Che-code editor failed to start in containers with OPENSSL version < 3.4.0

[svor]

Describe the bug

The workspace failed to start when using the che-code:latest image

From the Events:

status:
  conditions:
    - lastTransitionTime: '2025-12-19T11:43:45Z'
      message: DevWorkspace failed to progress past step 'Waiting for editor to start' for longer than timeout (300s)
      reason: InfrastructureFailure
      status: 'True'
      type: FailedStart

From the checode/entrypoint-logs.txt:

time="2025-12-19T12:24:37Z" level=info msg="Activity tracker is run and workspace will be stopped in 30m0s if there is no activity"
[GIN-debug] Listening and serving HTTP on 127.0.0.1:3333
[INFO] OpenSSL major version is: 3.
[INFO] LD_LIBRARY_PATH is: /checode/checode-linux-libc/ubi9/ld_libs:
[INFO] Using linux-libc ubi9-based assembly...
[INFO] Node.js dir for running VS Code: /checode/checode-linux-libc/ubi9
/checode/checode-linux-libc/ubi9/node: /lib64/libcrypto.so.3: version `OPENSSL_3.4.0' not found (required by /checode/checode-linux-libc/ubi9/ld_libs/libnode.so.127)

Che version

7.112@latest

Steps to reproduce

Try to start any workspace with quay.io/che-incubator/che-code:latest editor image and quay.io/devfile/universal-developer-image:ubi9-f1cf6ea (which provides OpenSSL 3.2.2 ) as a tool container's image

Expected behavior

The workspace should start

Runtime

OpenShift

Screenshots

No response

Installation method

chectl/next

Environment

Linux

Eclipse Che Logs

Additional context

No response

[azatsarynnyy]

I provided quay.io/che-incubator/che-code:latest as the editor image:

and Che-Code started successfully

@svor is there an important step missing for reproducing the problem?

[azatsarynnyy]

I see that it is reproduced with the Empty Workspace sample.

[svor]

@azatsarynnyy also you can try this factory:

che-host#https://github.com/che-incubator/quarkus-api-example?editor-image=quay.io/che-incubator/che-code:latest

[RomanNikitenko]

It makes sense to double check starting che-code editor for all ubi8/ubi9/ubi10-based images - it's possible there are other images that do not contain a required lib/required version of a lib.

[RomanNikitenko]

I think the cause of the problem is:

• openssl version was updated (to clarify - no changes on the che-code side, it was done on the ubi9 level)
• 9.6 tag of a ubi9-based image contains openssl-3.2.2 package
• 9.7 tag of a ubi9-based image contains openssl-3.5.1 package
• workspaces are not going to start if a user's container (tools container) contains older openssl version.

For example, if we use 9.6 tag of a ubi9-based container - it will fail:

https://che-dogfooding.apps.che-dev.x6e0.p1.openshiftapps.com#https://github.com/RomanNikitenko/web-nodejs-sample?image=registry.access.redhat.com/ubi9/nodejs-22:9.6&editor-image=quay.io/che-incubator/che-code:latest
as the tools container contains older version of the openssl package.

it works for the 9.7 tag - as it contains newer version of the package
https://che-dogfooding.apps.che-dev.x6e0.p1.openshiftapps.com#https://github.com/RomanNikitenko/web-nodejs-sample?image=registry.access.redhat.com/ubi9/nodejs-22:9.7&editor-image=quay.io/che-incubator/che-code:latest