title: Distroless docker + sudo
body: <p>I have dissected Google's distroless images to see how they're built as I'd like to use them but my company wants to have images we have built ourselves.</p>
  
  <p>It looks like Google build glibc, libssl, and openssl in their base images so I did the same. I added a statically linked busybox, curl, and sudo for testing purposes. However, when I login as my user sudo tells me that it is unable to read libraries that exist on the system. At first I thought it had to do with root's environment because setuid but passwd is also setuid and it works.</p>
  
  <p>Here is some output:</p>
  
  <pre><code>Distroless  [gdanko@5bd77574a894]:~ $ ldd /usr/bin/sudo
  linux-vdso.so.1 (0x00007fff5e728000)
  libutil.so.1 =&gt; /lib64/libutil.so.1 (0x00007f4bf61a1000)
  libcrypt.so.1 =&gt; /lib64/libcrypt.so.1 (0x00007f4bf5f6a000)
  libpthread.so.0 =&gt; /lib64/libpthread.so.0 (0x00007f4bf5d4c000)
  libc.so.6 =&gt; /lib64/libc.so.6 (0x00007f4bf59b3000)
  /lib64/ld-linux-x86-64.so.2 (0x00007f4bf6621000)
  
  Distroless  [gdanko@5bd77574a894]:~ $ ls -l /lib64/libutil.so.1
  lrwxrwxrwx    1 root     root            15 Oct  2 17:45 
  /lib64/libutil.so.1 -&gt; libutil-2.25.so
  
  Distroless  [gdanko@5bd77574a894]:~ $ ls -l /lib64/libcrypt.so.1
  lrwxrwxrwx    1 root     root            16 Oct  2 17:45 
  /lib64/libcrypt.so.1 -&gt; libcrypt-2.25.so
  
  Distroless  [gdanko@5bd77574a894]:~ $ ls -l /lib64/libpthread.so.0
  lrwxrwxrwx    1 root     root            18 Oct  2 17:45 
  /lib64/libpthread.so.0 -&gt; libpthread-2.25.so
  
  Distroless  [gdanko@5bd77574a894]:~ $ ls -l /lib64/libc.so.6
  lrwxrwxrwx    1 root     root            12 Oct  2 17:45 
  /lib64/libc.so.6 -&gt; libc-2.25.so
  
  Distroless  [gdanko@5bd77574a894]:~ $ sudo
  sudo: error while loading shared libraries: libutil.so.1: cannot open 
  shared object file: No such file or directory
  </code></pre>
  
  <p>If I su - root and execute sudo it works</p>
  
  <pre><code>Distroless  [gdanko@5bd77574a894]:~ $ su - root
  Password: 
  Distroless  [root@5bd77574a894]:~ # sudo
  usage: sudo -h | -K | -k | -V
  usage: sudo -v [-AknS] [-g group] [-h host] [-p prompt] [-u user]
  usage: sudo -l [-AknS] [-g group] [-h host] [-p prompt] [-U user] [-u user] [command]
  usage: sudo [-AbEHknPS] [-C num] [-g group] [-h host] [-p prompt] [-T timeout] [-u user] [VAR=value] [-i|-s] [&lt;command&gt;]
  usage: sudo -e [-AknS] [-C num] [-g group] [-h host] [-p prompt] [-T timeout] [-u user] file ...
  </code></pre>
  
  <p>I was wondering if it was in how Google built glibc but I could not find anything glaring.</p>
  
  <p>The other thing is, if I use Google's distroless base for my image and copy my sudo over, busybox works in the container. I have tried a number of different things trying to troubleshoot this but I am at a loss. Can anyone see something I may be missing??</p>