How to run latest envoy on RHEL8?

[Atul Baghel]

Hello Envoy Community,

I want to run latest envoy on RHEL8? How can I do it?

Thanks,

Atul

[Yan Avlasov]

Envoy is distributed in docker images. Are these not working for you?

--
You received this message because you are subscribed to the Google Groups "envoy-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to envoy-users...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/envoy-users/87981e48-caef-485a-bc8b-7ee368182e85n%40googlegroups.com.

[Atul Baghel]

So, I am not looking to run it on container. When I try to run it on RHEL8 VM, I get the error: "envoy: /lib64/libm.so.6: version `GLIBC_2.29' not found (required by envoy)"

Steps:

curl -L https://github.com/envoyproxy/envoy/releases/download/v1.24.7/envoy-1.24.7-linux-aarch_64 -o
chmod +x /usr/local/bin/envoy
envoy -c /etc/envoy/envoy.yaml
envoy: /lib64/libm.so.6: version `GLIBC_2.29' not found (required by envoy)

[Ryan Northey]

Hi Atul,

a few points

the version you are using is very old and long out of security
maintenance.

we build currently on ubuntu18 and deploy in ubuntu20 - glibc from
ubuntu18 _should_ make the minimum glibc requirement 2.27

it seems that is not the case and that some libs with a higher
requirement have sneaked into our build - most likely through libgcc
(which we get from the newer gcc13) or perhaps from libc++ - not sure on
the exact cause, but ill try and track it down.

tldr the current glibc requirement for all our supported binaries is
2.30

```
$ objdump -T envoy-1.33.11-linux-x86_64 | grep GLIBC | sed
's/.*GLIBC_\([.0-9]*\).*/\1/g' | sort -Vu |tail -n1
2.30
$ objdump -T envoy-1.36.2-linux-x86_64 | grep GLIBC | sed
's/.*GLIBC_\([.0-9]*\).*/\1/g' | sort -Vu | tail -n1
2.30
```

this means that the minimum OS compat is:

- Debian 11
- Ubuntu 20
- Redhat 9

thanks for bringing this to my attention - im currently working on the
build and was considering bumping to these requirements anyway

it also flags that we are not testing this directly (we test ubuntu20
containers) - probably we should add something to the static binary
test, and perhaps even some quick distro container compat tests - either
way we need to know if/when our build compat changes

cheers,

Ryan Northey (@phlax)

>>> [1].

>
> --
> You received this message because you are subscribed to the Google
> Groups "envoy-users" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to envoy-users...@googlegroups.com.
> To view this discussion visit

> https://groups.google.com/d/msgid/envoy-users/12f0aeaa-00fb-41e8-85e1-a6b001f58184n%40googlegroups.com
> [2].
>
>
> Links:
> ------
> [1]
> https://groups.google.com/d/msgid/envoy-users/87981e48-caef-485a-bc8b-7ee368182e85n%40googlegroups.com?utm_medium=email&utm_source=footer
> [2]
> https://groups.google.com/d/msgid/envoy-users/12f0aeaa-00fb-41e8-85e1-a6b001f58184n%40googlegroups.com?utm_medium=email&utm_source=footer

[Ryan Northey]

following up on this ...

it seems i had been under incorrect understanding - we build and deploy
on ubuntu 20 - and that has been the case for 3 years - now im looking
back at the commits, i can remember the conversation at the time.

so theres no mystery - the build is working as intended.

kinda related - remembering that we _do_ have distro compat testing, but
not for redhat - only ubuntu/debian.

cheers,

Ryan Northey (@phlax)

[Atul Baghel]

Hi Ryan,

We do run on RHEL9 VMs in most of the scenarios but some of our customers are running RHEL8 and would like to run envoy on RHEL8. What is a recommended way for me to try out?

1. Recompile envoy with older GLIBC
2. Recompile envoy with current GLIBC using static linking options
3. Patch envoy binary to use older GLIBC
4. Anything else?

Thanks,

Atul

[Ryan Northey]

Hi,

yeah - really you want to recompile with the target glibc (ie dynamic as
now but with your expected version)

any of the other options would be at best unreliable and definitely not
for production deployment.

we are currently separating out our compiler toolchains, and making them
hermetic - which would make this an easier thing to do but not sure if
we can support additional glibc builds as it would act as multiplier on
other variants.

cheers,

Ryan Northey (@phlax)

On 2025-11-12 10:51, 'Atul Baghel' via envoy-users wrote:
> Hi Ryan,
>
> We do run on RHEL9 VMs in most of the scenarios but some of our
> customers are running RHEL8 and would like to run envoy on RHEL8. What
> is a recommended way for me to try out?
>

> * Recompile envoy with older GLIBC
> * Recompile envoy with current GLIBC using static linking options
> * Patch envoy binary to use older GLIBC
> * Anything else?

