIPS enabled. Get the exact same error on Ubuntu 24.04.3 LTS (ubuntu:latest), but do not get the same error on Ubuntu 22.04. I'm using podman instead of docker for managing my containers.

0 replies

podhrmic · 2026-09-01T22:59:17Z

podhrmic
Sep 1, 2026

FYI the issue seems to be resolved now (tested with Ubuntu 24.04)

0 replies

Navigation Menu

Uh oh!

Unable to move past Ubuntu 22.04 #17359

Uh oh!

{{title}}

Uh oh!

Replies: 5 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Unable to move past Ubuntu 22.04 #17359

Uh oh!

weaversa Apr 9, 2025

Replies: 5 comments

Uh oh!

matifali Apr 9, 2025 Maintainer

Uh oh!

mafredri Apr 10, 2025 Collaborator

Uh oh!

matifali Apr 11, 2025 Maintainer

Uh oh!

tonyj13 Oct 13, 2025

Uh oh!

podhrmic Sep 1, 2026

weaversa
Apr 9, 2025

matifali
Apr 9, 2025
Maintainer

mafredri
Apr 10, 2025
Collaborator

matifali
Apr 11, 2025
Maintainer

tonyj13
Oct 13, 2025

podhrmic
Sep 1, 2026