How to get rid of cryptography build error?

Question

I am trying to build a dockerfile but the problem is when it trying to build specifically cryptography is not building.

MY Dockerfile

FROM python:3.7-alpine

ENV PYTHONUNBUFFERED 1

RUN apk update \
  # psycopg2 dependencies
  && apk add --virtual build-deps gcc python3-dev musl-dev\
  && apk add postgresql-dev \
  && apk add build-base \
  # Pillow dependencies
  && apk add jpeg-dev zlib-dev freetype-dev lcms2-dev openjpeg-dev tiff-dev tk-dev tcl-dev \
  # CFFI dependencies
  && apk add libffi-dev py-cffi \
  # Translations dependencies
  && apk add gettext \
  # https://docs.djangoproject.com/en/dev/ref/django-admin/#dbshell
  && apk add postgresql-client \
  # cairo
  && apk add cairo cairo-dev pango-dev gdk-pixbuf-dev poppler-utils

# fonts for weasyprint
RUN mkdir ~/.fonts
COPY ./fonts/* /root/.fonts/

# secret key (should be in docker-secrets, or we need to run minikube locally
RUN mkdir /etc/secrets
COPY secret.readme proxy_rsa_key* /etc/secrets/

# Requirements are installed here to ensure they will be cached.
COPY ./requirements /requirements
RUN pip install -r /requirements/local.txt

COPY ./compose/local/django/entrypoint /entrypoint
RUN sed -i 's/\r//' /entrypoint
RUN chmod +x /entrypoint

COPY ./compose/local/django/start /start
RUN sed -i 's/\r//' /start
RUN chmod +x /start

COPY ./compose/local/django/celery/worker/start /start-celeryworker
RUN sed -i 's/\r//' /start-celeryworker
RUN chmod +x /start-celeryworker

COPY ./compose/local/django/celery/beat/start /start-celerybeat
RUN sed -i 's/\r//' /start-celerybeat
RUN chmod +x /start-celerybeat

COPY ./compose/local/django/celery/flower/start /start-flower
RUN sed -i 's/\r//' /start-flower
RUN chmod +x /start-flower

WORKDIR /app

ENTRYPOINT ["/entrypoint"]

when I try to build my dockerfile it shows:

Building wheel for cryptography (PEP 517): finished with status 'error'
  ERROR: Command errored out with exit status 1:
  
  error: Can not find Rust compiler
  ----------------------------------------
  ERROR: Failed building wheel for cryptography

I tried to solve but i couldn't. I am newbie in docker.Please help how to get rid of this problem.

Theurgy

Answer 1

Since the error is...

error: Can not find Rust compiler

...the solution is to install the rust compiler. You'll also need cargo, the Rust package manager, and it looks like your Dockerfile is missing openssl-dev.

The following builds successfully for me:

FROM python:3.7-alpine

ENV PYTHONUNBUFFERED 1

RUN apk add --update \
  build-base \
  cairo \
  cairo-dev \
  cargo \
  freetype-dev \
  gcc \
  gdk-pixbuf-dev \
  gettext \
  jpeg-dev \
  lcms2-dev \
  libffi-dev \
  musl-dev \
  openjpeg-dev \
  openssl-dev \
  pango-dev \
  poppler-utils \
  postgresql-client \
  postgresql-dev \
  py-cffi \
  python3-dev \
  rust \
  tcl-dev \
  tiff-dev \
  tk-dev \
  zlib-dev

RUN pip install cryptography

Note that the above apk add ... command line is largely the same as what you've got; I've just simplified the multiple apk add ... statements into a single apk add execution.

Leif

Oh, but also see this exciting issue: github.com/pyca/cryptography/issues/5771 – Leif

Thanks. The problem is now solved. Btw can you tell me what cargo and rust do? – Theurgy

rust is a compiled language that cryptography is using because it is more memory-safe than C. cargo is the rust package manager. – Leif

you will also need to use a newer version of alpine that has the minimum required rust version (>= v1.41.0 as of github.com/pyca/cryptography/issues/5771#issuecomment-775990406 ). which is alpine 3.12 or later: pkgs.alpinelinux.org/packages?name=rust&branch=v3.12 – Dither

...assuming you are determined not to install Rust :) – Lunik

Unfortunately, it does not work for me due to the conflicting Rust version. Amazon EC2 yum based installation old version – Cameroncameroon

Answer 2

cryptography < 3.5:

You can skip the rust installation and other related dependencies by adding the line below before apk add commands:

ENV CRYPTOGRAPHY_DONT_BUILD_RUST=1

cryptography >= 3.5: Thanks @riptusk331

After this version rust will be required. Either install a specific version <3.5 or follow cryptography installation instructions. It is stated in the attached link that they are very aggressively explained in the docs.

