Hacker News Reader

Comment by e12e | Hacker News Reader

I was recently surprised by this, when I tried to run a simple go web server in a chroot -- Apparently go defaults to dynamically linking to the host c libraries for domain lookups (partly this has to do with it being hard to do this with static code on OS X apparently).

The upshot is that while "go build" might be expected to create a static binary (that should be easy to run in a chroot) -- in practice it won't unless you manually rebuild your go toolchain, passing in a parameter to avoid cgo/linking to c libraries for name lookup.

View on HN

if you build with CGO_ENABLED=0 then you'll have fully static go binaries on osx (but TLS won't work)

TLS will work, you just can't pull the host CA bundle (osx keeps it in the keychain), so certificate verification won't work without proving your own.

It's my understanding that you have to do this on Linux as well, and it isn't enough to just build your project with CGO_ENABLED=0, you'll also have to rebuild the go-toolchain with CGO_ENABLED=0 for it to work. But perhaps this has changed in recent versions of go?

Eg:

    cd /tmp
    git clone git@github.com:apg/wipes.git wipes.git
    cd wipes.git/
    go get github.com/gorilla/websocket
    go get github.com/gorilla/websocket
    go build
    ldd wipes.git
    # > libc.so.6 among others
    export CGO_ENABLED=0
    go build  # makes no difference, produces identical binary

Afaik, in this case it's 'net/http' that pulls in a dependency on cgo (again, unless we rebuild the whole go toolchain with cgo_enabled=0).

Not that this is terrible as such, but it's a gotcha if you want to run the resulting binary in a chroot, or on a host with a different version of libc...

> But perhaps this has changed in recent versions of go?

it hasn't. i meant 'if you build go with CGO_ENABLED=0' but was unclear.

  > Afaik, in this case it's 'net/http' that pulls in a 
  > dependency on cgo (again, unless we rebuild the whole
  > go toolchain with cgo_enabled=0).

You can also build with '-tags netgo'[1], and use go for name resolution, but still use cgo for when else you may need it.

[1]: http://dominik.honnef.co/go-tip/2013-09-07/#netgo

Indeed:

    go install -a -tags netgo std
    go build -tags netgo
    ldd wipes.git
        not a dynamic executable

Thanks for the tip :)

Reply on news.ycombinator.com