sshd fails to start in GitLab 18.0.2 container

[hannes-ucsc]

Container starts but the sshd process inside it does not. I don't have a screenshot of that situation but the first child of run runsv sshd would be missing in that case …

… and the respective log is filled with PRNG is not seeded

$ sudo grep seeded /mnt/gitlab/logs/sshd/* | tail
/mnt/gitlab/logs/sshd/@400000006849c4e10cafeeb4.u:2025-06-11_18:02:23.11544 PRNG is not seeded
/mnt/gitlab/logs/sshd/@400000006849c4e10cafeeb4.u:2025-06-11_18:02:24.12335 PRNG is not seeded
/mnt/gitlab/logs/sshd/@400000006849c4e10cafeeb4.u:2025-06-11_18:02:25.13026 PRNG is not seeded
/mnt/gitlab/logs/sshd/@400000006849c4e10cafeeb4.u:2025-06-11_18:02:26.13651 PRNG is not seeded
/mnt/gitlab/logs/sshd/@400000006849c4e10cafeeb4.u:2025-06-11_18:02:27.14790 PRNG is not seeded
/mnt/gitlab/logs/sshd/@400000006849c4e10cafeeb4.u:2025-06-11_18:02:28.15500 PRNG is not seeded
/mnt/gitlab/logs/sshd/@400000006849c4e10cafeeb4.u:2025-06-11_18:02:29.16024 PRNG is not seeded
/mnt/gitlab/logs/sshd/@400000006849c4e10cafeeb4.u:2025-06-11_18:02:30.16644 PRNG is not seeded
/mnt/gitlab/logs/sshd/@400000006849c4e10cafeeb4.u:2025-06-11_18:02:31.17174 PRNG is not seeded
/mnt/gitlab/logs/sshd/@400000006849c4e10cafeeb4.u:2025-06-11_18:02:32.17724 PRNG is not seeded

User are be unable to pull from or push to any git repository on the GitLab instance, using git+ssh.

[hannes-ucsc]

The GitLab Omnibus team is addressing this differently:

https://gitlab.com/gitlab-org/omnibus-gitlab/-/commit/4b49eb18ee544fa77a32cb2e58cd85b4c6aa68cd

and point at dotnet/dotnet-docker#5849 (comment) as the cause.

I suspect the long-term solution is to include the OpenSSL FIPS libraries in the image.

There is some activity related to this so I am hopeful this will happen soon:

https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8917
https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8908

[achave11-ucsc]

Assignee to periodically check on the aforementioned tickets.

[hannes-ucsc]

Some activity on https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8908

MR is https://gitlab.com/gitlab-org/gitlab/-/merge_requests/192361

It looks like 18.4 will resolve that ticket via that MR.

Spike to try removing the workaround once we update to 18.4.

[dsotirho-ucsc]

@hannes-ucsc: "Will be upgrading to 18.4 as part of PR #7447 for issue #7409. @achave11-ucsc is in the final stages of preparing the PR. I'd like @dsotirho-ucsc to try the removal of the workaround when deploying that PR."