基于node:lts-alpine构建Docker镜像时OpenSSL识别失败求助

问题背景 #

尝试使用node:lts-alpine构建轻量级Docker镜像替代node:20.11.1-buster-slim（镜像大小约600MB），但构建过程中CMake无法识别已安装的OpenSSL，导致npm安装失败。

所用Dockerfile #

# FROM node:20.11.1-buster-slim
FROM node:lts-alpine

# Set environment variables
ENV ALLOW_CONFIG_MUTATIONS true
ENV DEBUG "libp2p:tcp,libp2p:websockets,libp2p:webtransport,libp2p:kad-dht,libp2p:dialer"
ENV OPENSSL_ROOT_DIR=/usr/include/openssl
ENV OPENSSL_LIB_DIR=/usr/lib

# Expose the required ports
EXPOSE 7002 7012

# Set the working directory
WORKDIR /usr/src/app

# Copy dependancies tree
COPY package*.json ./

# Install CMake, build tools, C++ compiler, Python3, and OpenSSL

RUN apk add --no-cache --virtual .build-deps alpine-sdk cmake python3 openssl-dev
    # Optionally, you can remove the build dependencies later if they are no longer needed
    # && apk del .build-deps

# Install the dependancies

RUN npm install

COPY . .

# Command to run on container startup
CMD ["npm", "start"]

错误信息 #

CMake Error at /usr/share/cmake/Modules/FindPackageHandleStandardArgs.cmake:230 (message):
137.3 npm ERR!   Could NOT find OpenSSL, try to set the path to OpenSSL root folder in the
137.3 npm ERR!   system variable OPENSSL_ROOT_DIR (missing: OPENSSL_CRYPTO_LIBRARY) (found
137.3 npm ERR!   version "3.1.4")
137.3 npm ERR! Call Stack (most recent call first):
137.3 npm ERR!   /usr/share/cmake/Modules/FindPackageHandleStandardArgs.cmake:600 (_FPHSA_FAILURE_MESSAGE)
137.3 npm ERR!   /usr/share/cmake/Modules/FindOpenSSL.cmake:668 (find_package_handle_standard_args)
137.3 npm ERR!   CMakeLists.txt:29 (find_package)

排查结果 #

手动进入node:lts-alpine镜像检查，确认OpenSSL相关文件和目录均存在：

Unable to find image 'node:lts-alpine' locally
lts-alpine: Pulling from library/node
4abcf2066143: Already exists 
9f16480e2ff5: Already exists 
092226d52cac: Already exists 
0493dfb2ff9c: Already exists 
Digest: sha256:bf77dc26e48ea95fca9d1aceb5acfa69d2e546b765ec2abfb502975f1a2d4def
Status: Downloaded newer image for node:lts-alpine
/ # apk update && apk add openssl-dev
fetch https://dl-cdn.alpinelinux.org/alpine/v3.19/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.19/community/x86_64/APKINDEX.tar.gz
v3.19.1-268-g03ce30a82dd [https://dl-cdn.alpinelinux.org/alpine/v3.19/main]
v3.19.1-270-g475f8d7e93f [https://dl-cdn.alpinelinux.org/alpine/v3.19/community]
OK: 22990 distinct packages available
(1/2) Installing pkgconf (2.1.0-r0)
(2/2) Installing openssl-dev (3.1.4-r5)
Executing busybox-1.36.1-r15.trigger
OK: 12 MiB in 19 packages
/ # find / -type f -name "libssl.so*" -o -name "libcrypto.so*"

/usr/lib/libcrypto.so.3
/usr/lib/libcrypto.so
/lib/libcrypto.so.3
/lib/libssl.so.3
/ # 
/ # find / -type d -name "openssl"
/usr/local/include/node/openssl
/usr/local/include/node/openssl/archs/linux-x86_64/asm/include/openssl
/usr/local/include/node/openssl/archs/linux-x86_64/asm_avx2/include/openssl
/usr/local/include/node/openssl/archs/linux-x86_64/no-asm/include/openssl
/usr/include/openssl

解决建议 #

1. 修正OpenSSL环境变量路径 #

原Dockerfile中OPENSSL_ROOT_DIR指向了头文件子目录，CMake需要的是包含include和lib的根目录，调整环境变量：

ENV OPENSSL_ROOT_DIR=/usr
ENV OPENSSL_LIB_DIR=/usr/lib
ENV OPENSSL_INCLUDE_DIR=/usr/include/openssl

2. 合并RUN命令并配置pkg-config路径 #

Dockerfile多行RUN会生成冗余镜像层，需用\连接命令；同时指定PKG_CONFIG_PATH帮助CMake定位库：

RUN apk add --no-cache --virtual .build-deps alpine-sdk cmake python3 openssl-dev \
    && export PKG_CONFIG_PATH=/usr/lib/pkgconfig:/usr/share/pkgconfig \
    && npm install \
    && apk del .build-deps

3. 多阶段构建优化镜像大小 #

将构建依赖与运行环境分离，进一步压缩最终镜像体积：

# 构建阶段：安装依赖并编译
FROM node:lts-alpine AS builder

WORKDIR /usr/src/app

COPY package*.json ./

RUN apk add --no-cache --virtual .build-deps alpine-sdk cmake python3 openssl-dev \
    && export OPENSSL_ROOT_DIR=/usr \
    && npm install

COPY . .

# 运行阶段：仅保留运行所需文件
FROM node:lts-alpine

WORKDIR /usr/src/app

COPY --from=builder /usr/src/app .

ENV ALLOW_CONFIG_MUTATIONS true
ENV DEBUG "libp2p:tcp,libp2p:websockets,libp2p:webtransport,libp2p:kad-dht,libp2p:dialer"

EXPOSE 7002 7012

CMD ["npm", "start"]

4. 尝试使用Node.js自带的OpenSSL #

Node.js镜像内置OpenSSL，可指定CMake使用该版本：

ENV OPENSSL_ROOT_DIR=/usr/local/include/node/openssl
ENV OPENSSL_LIB_DIR=/usr/local/lib

内容的提问来源于stack exchange，提问作者Matias Salimbene