Release 8.8.3 log4j CVE patch build failed

[jiraky]

Hello,
I'm having trouble in building the solr-base image for docker with the 8.8.3 release. The 8.8.1 is working as intended.
The current docker setup is on a clean Debian installation in virtualized lxc container (unprivileged, keyctl enabled).
Full trace as follows:

root@docker:~# git clone https://github.com/bcgov/openshift-solr
Cloning into 'openshift-solr'...
remote: Enumerating objects: 238, done.
remote: Counting objects: 100% (30/30), done.
remote: Compressing objects: 100% (10/10), done.
remote: Total 238 (delta 24), reused 24 (delta 20), pack-reused 208
Receiving objects: 100% (238/238), 108.26 KiB | 2.78 MiB/s, done.
Resolving deltas: 100% (87/87), done.
root@indy-docker:~# cd openshift-solr/
root@indy-docker:~/openshift-solr# ls -lA
total 40
drwxr-xr-x 8 root root 4096 Dec 27 08:05 .git
-rw-r--r-- 1 root root  231 Dec 27 08:05 .gitattributes
-rw-r--r-- 1 root root  771 Dec 27 08:05 CONTRIBUTING.md
-rw-r--r-- 1 root root 2202 Dec 27 08:05 Dockerfile
-rw-r--r-- 1 root root 1069 Dec 27 08:05 LICENSE
-rw-r--r-- 1 root root 2586 Dec 27 08:05 README.md
-rw-r--r-- 1 root root  113 Dec 27 08:05 build.sh
drwxr-xr-x 4 root root 4096 Dec 27 08:05 openshift
drwxr-xr-x 3 root root 4096 Dec 27 08:05 s2i
drwxr-xr-x 3 root root 4096 Dec 27 08:05 solr
root@indy-docker:~/openshift-solr# docker build --no-cache --progress plain -t solr-base .
Sending build context to Docker daemon  497.2kB
Step 1/15 : FROM solr:8.8.1
 ---> 1e4deb1f2bd7
Step 2/15 : LABEL maintainer="[email protected]"
 ---> Running in 1f0cd208c177
Removing intermediate container 1f0cd208c177
 ---> 3967cc5ebadf
Step 3/15 : LABEL maintainer="[email protected]"
 ---> Running in 55e3e459c31c
Removing intermediate container 55e3e459c31c
 ---> 7b956eaffef6
Step 4/15 : USER root
 ---> Running in ed27fa9336ef
Removing intermediate container ed27fa9336ef
 ---> f86c2025d31b
Step 5/15 : ENV STI_SCRIPTS_PATH=/usr/libexec/s2i
 ---> Running in e2c04ee46fde
Removing intermediate container e2c04ee46fde
 ---> 647c86d1a188
Step 6/15 : RUN apt-get update &&     apt-get install zip
 ---> Running in d96b65fe9d1a
Get:1 http://security.debian.org/debian-security buster/updates InRelease [65.4 kB]
Get:2 http://deb.debian.org/debian buster InRelease [122 kB]
Get:3 http://deb.debian.org/debian buster-updates InRelease [51.9 kB]
Get:4 http://security.debian.org/debian-security buster/updates/main amd64 Packages [313 kB]
Get:5 http://deb.debian.org/debian buster/main amd64 Packages [7906 kB]
Get:6 http://deb.debian.org/debian buster-updates/main amd64 Packages [15.2 kB]
Fetched 8473 kB in 4s (1982 kB/s)
Reading package lists...
Reading package lists...
Building dependency tree...
Reading state information...
The following NEW packages will be installed:
  zip
0 upgraded, 1 newly installed, 0 to remove and 19 not upgraded.
Need to get 234 kB of archives.
After this operation, 623 kB of additional disk space will be used.
Get:1 http://deb.debian.org/debian buster/main amd64 zip amd64 3.0-11+b1 [234 kB]
debconf: delaying package configuration, since apt-utils is not installed
Fetched 234 kB in 0s (2341 kB/s)
Selecting previously unselected package zip.
(Reading database ... 8106 files and directories currently installed.)
Preparing to unpack .../zip_3.0-11+b1_amd64.deb ...
Unpacking zip (3.0-11+b1) ...
Setting up zip (3.0-11+b1) ...
Removing intermediate container d96b65fe9d1a
 ---> b88afab4b443
Step 7/15 : ENV LOG4J_FORMAT_MSG_NO_LOOKUPS=true
 ---> Running in 16f0660c07f3
Removing intermediate container 16f0660c07f3
 ---> a5bd6205db65
Step 8/15 : RUN find / -name log4j-core*.jar -exec zip -q -d {} org/apache/logging/log4j/core/lookup/JndiLookup.class \; 2>/dev/null
 ---> Running in 02375c4e0c3f
The command '/bin/sh -c find / -name log4j-core*.jar -exec zip -q -d {} org/apache/logging/log4j/core/lookup/JndiLookup.class \; 2>/dev/null' returned a non-zero code: 1
root@docker:~/openshift-solr#

