reqwest::Client builder error inside Fly Machines — TLS fails in firecracker VM

[Chococoin]

Summary

reqwest::Client::builder().use_rustls_tls().build() returns a generic "builder error" when running inside a Fly Machine. The same binary works correctly in Docker locally (both arm64 and amd64).

Environment

• Region: cdg (Paris)
• Machine: shared-cpu-1x, 512MB
• Base image: debian:bookworm-slim and also rust:1.91-bookworm (single-stage)
• Rust: 1.91.0
• reqwest: 0.12.28 with default-features = false, features = ["json", "rustls-tls", "http2", "charset"]

Reproduction

1. Simple Axum server with a health endpoint that creates a reqwest client and makes an HTTPS POST:

let client = reqwest::Client::builder()
    .use_rustls_tls()
    .build()
    .map_err(|e| format!("client build: {e}"))?; // <-- fails here with "builder error"

let resp = client
    .post("https://api.mailersend.com/v1/email")
    .header("Authorization", "Bearer xxx")
    .header("Content-Type", "application/json")
    .body(r#"{"test": true}"#.to_string())
    .send()
    .await?;

2. Build with Docker: docker build --platform linux/amd64 -t test .
3. Run locally: works, returns HTTP 202
4. Deploy to Fly: same image, returns "builder error"
5. Tested with --depot=false --no-cache, --local-only, and manually pushing to registry.fly.io — same result every time

What works

• The binary itself starts fine (health check passes, PostgreSQL connects, MongoDB connects, Solana RPC connects)
• Only outbound HTTPS via reqwest fails
• ca-certificates is installed in the image

Expected

reqwest::Client::builder().use_rustls_tls().build() should succeed, as it does in the identical Docker image run locally.

Workaround

None found. Trying Shuttle as alternative hosting.