wkhtmltopdf ships with an expiry date: bookworm and jammy, then nothing

The three failure modes in Vitalii's writeup read like three separate bugs, which is why they burn afternoons. On Alpine, the shell reports `not found` for a file `ls` can see. The kernel is refusing to load the binary's interpreter: official builds link glibc, Alpine ships musl, and `/lib64/ld-linux-x86-64.so.2` is not there ^[4]. A single `ldd` on the binary shows it ^[4]. Alpine dropped its own wkhtmltopdf package years ago and gcompat shims are a lottery with a binary this large, so the roughly 50 MB the slim base saves is the entire reason anyone is in that hole ^[14].

The libssl1.1 wall is a different animal, and mostly self-inflicted. The Dockerfiles in circulation fetch `wkhtmltox_0.12.6-1`, which links OpenSSL 1.1, while Debian 12 and Ubuntu 22.04 onward ship OpenSSL 3 and no longer carry libssl1.1 in the archives ^[5]. The final release, 0.12.6.1-3, was built against OpenSSL 3 for bookworm and jammy ^[6]. So the most common error is a stale version string in a copied recipe rather than the archival itself ^[12]. That release also ships amd64 and arm64 for both distros, which is why `dpkg --print-architecture` in the download URL is enough to cover both ^[7].

What no recipe fixes is the ceiling. Upstream packaging outlived the read-only repository by about four months ^[13], and the newest targets it ever produced are Debian 12 and Ubuntu 22.04 ^[11]. Those debs may keep installing on newer bases for as long as the dependency chain happens to line up, and the author's read is that every base-image bump from here is a gamble against a binary from 2023 ^[17].

Two recurring costs sit underneath. Fonts: the image arrives with almost none, wkhtmltopdf resolves them through fontconfig, and missing glyphs render as tofu, so any non-Latin text needs re-checking after each base change ^[8]. Security: CVE-2022-35583, an SSRF through rendered content, is permanently unfixed, which is why the guide says to keep untrusted HTML away from it and run the container with no metadata endpoint access and restricted egress ^[9].

The exits are listed by someone who sells one of them. Vitalii discloses that he founded PDFik, a hosted URL and HTML-to-PDF API ^[16], and still puts headless Chromium (Puppeteer or Playwright's `page.pdf()`, or Gotenberg as a ready-made sidecar) and WeasyPrint for print-CSS documents that run no JavaScript ahead of the hosted category ^[15]. The ordering is the useful part: the options that cost nothing come first, and the pitch is narrowed to teams whose actual lock-in is the CLI flags, which PDFik's compatibility mode accepts ^[16].