opa binary in 0.25.0-debug docker image is sensitive to working directory

[nairb774]

Expected Behavior

That running the following will allow checking the formatting of rego files (used in CI)

$ docker run --rm \
  --volume $PWD:/test \
  --workdir /test \
  openpolicyagent/opa:0.25.0-debug@sha256:b39280c50cded838266f52ce5a8c80529225eecda92eeafa1c3561605ab2e5b1 \
  fmt --list .

Actual Behavior

Running the image results in the following error:

/opa: error while loading shared libraries: libwasmer.so: cannot open shared object file: No such file or directory.

This can also be triggered with the non-debug container as well, but the debug container is used in our CI as it has a shell that CircleCI uses for running CI steps.

Steps to Reproduce the Problem

Run the above command from a directory containing rego files to check the formatting on. The actual rego contents, I hope, aren't really that important as the binary doesn't seem to even be getting to main.

The important part to call out about the above command is the use of --workdir to change the current working directory to something other than the default /.

Additional Info

Pulling the opa binary apart with readelf it looks like the the RUNPATH is using a relative path:

Dynamic section at offset 0x10aede8 contains 27 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libpthread.so.0]
 0x0000000000000001 (NEEDED)             Shared library: [libwasmer.so]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x000000000000001d (RUNPATH)            Library runpath: [./:/go/src/github.com/open-policy-agent/opa/vendor/github.com/wasmerio/go-ext-wasm/wasmer]
 0x000000000000000c (INIT)               0x404000
 0x000000000000000d (FINI)               0xbf3414
 0x0000000000000019 (INIT_ARRAY)         0x14afdd8
 0x000000000000001b (INIT_ARRAYSZ)       8 (bytes)
 0x000000000000001a (FINI_ARRAY)         0x14afde0
 0x000000000000001c (FINI_ARRAYSZ)       8 (bytes)
 0x000000006ffffef5 (GNU_HASH)           0x4003a8
 0x0000000000000005 (STRTAB)             0x401da8
 0x0000000000000006 (SYMTAB)             0x4007b8
 0x000000000000000a (STRSZ)              5042 (bytes)
 0x000000000000000b (SYMENT)             24 (bytes)
 0x0000000000000015 (DEBUG)              0x0
 0x0000000000000003 (PLTGOT)             0x14b0000
 0x0000000000000002 (PLTRELSZ)           2496 (bytes)
 0x0000000000000014 (PLTREL)             RELA
 0x0000000000000017 (JMPREL)             0x4033c8
 0x0000000000000007 (RELA)               0x403380
 0x0000000000000008 (RELASZ)             72 (bytes)
 0x0000000000000009 (RELAENT)            24 (bytes)
 0x000000006ffffffe (VERNEED)            0x403330
 0x000000006fffffff (VERNEEDNUM)         2
 0x000000006ffffff0 (VERSYM)             0x40315a
 0x0000000000000000 (NULL)               0x0

which makes running the binary sensitive to the current working directory. Ideally the location of libwasmer.so would be in a location referenced with an absolute path so the binary can be run from any directory.

[tsandall]

Thanks for filing this @nairb774! It should be a relatively simple fix. I'll take a look tomorrow.

[nairb774]

Thank you!