Building with 8.8.1 release:

root@docker:~/openshift-solr# git checkout 8.8.1
Note: switching to '8.8.1'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at 5e68be4 Merge pull request #9 from bcgov/solr-8.8.1
root@docker:~/openshift-solr# docker build --no-cache --progress plain -t solr-base .
Sending build context to Docker daemon  496.1kB
Step 1/12 : FROM solr:8.8.1
 ---> 1e4deb1f2bd7
Step 2/12 : LABEL maintainer="[email protected]"
 ---> Running in 3e1d15f584d0
Removing intermediate container 3e1d15f584d0
 ---> d1446284c2b8
Step 3/12 : LABEL maintainer="[email protected]"
 ---> Running in 927d939ab4c7
Removing intermediate container 927d939ab4c7
 ---> b7a911f19ad2
Step 4/12 : USER root
 ---> Running in 416ded0618d7
Removing intermediate container 416ded0618d7
 ---> 07a4f5f963c4
Step 5/12 : ENV STI_SCRIPTS_PATH=/usr/libexec/s2i
 ---> Running in 43b8c6bdcf07
Removing intermediate container 43b8c6bdcf07
 ---> bd2d3b06aa58
Step 6/12 : LABEL io.k8s.description="Run SOLR search in OpenShift"       io.k8s.display-name="SOLR 8.8.1"       io.openshift.expose-services="8983:http"       io.openshift.tags="builder,solr,solr8.8.1"       io.openshift.s2i.scripts-url="image:///${STI_SCRIPTS_PATH}"
 ---> Running in 4283070aa905
Removing intermediate container 4283070aa905
 ---> 9b34f318dad4
Step 7/12 : COPY ./s2i/bin/. ${STI_SCRIPTS_PATH}
 ---> dd83be1842f2
Step 8/12 : RUN chmod -R a+rx ${STI_SCRIPTS_PATH}
 ---> Running in 9245ad526627
Removing intermediate container 9245ad526627
 ---> 5f8696ff123d
Step 9/12 : RUN chgrp -R 0 /opt/solr   && chmod -R g+rwX /opt/solr   && chown -LR solr:root /opt/solr
 ---> Running in 11e2843a853d
Removing intermediate container 11e2843a853d
 ---> 0c032a568428
Step 10/12 : RUN chgrp -R 0 /opt/docker-solr   && chmod -R g+rwX /opt/docker-solr   && chown -LR solr:root /opt/docker-solr
 ---> Running in d0959499f48b
Removing intermediate container d0959499f48b
 ---> a56b78083058
Step 11/12 : RUN usermod -a -G 0 solr
 ---> Running in 9e6511626a5e
Removing intermediate container 9e6511626a5e
 ---> bf3582d7b0d0
Step 12/12 : USER 8983
 ---> Running in 78c2c36a19ae
Removing intermediate container 78c2c36a19ae
 ---> 471f70033419
Successfully built 471f70033419
Successfully tagged solr-base:latest

[jiraky]

Upon further testing, it appears that it might depends on the system itself. That is to say, with other environments (docker on barebone Ubuntu machine, docker on WSL in Windows10) I cannot reproduce the issue.
Any idea regarding what should I check next?

Cheers

[WadeBarnes]

Sorry for the very delayed reply. It looks like I did not have watching enabled on this repo. The best I could recommend is comment out the offending line in the docker file and build the image, then shell into the image and try running the command from inside the running container to debug it. Like you said it works on other systems. For me Windows 11 and builds inside OpenShift.