GraalVM Native Image环境下Spring Boot WebFlux应用无法加载Netty-tcnative OpenSSL库的问题排查求助

各位好，最近在优化Spring Boot WebFlux应用的SSL性能时踩了个坑，想请大家支支招：

我有一个基于Spring Boot WebFlux + Netty的应用，开启SSL后性能下降超出预期，所以打算尝试使用原生OpenSSL（依赖netty-tcnative）来优化性能。我自认为相关配置都已经正确设置了，但运行GraalVM原生镜像时，应用始终提示OpenSSL不可用，抛出了如下栈跟踪：

java.lang.IllegalArgumentException: Failed to load any of the given libraries: [netty_tcnative_linux_aarch_64, netty_tcnative_linux_aarch_64_fedora, netty_tcnative_aarch_64, netty_tcnative]
    at io.netty.util.internal.NativeLibraryLoader.loadFirstAvailable(NativeLibraryLoader.java:114)
    at io.netty.handler.ssl.OpenSsl.loadTcNative(OpenSsl.java:716)
    at io.netty.handler.ssl.OpenSsl.<clinit>(OpenSsl.java:110)
    at com.example.OpensslTestApplication.main(OpensslTestApplication.java:23)
    at java.base@21.0.7/java.lang.invoke.LambdaForm$DMH/sa346b79c.invokeStaticInit(LambdaForm$DMH)
Suppressed: java.lang.UnsatisfiedLinkError: Can't load library: /tmp/libnetty_tcnative_linux_aarch_6413650046406937568812.so
    at org.graalvm.nativeimage.builder/com.oracle.svm.core.jdk.NativeLibrarySupport.loadLibraryAbsolute(NativeLibrarySupport.java:100)
    at java.base@21.0.7/java.lang.ClassLoader.loadLibrary(ClassLoader.java:114)
    at java.base@21.0.7/java.lang.Runtime.load0(Runtime.java:852)
    at java.base@21.0.7/java.lang.System.load(System.java:2025)
    at io.netty.util.internal.NativeLibraryUtil.loadLibrary(NativeLibraryUtil.java:36)
    at io.netty.util.internal.NativeLibraryLoader.loadLibrary(NativeLibraryLoader.java:396)
    at io.netty.util.internal.NativeLibraryLoader.load(NativeLibraryLoader.java:218)
    at io.netty.util.internal.NativeLibraryLoader.loadFirstAvailable(NativeLibraryLoader.java:105)
    ... 4 more
Suppressed: java.lang.UnsatisfiedLinkError: Can't load library: /tmp/libnetty_tcnative_linux_aarch_6413650046406937568812.so
    at org.graalvm.nativeimage.builder/com.oracle.svm.core.jdk.NativeLibrarySupport.loadLibraryAbsolute(NativeLibrarySupport.java:100)
    at java.base@21.0.7/java.lang.ClassLoader.loadLibrary(ClassLoader.java:114)
    at java.base@21.0.7/java.lang.Runtime.load0(Runtime.java:852)
    at java.base@21.0.7/java.lang.System.load(System.java:2025)
    at io.netty.util.internal.NativeLibraryUtil.loadLibrary(NativeLibraryUtil.java:36)
    at java.base@21.0.7/java.lang.reflect.Method.invoke(Method.java:580)
    at io.netty.util.internal.NativeLibraryLoader$1.run(NativeLibraryLoader.java:430)
    at java.base@21.0.7/java.security.AccessController.executePrivileged(AccessController.java:129)
    at java.base@21.0.7/java.security.AccessController.doPrivileged(AccessController.java:319)
    at io.netty.util.internal.NativeLibraryLoader.loadLibraryByHelper(NativeLibraryLoader.java:422)
    at io.netty.util.internal.NativeLibraryLoader.loadLibrary(NativeLibraryLoader.java:388)
    ... 6 more

我已经做了一些排查：

• 用资源日志参数-H:Log=registerResource:3验证过，META-INF/native/libnetty_tcnative_linux_aarch_64.so确实已经被注册并包含在原生镜像中
• 从错误信息来看，程序能找到jar里的这个so文件，并且已经提取到/tmp目录下（文件名带随机后缀），但就是加载失败

我的构建和运行环境是：在M2 MacBook Air上构建镜像，用Rancher Desktop运行。

想请教大家：

1. 有没有什么调试方向或者排查技巧可以推荐？
2. GraalVM原生镜像环境下，理论上是可以使用原生OpenSSL的吧？

附上我的复现代码：

应用主类 #

@SpringBootApplication
@ImportRuntimeHints(OpensslTestApplication.NettyNativeRuntimeHints.class)
public class OpensslTestApplication {

    public static void main(String[] args) {
        System.setProperty("io.netty.native.workdir", "/tmp");
        if (!OpenSsl.isAvailable()) {
            System.err.println("❌ OpenSSL unavailable:");
            OpenSsl.unavailabilityCause().printStackTrace();
        } else {
            System.out.println("✅ OpenSSL available: " + OpenSsl.versionString());
        }
        SpringApplication.run(OpensslTestApplication.class, args);
    }

    static class NettyNativeRuntimeHints implements RuntimeHintsRegistrar {
        @Override
        public void registerHints(RuntimeHints hints, ClassLoader classLoader) {
            hints.jni().registerType(OpenSsl.class);
            hints.resources().registerPattern("META-INF/native/libnetty_tcnative_linux_aarch_64.so");
            hints.resources().registerPattern("test.p12");
        }
    }

    @Bean
    RouterFunction<ServerResponse> route() {
        return RouterFunctions.route(RequestPredicates.GET("/"),
                req -> ServerResponse.ok().body(Mono.just("Hello from native SSL!"), String.class)
        );
    }
}

build.gradle配置 #

import org.springframework.boot.gradle.plugin.SpringBootPlugin

plugins {
    id 'java'
    id 'org.springframework.boot' version '3.5.3'
    id 'org.graalvm.buildtools.native' version '0.10.6'
}

java {
    toolchain {
        languageVersion = JavaLanguageVersion.of(21)
    }
}

repositories {
    mavenCentral()
}

dependencies {
    implementation platform(SpringBootPlugin.BOM_COORDINATES)
    implementation 'org.springframework.boot:spring-boot-starter-webflux'
    implementation "io.netty:netty-tcnative-boringssl-static:2.0.72.Final:linux-aarch_64"
}

内容来源于stack exchange