Using SoftHSM2 from host with EJBCA and SignServer (glibc version mismatch)

[naejbravo]

Hi, I’m setting up EJBCA Community and SignServer Community to use SoftHSM2 installed on the host, instead of installing SoftHSM inside each Docker container.

Here’s my environment setup:

• Host: Ubuntu 24.04 (glibc 2.38)
• EJBCA-CE container: based on AlmaLinux 9 (glibc 2.34)
• SignServer-CE container: based on AlmaLinux 8 (glibc 2.28)
• SoftHSM2 is installed on the host and mounted into the containers via volume.

Both containers define:

P11LIB=/usr/lib/softhsm/libsofthsm2.so SOFTHSM2_CONF=/etc/softhsm2.conf

I cant list slots from EJBCA ui, instead i have this in the logs:

/lib64/libc.so.6: version GLIBC_2.38' not found (required by /usr/lib/softhsm/libsofthsm2.so)
`
I understand this happens because the libsofthsm2.so binary from the host was compiled against glibc 2.38, while the containers use older versions (2.34 and 2.28).

❓Question

What’s the recommended approach here?

Should I install SoftHSM inside each container so it matches the container’s glibc version?

Or is there a recommended way to build a version of libsofthsm2.so that’s compatible with older glibc (e.g., 2.28–2.34) so it can be shared safely between containers?

Any advice or examples from similar setups (modern Ubuntu host + RHEL/AlmaLinux-based containers) would be very helpful.

Thanks in advance!

[primetomas]

There are many different approaches you can take. You can build libsofthsm so it's compatible with the container version of glibc, maybe that's the easiest.
Next release of EJBCA I think will use an updated container base as well.

[kedev2]

Just curious on the timeline of the next release...having the same problem but will try building a compatible version.

[naejbravo]

@kedev2 If this can help you, for example the thing that i did was:

• Use a docker with almalinux 9
• In almalinux docker, install softhsm2
• Copy the libsofthsm2.so to host
• Copy libsofthsm2.so to ejbca docker

with this you wont have the problem of glibc.

[kedev2]

ended up building with almalinux 9 and mounted host dir to ejbca container...works...thanks