From 6593db21b1f9bd092e73b3d1fa1eb45581c0c96c Mon Sep 17 00:00:00 2001
From: Zac Bergquist <zac.bergquist@goteleport.com>
Date: Wed, 7 Jan 2026 02:38:18 +0000
Subject: [PATCH] Fix make build-binaries

The dockerized build (make -C build.assets build-binaries) fails
with GLIBC errors because it is a multi-stage build that runs
across several different containers.

First, we build the webassets in buildbox-node. Then we build the
Teleport binaries in buildbox-centos7, reusing the webassets built
previously.

The issue arises because buildbox-node runs a newer version of GLIBC
than buildbox-centos7, and we weren't properly cleaning some build
artifacts when switching from one builder to another. As a result,
the centos7 builder would see intermediate artifacts with a dependency
on a GLIBC version that is too new.

Fix the issue by ensuring we run a clean-build after hopping into
the centos7 container.

Closes #62594
---
 README.md             |  3 +++
 build.assets/Makefile | 24 +++++++++++++++---------
 2 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 2e25df3f8b028..52ebce8c9ac6f 100644
--- a/README.md
+++ b/README.md
@@ -133,6 +133,9 @@ that docker is installed and running, and execute:
 make -C build.assets build-binaries
 ```
 
+This command will build Linux binaries matching the host architecture.
+It is not possible to cross-compile to a different target architecture.
+
 ### Local Build
 
 #### Dependencies
diff --git a/build.assets/Makefile b/build.assets/Makefile
index 61c0162fec07f..a9a78649c6f82 100644
--- a/build.assets/Makefile
+++ b/build.assets/Makefile
@@ -75,20 +75,26 @@ build: buildbox-centos7 webassets
 		make -C $(SRCDIR) ADDFLAGS='$(ADDFLAGS)' PIV=$(PIV) release-unix-preserving-webassets
 
 #
-# Build 'teleport' release inside a docker container
+# Build 'teleport' binaries inside a docker container
 #
 .PHONY:build-binaries
 build-binaries: buildbox-centos7 webassets
-	docker run $(DOCKERFLAGS) $(NOROOT) $(BUILDBOX_CENTOS7) \
-		make -C $(SRCDIR) ADDFLAGS='$(ADDFLAGS)' PIV=$(PIV) full
+	$(call LOG_GROUP_START)
+	$(REQUIRE_HOST_ARCH)
+	docker run $(DOCKERFLAGS) -i $(NOROOT) $(BUILDBOX_CENTOS7) \
+		/usr/bin/scl enable $(DEVTOOLSET) 'make clean-build full -e ADDFLAGS="$(ADDFLAGS)" OS=$(OS) ARCH=$(ARCH) RUNTIME=$(GOLANG_VERSION) FIDO2=$(FIDO2) PIV=$(PIV) REPRODUCIBLE=no'
+	$(call LOG_GROUP_END)
 
 #
-# Build 'teleport' Enterprise release inside a docker container
+# Build 'teleport' Enterprise binaries inside a docker container
 #
 .PHONY:build-enterprise-binaries
 build-enterprise-binaries: buildbox-centos7 webassets
+	$(call LOG_GROUP_START)
+	$(REQUIRE_HOST_ARCH)
 	docker run $(DOCKERFLAGS) $(NOROOT) $(BUILDBOX_CENTOS7) \
-		make -C $(SRCDIR)/e ADDFLAGS='$(ADDFLAGS)' VERSION=$(VERSION) GITTAG=v$(VERSION) PIV=$(PIV) clean full
+		/usr/bin/scl enable $(DEVTOOLSET) 'make clean-build full-ent -e ADDFLAGS="$(ADDFLAGS)" OS=$(OS) ARCH=$(ARCH) RUNTIME=$(GOLANG_VERSION) FIDO2=$(FIDO2) PIV=$(PIV) REPRODUCIBLE=no'
+	$(call LOG_GROUP_END)
 
 #
 # Build 'teleport' FIPS release inside a docker container
@@ -664,11 +670,11 @@ release-fips: buildbox-centos7-fips webassets
 #
 .PHONY:release-centos7
 release-centos7: buildbox-centos7 webassets
-	$(LOG_GROUP_START)
+	$(call LOG_GROUP_START)
 	$(REQUIRE_HOST_ARCH)
 	docker run $(DOCKERFLAGS) -i $(NOROOT) $(BUILDBOX_CENTOS7) \
 		/usr/bin/scl enable $(DEVTOOLSET) 'make release-unix-preserving-webassets -e ADDFLAGS="$(ADDFLAGS)" OS=$(OS) ARCH=$(ARCH) RUNTIME=$(GOLANG_VERSION) FIDO2=$(FIDO2) PIV=$(PIV) REPRODUCIBLE=no'
-	$(LOG_GROUP_END)
+	$(call LOG_GROUP_END)
 
 #
 # Create a Teleport FIPS package for CentOS 7 using the build container.
@@ -680,10 +686,10 @@ release-centos7: buildbox-centos7 webassets
 #
 .PHONY:release-centos7-fips
 release-centos7-fips: buildbox-centos7-fips webassets
-	$(LOG_GROUP_START)
+	$(call LOG_GROUP_START)
 	docker run $(DOCKERFLAGS) -i $(NOROOT) $(BUILDBOX_CENTOS7_FIPS) \
 		/usr/bin/scl enable $(DEVTOOLSET) '/usr/bin/make -C e release -e ADDFLAGS="$(ADDFLAGS)" OS=$(OS) ARCH=$(ARCH) RUNTIME=$(GOLANG_VERSION) FIDO2=$(FIDO2) PIV=$(PIV) FIPS=yes VERSION=$(VERSION) GITTAG=v$(VERSION) REPRODUCIBLE=no'
-	$(LOG_GROUP_END)
+	$(call LOG_GROUP_END)
 
 #
 # Create a Windows Teleport package using the build container.