Where is libgcrypt used?

[alex-rowe]

When running strace and lsof we can see libgcrypt.so being called. In the source, I can only find references to it being installed in Dockerfile's.

From lsof

/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4

Is it possible to build fluent-bit without libgcrypt and only use the OpenSSL implementation? If so, what flags need to be configured at build time?

[patrick-stephens]

It's probably a dependency of one of the other dependencies, an ldd can show you to figure it out.
My suspicion would be a Kafka or Postgres dependency as those seem to be the usual suspects. You can potentially disable the plugin that uses it.

[alex-rowe]

ldd didn't but lddtree showed it was coming from libsystemd.so

root@c798cf06b513:~# lddtree /fluent-bit/bin/fluent-bit
fluent-bit => /fluent-bit/bin/fluent-bit (interpreter => /lib64/ld-linux-x86-64.so.2)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0
    libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2
    libyaml-0.so.2 => /usr/lib/x86_64-linux-gnu/libyaml-0.so.2
    libsystemd.so.0 => /usr/lib/x86_64-linux-gnu/libsystemd.so.0
        librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1
        libgcrypt.so.20 => /usr/lib/x86_64-linux-gnu/libgcrypt.so.20
            libgpg-error.so.0 => /lib/x86_64-linux-gnu/libgpg-error.so.0

Removing that plugin then removes libgcrypt but then we also lose the ability to use systemd/journald inputs.

It would be good to keep the OpenSSL library for systemd but remove the libgcrypt library if it's not needed.

[patrick-stephens]

Fluent Bit has no control over libsystemd - it's a dependency (from the distroless base image repos) and likely required for some functionality it uses (maybe?).
If you mean you want to make a custom image that removes the dependency manually then give it a go, I don't think that's something the OSS project could countenance as a sustainable option with all the unknown impact it might have.