NPM install hangs infinitely while installing isolated-vm on Node 22.11.0

[paulrutter]

See related issue npm/cli#7900 (comment).

isolated-vm version: 5.0.1

I had a situation where installing isolated-vm (as optional dependency), caused npm install to hang infinitely.
I narrowed it down to this module by using --foreground-scripts.
It would hang upon a gcc command while compiling native code. I'm not sure why the prebuilt binary was not used, as my architecture should allow for this (linux x64).

The workaround that worked for me is setting --jobs 10 so compilation of native code doesn't take all CPU cores.
See https://github.com/nodejs/node-gyp?tab=readme-ov-file#command-options.

npm install --jobs 10 // or npm ci --jobs 10

It's not a pretty solution, but it solved the issue for me.

My platform where this occurs:

Node version: 22.11.0
NPM version: 10.9.0 (downgrading to 10.3.0 as suggested in the linked thread didn't help for me though)
Platform: Linux, Dockerized, Amazon Linux 2023 base image

VERSION="2023"
ID="amzn"
ID_LIKE="fedora"
VERSION_ID="2023"
PLATFORM_ID="platform:al2023"
PRETTY_NAME="Amazon Linux 2023.6.20241010"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2023"
HOME_URL="https://aws.amazon.com/linux/amazon-linux-2023/"
DOCUMENTATION_URL="https://docs.aws.amazon.com/linux/"
SUPPORT_URL="https://aws.amazon.com/premiumsupport/"
BUG_REPORT_URL="https://github.com/amazonlinux/amazon-linux-2023"
VENDOR_NAME="AWS"
VENDOR_URL="https://aws.amazon.com/"
SUPPORT_END="2028-03-15"

gcc --version
gcc (GCC) 11.4.1 20230605 (Red Hat 11.4.1-2)
Copyright (C) 2021 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

On a Windows or Mac based platform, i haven't ran into this issue though (same package.json).
Any ideas as to what could cause this? On node 20.18.0 (with isolated-vm 4.x) i do not see this issue.

[laverdet]

Thank you for the detailed information.

So there's two questions: why don't the prebuilt binaries work, and why does the build hang?

This could help diagnose:

mkdir tmp; cd tmp
npm init -y
npm install isolated-vm --skip-scripts
cd node_modules/isolated-vm 
npx prebuild-install --verbose

On my machine:

marcel[12:51:23PM] [~/tmp] npm init -y
Wrote to /Users/marcel/tmp/package.json:

{
  "name": "tmp",
  "version": "1.0.0",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "description": ""
}

marcel[12:51:25PM] [~/tmp] npm install isolated-vm --skip-scripts

added 36 packages, and audited 37 packages in 516ms

9 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

marcel[12:51:31PM] [~/tmp] cd node_modules/isolated-vm 
marcel[12:51:37PM] [~/tmp/node_modules/isolated-vm] npx prebuild-install --verbose
prebuild-install info begin Prebuild-install version 7.1.2
prebuild-install info looking for local prebuild @ prebuilds/isolated-vm-v5.0.1-node-v127-darwin-arm64.tar.gz
prebuild-install info looking for cached prebuild @ /Users/marcel/.npm/_prebuilds/b95053-isolated-vm-v5.0.1-node-v127-darwin-arm64.tar.gz
prebuild-install info found cached prebuild
prebuild-install info unpacking @ /Users/marcel/.npm/_prebuilds/b95053-isolated-vm-v5.0.1-node-v127-darwin-arm64.tar.gz
prebuild-install info unpack resolved to /Users/marcel/tmp/node_modules/isolated-vm/out/isolated_vm.node
prebuild-install info unpack required /Users/marcel/tmp/node_modules/isolated-vm/out/isolated_vm.node successfully
prebuild-install info install Successfully installed prebuilt binary!

[paulrutter]

Good one, i will try that out next week in our docker build container and post the output here.

[paulrutter]

@laverdet I tried it out just now, and i had to use the - -jobs 10 command to get past the install phase again.

Then, the following command outputs this:

added 37 packages in 3m
⠏
⠏9 packages are looking for funding
⠏  run `npm fund` for details
⠏cd node_modules/isolated-vm
npx prebuild-install --verbose
⠙prebuild-install info begin Prebuild-install version 7.1.2
prebuild-install info looking for local prebuild @ prebuilds/isolated-vm-v5.0.1-node-v127-linux-x64.tar.gz
prebuild-install info looking for cached prebuild @ /root/.npm/_prebuilds/e78454-isolated-vm-v5.0.1-node-v127-linux-x64.tar.gz
prebuild-install info found cached prebuild
prebuild-install info unpacking @ /root/.npm/_prebuilds/e78454-isolated-vm-v5.0.1-node-v127-linux-x64.tar.gz
prebuild-install info unpack resolved to /tmp/node_modules/isolated-vm/out/isolated_vm.node
prebuild-install warn install /lib64/libstdc++.so.6: version `GLIBCXX_3.4.30' not found (required by /tmp/node_modules/isolated-vm/out/isolated_vm.node)
⠙

[paulrutter]

Is gcc too old?
https://docs.aws.amazon.com/linux/al2023/ug/c-cplusplus.html and https://repost.aws/questions/QUZgn4fP5YRYe9kO3DZFTgLQ/amazon-linux-2023-ami-update-to-libstdc-with-glibcxx-3-4-30

It might help to pin down the gcc version in github actions, see https://github.com/marketplace/actions/install-gcc.

Gcc12 seems pretty cutting edge, maybe using 11 would support more distros.

[paulrutter]

#507 is worth a try, or specifying an older ubuntu image could work.
But i don't know if you're ok with going down that route, or that gcc12 is a requirement for it to be used.

[paulrutter]

See #509

[laverdet]

Ok thanks for checking on it. Most of my spare attention has been going towards https://github.com/laverdet/isolated-vm/tree/experimental which will have a different build process. I'll make sure to loop back around and make sure the distributed binaries are linking against the oldest possible libc symbols, since this is a common problem.

[paulrutter]

@laverdet in the meantime, will a new 5.x version be released that's compiled against GCC11?

[dixon1e]

If this is a compiler version mismatch, a test case might be at formio/formio on github. That build fails when using either Docker or yarn. Tried on both MacOS and a fresh Ubuntu 24.04.1 install.

EDIT: Issue report for formio here.
EDIT: Version: g++ (Ubuntu 13.2.0-23ubuntu4) 13.2.0