3254338 fix(deploy): disable OpenSSL ARM crypto extensions to avoid SIGILL
📊 Changes
1 file changed (+5 additions, -0 deletions)
View changed files
📝docker-compose.prod.yml (+5 -0)
📄 Description
Summary
make prod fails on Apple Silicon under Colima (Apple Virtualization Framework / vz backend): the api container crash-loops with Illegal instruction (core dumped) (SIGILL, exit 132) during alembic upgrade head, so flowsint-api-prod never becomes healthy and make prod aborts.
Root cause: the guest kernel reports AArch64 crypto-extension HWCAP flags (AES/PMULL/SHA) that the hypervisor's vCPU doesn't actually support. alembic upgrade head → flowsint_core → redis → PyJWT → cryptography.hazmat.bindings loads cryptography's Rust/OpenSSL extension, whose runtime CPU-feature detection picks an accelerated codepath that then executes an unsupported instruction.
Fix: set OPENSSL_armcap=0 on the api and celery services to force OpenSSL's portable C fallback. This only affects OpenSSL's AArch64 codepath — it's a no-op on x86_64 and on hosts where the HWCAP flags are reported correctly, so it's safe to set unconditionally.
Test plan
Reproduced by bisecting the crash down to import cryptography.hazmat.bindings._rust inside the api image, confirmed via docker compose run --rm -e OPENSSL_armcap=0 ... that the import succeeds with the flag set.
docker compose -f docker-compose.prod.yml up -d with the fix applied: api, celery, postgres, redis, neo4j, app all reach healthy/Up.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/reconurge/flowsint/pull/197
**Author:** [@stewroux](https://github.com/stewroux)
**Created:** 7/18/2026
**Status:** 🔄 Open
**Base:** `main` ← **Head:** `fix/api-sigill-openssl-armcap-arm64-vz`
---
### 📝 Commits (1)
- [`3254338`](https://github.com/reconurge/flowsint/commit/32543384338b8d307caaabd33f58e489853ef8ff) fix(deploy): disable OpenSSL ARM crypto extensions to avoid SIGILL
### 📊 Changes
**1 file changed** (+5 additions, -0 deletions)
<details>
<summary>View changed files</summary>
📝 `docker-compose.prod.yml` (+5 -0)
</details>
### 📄 Description
## Summary
- `make prod` fails on Apple Silicon under Colima (Apple Virtualization Framework / `vz` backend): the `api` container crash-loops with `Illegal instruction (core dumped)` (SIGILL, exit 132) during `alembic upgrade head`, so `flowsint-api-prod` never becomes healthy and `make prod` aborts.
- Root cause: the guest kernel reports AArch64 crypto-extension HWCAP flags (AES/PMULL/SHA) that the hypervisor's vCPU doesn't actually support. `alembic upgrade head` → `flowsint_core` → `redis` → PyJWT → `cryptography.hazmat.bindings` loads cryptography's Rust/OpenSSL extension, whose runtime CPU-feature detection picks an accelerated codepath that then executes an unsupported instruction.
- Fix: set `OPENSSL_armcap=0` on the `api` and `celery` services to force OpenSSL's portable C fallback. This only affects OpenSSL's AArch64 codepath — it's a no-op on x86_64 and on hosts where the HWCAP flags are reported correctly, so it's safe to set unconditionally.
## Test plan
- [x] Reproduced by bisecting the crash down to `import cryptography.hazmat.bindings._rust` inside the `api` image, confirmed via `docker compose run --rm -e OPENSSL_armcap=0 ...` that the import succeeds with the flag set.
- [x] `docker compose -f docker-compose.prod.yml up -d` with the fix applied: `api`, `celery`, `postgres`, `redis`, `neo4j`, `app` all reach `healthy`/`Up`.
- [x] `curl http://127.0.0.1:5001/health` returns `{"status":"ok"}`.
- [ ] Not verified on Docker Desktop / native Linux ARM64 / x86_64 (expected no-op there, but untested by me).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01R3yAhS1TuD13NwPheDuMv6
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/reconurge/flowsint/pull/197
Author: @stewroux
Created: 7/18/2026
Status: 🔄 Open
Base:
main← Head:fix/api-sigill-openssl-armcap-arm64-vz📝 Commits (1)
3254338fix(deploy): disable OpenSSL ARM crypto extensions to avoid SIGILL📊 Changes
1 file changed (+5 additions, -0 deletions)
View changed files
📝
docker-compose.prod.yml(+5 -0)📄 Description
Summary
make prodfails on Apple Silicon under Colima (Apple Virtualization Framework /vzbackend): theapicontainer crash-loops withIllegal instruction (core dumped)(SIGILL, exit 132) duringalembic upgrade head, soflowsint-api-prodnever becomes healthy andmake prodaborts.alembic upgrade head→flowsint_core→redis→ PyJWT →cryptography.hazmat.bindingsloads cryptography's Rust/OpenSSL extension, whose runtime CPU-feature detection picks an accelerated codepath that then executes an unsupported instruction.OPENSSL_armcap=0on theapiandceleryservices to force OpenSSL's portable C fallback. This only affects OpenSSL's AArch64 codepath — it's a no-op on x86_64 and on hosts where the HWCAP flags are reported correctly, so it's safe to set unconditionally.Test plan
import cryptography.hazmat.bindings._rustinside theapiimage, confirmed viadocker compose run --rm -e OPENSSL_armcap=0 ...that the import succeeds with the flag set.docker compose -f docker-compose.prod.yml up -dwith the fix applied:api,celery,postgres,redis,neo4j,appall reachhealthy/Up.curl http://127.0.0.1:5001/healthreturns{"status":"ok"}.🤖 Generated with Claude Code
https://claude.ai/code/session_01R3yAhS1TuD13NwPheDuMv6
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.