Bug Report
Describe the bug
The official fluent/fluent-bit:5.0.7 production (Only PROD images!!! DEBUG images are OK!!!) Docker image (and all versions from v4.2.1 through v5.0.7) is missing the libxxhash0 shared library (libxxhash.so.0). This causes the systemd input plugin to silently drop journal fields (MESSAGE, _SYSTEMD_UNIT, and others) when reading from journald backends that use LZ4 compression. This scenario especially applies to OpenShift environments (for example https://developers.redhat.com/products/openshift-local) since there is this override -> usr/lib/systemd/system/systemd-journald.service.d/rhel8-compat.conf
Environment=SYSTEMD_JOURNAL_COMPACT=0 SYSTEMD_JOURNAL_KEYED_HASH=0 SYSTEMD_JOURNAL_COMPRESS=LZ4
This overrides the compile-time ZSTD default and forces LZ4 compression for all journal entries, including fresh kubelet logs. It ensures journal files remain readable by RHEL 8 tools.
The root cause of the issue on the Fluentbit side is in the deb-extractor stage of dockerfiles/Dockerfile: Debian Trixie's liblz4-1 package gained a hard runtime dependency on libxxhash.so.0, but the Dockerfile only copies liblz4-1 without also copying libxxhash0.
To Reproduce
See attached reproduce.zip for how to easily reproduce.
reproduce.zip
Expected behavior
Lines should not be skipped.
Your Environment
From v4.2.1 through v5.0.7 the official Fluentbit prod images. The debug images have the required dependency and all work ok.
Additional context
The workaround is easy ↓
cat > Dockerfile <<'EOF'
FROM debian:trixie-slim AS donor
RUN apt-get update && apt-get install -y --no-install-recommends libxxhash0 && apt-get clean
FROM fluent/fluent-bit:4.2.3
COPY --from=donor /usr/lib/x86_64-linux-gnu/libxxhash.so.0* /usr/lib/x86_64-linux-gnu/
EOF
docker build -t fluent-bit:4.2.3-fixed .
Bug Report
Describe the bug
The official
fluent/fluent-bit:5.0.7production (Only PROD images!!! DEBUG images are OK!!!) Docker image (and all versions from v4.2.1 through v5.0.7) is missing thelibxxhash0shared library (libxxhash.so.0). This causes thesystemdinput plugin to silently drop journal fields (MESSAGE,_SYSTEMD_UNIT, and others) when reading from journald backends that use LZ4 compression. This scenario especially applies to OpenShift environments (for example https://developers.redhat.com/products/openshift-local) since there is this override -> usr/lib/systemd/system/systemd-journald.service.d/rhel8-compat.confEnvironment=SYSTEMD_JOURNAL_COMPACT=0 SYSTEMD_JOURNAL_KEYED_HASH=0 SYSTEMD_JOURNAL_COMPRESS=LZ4
This overrides the compile-time ZSTD default and forces LZ4 compression for all journal entries, including fresh kubelet logs. It ensures journal files remain readable by RHEL 8 tools.
The root cause of the issue on the Fluentbit side is in the
deb-extractorstage ofdockerfiles/Dockerfile: Debian Trixie'sliblz4-1package gained a hard runtime dependency onlibxxhash.so.0, but the Dockerfile only copiesliblz4-1without also copyinglibxxhash0.To Reproduce
See attached reproduce.zip for how to easily reproduce.
reproduce.zip
Expected behavior
Lines should not be skipped.
Your Environment
From v4.2.1 through v5.0.7 the official Fluentbit prod images. The debug images have the required dependency and all work ok.
Additional context
The workaround is easy ↓
cat > Dockerfile <<'EOF'
FROM debian:trixie-slim AS donor
RUN apt-get update && apt-get install -y --no-install-recommends libxxhash0 && apt-get clean
FROM fluent/fluent-bit:4.2.3
COPY --from=donor /usr/lib/x86_64-linux-gnu/libxxhash.so.0* /usr/lib/x86_64-linux-gnu/
EOF
docker build -t fluent-bit:4.2.3-fixed .