Rajkot

After spending a whole day looking at a whole new set of weird problems, this fixed my problem. Thanks a lot!!! – Crenulation

While this may fix some folks' immediate problems, this is a bad answer that sets people up for future issues. If you're going to suggest bypassing the Rust build entirely, can you explain why? OP is using the 3.7-alpine image, which supports Rust (it's Alpine v3.13). As @larsks suggests in their answer, just install the compiler & package manager (rust and cargo) and this works fine. Cryptography 3.5+ will start requiring Rust...so you're just punting the issue here. – Stereopticon

@Stereopticon Most need cryptography as a dependency library meaning not using the library directly. I don't know what rust provides to cryptography. Ignoring it solved my issue so I went ahead and did it. Cryptography developers might have their reasons to make rust dependency required. What I do not understand is why I must manually ensure a child dependency is installed while I am installing a dependency myself. If that process was automated I would not take the time to disable it. – Rottenstone

Answer 3

pip install -U pip is what all I had to do

Charmine

Answer 4

Some people might come here (Like I did) looking for a fix just for Python, not necessarily Alpine.

Several options are available, mentioned in the github issue. (only pick one of these)

1. You can install rust, as another answer mentioned
2. You can downgrade your cryptography version to 3.4.x
3. You can upgrade to pip version 19.1.1 or higher, which installs precompiled packages

Lunik

I'm using pip 21.0.1 and it fails to build. I don't even want to build it... I'm just installing wheel but it has cryptography as dependency. – Galimatias

Hmm... There's a nice chicken / egg problem! I tried it myself with a completely fresh (and recent) Python installation. pip install --upgrade cryptography==3.4.6 --no-binary cryptography produced the expected error. But running pip install wheel worked just fine. In fact, it installed it using wheel, so I'm suspicious that it might have wheel by default. Have you attempted a fresh python installation? – Lunik

#3 does not work on alpine – Orcinol

Answer 5

I faced the same issue and in order to resolve it I tried out the following:

1. Answer provided by @larsks. RUN apk add cargo openssl-dev helped. But this resulted in a huge image size for me (>1GB). Best practice is to always target the bare-minimum with a small image size. This way, we don't expose ourselves to any external vulnerabilities.

2. Answer provided by Sabri Özgür, ENV CRYPTOGRAPHY_DONT_BUILD_RUST=1. This worked great!

3. Based on the comment added by @riptusk331 for the earlier answer, simply ignoring the Rust build may only work for now, as Cryptography 3.5+ will start requiring Rust.

My solution just to be safe was;

...
ENV CRYPTOGRAPHY_DONT_BUILD_RUST=1
...
RUN pip install cryptography==3.4.6 
...

This way, I managed to keep the image size at a considerably lower value while getting the build to pass.

Wards

As stated in the docs (last paragraph cryptography.io/en/latest/installation), rust is only used to build cryptography. Once it's built you can delete rust (and cargo) again. – Ramification

Answer 6

For me (host is an Apple Silicon ARM Mac, running in Alpine Docker), I had to do:

# upgrade pip
pip install --upgrade pip

# install rust toolchain
curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain stable -y
PATH="/root/.cargo/bin:${PATH}"

# build from source
pip install cryptography --no-cache-dir --only-binary=:all: --force-reinstall --upgrade

Leucotomy

Answer 7

Editing pyvenv.cfg by adding in my .env:

CRYPTOGRAPHY_DONT_BUILD_RUST=1

then doing pip install cryptography, solved my issue.

Tearing

Answer 8

A solution that worked for me was to upgrade pip as the documentation recommends, the first step to try to fix it is to update pip.

If you are having issues installing cryptography the first troubleshooting step is to upgrade pip and then try to install again. For most users this will take the form of pip install -U pip, but on Windows you should do python -m pip install -U pip. If you are still seeing errors after upgrading and trying pip install cryptography again, please see the Installation documentation.

pip's newer versions come with cryptography's wheel pre-built, so you do not have to deal with building it.

I'm using python:3.9.5-alpine and to upgrade pip just add to your Dockerfile:

RUN pip install --upgrade pip

Theriot

Answer 9

Just install the rust compiler and put it in the environment.

Here is a simple example of Dokerfile:

FROM python:3.9

# Install Rust
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
ENV PATH="/root/.cargo/bin:${PATH}"

COPY . /app

WORKDIR /app

# Install the requirement that may need rust
RUN pip install -r requirements.txt

CMD ["python", "app.py"]

Detta