>> [1]
>>>> [2]
>>>>
>>
> https://groups.google.com/d/msgid/envoy-users/12f0aeaa-00fb-41e8-85e1-a6b001f58184n%40googlegroups.com?utm_medium=email&utm_source=footer
>> [2]

>
> --
> You received this message because you are subscribed to the Google
> Groups "envoy-users" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to envoy-users...@googlegroups.com.
> To view this discussion visit

> https://groups.google.com/d/msgid/envoy-users/eee3f67c-74a8-4b51-8107-057c1bc7fdean%40googlegroups.com
> [3].

>
>
> Links:
> ------
> [1]
> https://groups.google.com/d/msgid/envoy-users/87981e48-caef-485a-bc8b-7ee368182e85n%40googlegroups.com?utm_medium=email&utm_source=footer
> [2]
> https://groups.google.com/d/msgid/envoy-users/12f0aeaa-00fb-41e8-85e1-a6b001f58184n%40googlegroups.com?utm_medium=email&utm_source=footer

> [3]
> https://groups.google.com/d/msgid/envoy-users/eee3f67c-74a8-4b51-8107-057c1bc7fdean%40googlegroups.com?utm_medium=email&utm_source=footer

[Atul Baghel]

Hi Ryan,

1. When you say “recompile with the target glibc (dynamic as now),” I’m planning to build latest Envoy inside a RHEL 8 environment (glibc 2.28) so the resulting binary dynamically links against glibc 2.28. Is that the right approach? Do you see any functionality break or run time issues? Also, is this process already documented somewhere?

2. On the “hermetic toolchains” effort: will that make it straightforward for downstreams to target older glibc versions (e.g., by swapping the base sysroot), and is there a rough timeline for when this will land?

Thanks,

Atul

[Atul Baghel]

Hi Ryan,

Also, If we rebuild with different glibc, (glibc v2.28 in this case),  What all tests we need to run to ensure that the rebuild with a different glibc works as expected and doesn't break anything?

Thanks,

Atul

[Ryan Northey]

Hi,

> 1. When you say “recompile with the target glibc (dynamic as
> now),” I’m planning to build latest Envoy inside a RHEL 8
> environment (glibc 2.28) so the resulting binary dynamically links
> against glibc 2.28. Is that the right approach? Do you see any
> functionality break or run time issues? Also, is this process already
> documented somewhere?

yeah - with current build it looks for glibc in the environment - so
replacing this with an earlier version should work - with the caveat
that we are not testing that environment, so there is some risk of it
breaking other things (eg kernel and/or system utilities may cause
issues)

> 2. On the “hermetic toolchains” effort: will that make it
> straightforward for downstreams to target older glibc versions (e.g.,
> by swapping the base sysroot), and is there a rough timeline for when
> this will land?

yes, exactly that - with the new hermetic build anything on the system
should be ignored (at least theoretically, currently im ironing out
issues where deps just expect system tools eg) - so glibc and any other
libs that are not pulled in through bazel deps are sourced from the
sysroot.

timeline is fairly imminent, but its a pretty major development, so
there are a lot of small issues to work through - my goal is to land it
in this release cycle.

> Also, If we rebuild with different glibc, (glibc v2.28 in this case),
> What all tests we need to run to ensure that the rebuild with a
> different glibc works as expected and doesn't break anything?

at a minimum i would say the release tests (ie ./ci/do_ci.sh release),
but you probably also want to know that the sanitizer checks havent
broke (ie asan/msan/tsan)

cheers,

Ryan Northey (@phlax)

>>> [3]
>>>
>>
> https://groups.google.com/d/msgid/envoy-users/eee3f67c-74a8-4b51-8107-057c1bc7fdean%40googlegroups.com?utm_medium=email&utm_source=footer
>> [3]

>
> --
> You received this message because you are subscribed to the Google
> Groups "envoy-users" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to envoy-users...@googlegroups.com.
> To view this discussion visit

> https://groups.google.com/d/msgid/envoy-users/5bc8f739-c73b-4e3b-944f-751486ccdf88n%40googlegroups.com
> [4].

>
>
> Links:
> ------
> [1]
> https://groups.google.com/d/msgid/envoy-users/87981e48-caef-485a-bc8b-7ee368182e85n%40googlegroups.com?utm_medium=email&utm_source=footer
> [2]
> https://groups.google.com/d/msgid/envoy-users/12f0aeaa-00fb-41e8-85e1-a6b001f58184n%40googlegroups.com?utm_medium=email&utm_source=footer
> [3]
> https://groups.google.com/d/msgid/envoy-users/eee3f67c-74a8-4b51-8107-057c1bc7fdean%40googlegroups.com?utm_medium=email&utm_source=footer

> [4]
> https://groups.google.com/d/msgid/envoy-users/5bc8f739-c73b-4e3b-944f-751486ccdf88n%40googlegroups.com?utm_medium=email&utm_source=footer