Docker在Alpine Linux中安装Python cryptography包失败问题排查

Absolutely, your hunch is 100% correct—using the python:3-alpine tag absolutely can cause this sudden failure, and here's a breakdown of what's going on and how to fix it:

Why This Happens #

The python:3-alpine image tag is a rolling, latest tag—every time you run docker build, it pulls the most recent version of Python 3.x based on the latest Alpine Linux release. Alpine frequently updates its system libraries (like libressl, which cryptography depends on), and if your requirements.txt doesn't pin a compatible cryptography version, the old version you were using may no longer compile against the updated system libraries.

Your error log confirms this: the compilation fails when building the OpenSSL bindings for cryptography, which is a common symptom when system SSL libraries change out from under a fixed version of the package.

How to Fix It #

You have a few solid options to resolve this, ordered by recommendation:

1. Pin the Alpine-based Python image to a specific version (Most Reliable) #

Instead of using the generic python:3-alpine, lock your base image to a specific, stable version that matches what was working when your builds succeeded. For example, if your last successful build used Python 3.6 on Alpine 3.18, update your Dockerfile:

FROM python:3.6-alpine3.18  # Replace with the exact version you know works
ENV PYTHONUNBUFFERED 1
WORKDIR /usr/src/app
RUN apk add --no-cache gcc mailcap python3-dev build-base linux-headers pcre-dev postgresql-dev libffi-dev libressl-dev
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

To find the exact version you previously used, run docker inspect <your-working-image-id> and look for the From field in the output—it will show the specific tagged image.

2. Update cryptography to a version compatible with the latest Alpine libraries #

If you want to keep using the latest python:3-alpine, update your requirements.txt to specify a newer cryptography version that supports the updated system libraries. For example:

cryptography>=41.0.0  # Check the cryptography release notes for the minimum compatible version

Newer versions of cryptography are regularly updated to support changes in system SSL libraries, so this should resolve the compilation errors.

3. Switch to a non-Alpine base image (Avoid Compilation Headaches) #

Alpine uses musl libc instead of glibc, which means many Python packages (including cryptography) need to be compiled from source rather than using pre-built wheels. If you want to avoid these compilation issues entirely, switch to a Debian-based slim image like python:3-slim:

FROM python:3.6-slim
ENV PYTHONUNBUFFERED 1
WORKDIR /usr/src/app
# Replace Alpine's apk with Debian's apt-get
RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc python3-dev build-essential libpcre3-dev libpq-dev libffi-dev libssl-dev \
    && rm -rf /var/lib/apt/lists/*  # Clean up to keep image size small
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

Debian-based images have more pre-built wheels available, so builds are faster and less prone to system library compatibility issues.

Quick Verification #

To confirm the base image was the issue, you can test building with an older, known-good Alpine tag first—if that succeeds, you'll know the rolling tag pulling a new version was the root cause.

内容的提问来源于stack exchange，提问作者Marko Zadravec