Skip to content

fix: compile ffi from source per-runtime so AppSec loads on Ruby 3.2 #152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
zarirhamza wants to merge 1 commit into from
+26 −1
Closed

fix: compile ffi from source per-runtime so AppSec loads on Ruby 3.2 #152

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 26 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,9 @@ RUN echo "git_ref: $git_ref"
COPY . /var/task/datadog-lambda-rb
WORKDIR /var/task/datadog-lambda-rb
RUN apt-get update
RUN apt-get install -y gcc zip binutils
# `libffi-dev` + `make` are needed to compile the `ffi` gem from source
# below — see the rebuild step after the datadog gem install.
RUN apt-get install -y gcc zip binutils make libffi-dev pkg-config

# Install this gem
RUN gem build datadog-lambda
Expand All @@ -26,6 +28,29 @@ RUN set -eux; \
gem install ./datadog-*.gem --install-dir "/opt/ruby/gems/$runtime"; \
fi

# Force `ffi` to be (re)built from source in this per-runtime builder so
# the resulting `ffi_c.so` matches the target Lambda runtime's Ruby ABI
# exactly. The precompiled `ffi-x.y.z-x86_64-linux-gnu` gem shipped via
# rubygems ships ABI-specific subdirs (`lib/3.3/ffi_c.so`,
# `lib/3.4/ffi_c.so`, …) and `ffi 1.17` does NOT include a Ruby 3.2
# subdir. Without this step, dd-trace-rb 2.30's AppSec component (which
# `require`s libddwaf → ffi → ffi_c) crashes the function at boot on
# Ruby 3.2 when `DD_APPSEC_ENABLED=true`:
#
# Init<LoadError>: cannot load such file -- ffi_c
#
# Confirmed via a single-lambda sandbox repro on 2026-05-15
# (datadog-lambda-rb v3.28.0, Datadog-Ruby3-2:28 + DD_APPSEC_ENABLED=true).
# Same combo on Ruby 3.4 / 4.0 works because the precompiled package does
# bundle binaries for their ABIs, but compiling from source here is a
# permanent fix that's defensive against future `ffi` releases dropping
# additional Ruby ABIs from the precompiled bundle.
RUN set -eux; \
gem uninstall ffi --all --ignore-dependencies --executables --force \
--install-dir "/opt/ruby/gems/$runtime" || true; \
gem install ffi --platform=ruby \
--install-dir "/opt/ruby/gems/$runtime"

WORKDIR /opt
# Remove native extension debase-ruby_core_source (25MB) runtimes below Ruby 2.6
RUN rm -rf ./ruby/gems/$runtime/gems/debase-ruby_core_source*/
Expand Down