{"record":{"id":"2898919833ae0ccf","repo":"jdx/mise","slug":"apk-failed-while-installing-oci-system-packages","errorCode":null,"errorMessage":"apk failed while installing OCI system packages: {}\n{}","messagePattern":"apk failed while installing OCI system packages: (.+?)\n(.+?)","errorType":"exception","errorClass":"eyre::Report","httpStatus":null,"severity":"error","filePath":"src/oci/packages.rs","lineNumber":376,"sourceCode":"        \"--root\".to_string(),\n        rootfs.display().to_string(),\n        \"--arch\".to_string(),\n        apk_architecture(architecture)?.to_string(),\n        \"--no-cache\".to_string(),\n        \"add\".to_string(),\n        \"--\".to_string(),\n    ];\n    args.extend(requests.iter().map(|request| match &request.version {\n        Some(version) => format!(\"{}={version}\", request.name),\n        None => request.name.clone(),\n    }));\n    info!(\"apk {}\", args.join(\" \"));\n    let output = Command::new(\"apk\")\n        .args(&args)\n        .output()\n        .wrap_err(\"running apk for OCI system packages\")?;\n    if !output.status.success() {\n        bail!(\n            \"apk failed while installing OCI system packages: {}\\n{}\",\n            output.status,\n            String::from_utf8_lossy(&output.stderr).trim()\n        );\n    }\n    Ok(())\n}\n\nfn apt_install_into_rootfs(\n    rootfs: &Path,\n    requests: &[PackageRequest],\n    architecture: &str,\n) -> Result<()> {\n    let status = rootfs.join(\"var/lib/dpkg/status\");\n    if let Some(parent) = status.parent() {\n        file::create_dir_all(parent)?;\n    }\n    if !status.exists() {","sourceCodeStart":358,"sourceCodeEnd":394,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/oci/packages.rs#L358-L394","documentation":"mise runs the host `apk` binary with `--root <tmp rootfs>` to install the requested packages into the unpacked base image. This error means the apk subprocess exited non-zero; mise surfaces the exit status plus apk's stderr verbatim, so the actual cause (unknown package, bad version pin, unreachable repo, DNS failure) is in the message body.","triggerScenarios":"`apk add --root ... <pkgs>` failing: package name or `name=version` pin that does not exist in the base's repository branch (e.g. an edge-only version pinned on a v3.20 image), DNS/resolver missing in the chroot, missing repository signing keys, target-arch packages unavailable, or temp disk exhaustion.","commonSituations":"Network-restricted CI runners blocking dl-cdn.alpinelinux.org; version pins copied from a different Alpine release; corporate proxies stripping TLS; repackaged/private Alpine mirrors not configured in the base image.","solutions":["Read the stderr appended to the message — apk names the exact failing package or repository there","Reproduce outside mise: `docker run --rm alpine:3.20 apk add <same packages>` to confirm the names/pins resolve for that release","Fix the pin: use `\"any\"` or a version that exists in the base image's Alpine release channel","Ensure the host has working DNS/network and, if behind a proxy, that the rootfs resolv.conf/repositories are reachable"],"exampleFix":"# before (mise.toml) — version only in Alpine edge\n[bootstrap.packages.apk]\nripgrep = \"14.1.1-r0\"\n\n# after — unpin or pin to the base release's version\n[bootstrap.packages.apk]\nripgrep = \"any\"","handlingStrategy":"try-catch","validationCode":"# Resolve the exact package set against the matching Alpine release first:\ndocker run --rm alpine:3.20 apk add --simulate curl ripgrep\n# Exit 0 → names/pins are valid for that release; anything else fails fast\n# before mise oci build spends time unpacking layers.","typeGuard":null,"tryCatchPattern":"// When shelling out to `mise oci build`:\nlet out = std::process::Command::new(\"mise\").args([\"oci\", \"build\"]).output()?;\nif !out.status.success() {\n    let msg = String::from_utf8_lossy(&out.stderr);\n    if msg.contains(\"apk failed while installing\") {\n        // stderr of apk is embedded after the newline — surface it verbatim;\n        // 'unable to select packages' → fix names/pins, network errors → retry.\n        eprintln!(\"apk failure — inspect embedded apk stderr:\\n{msg}\");\n    }\n}","preventionTips":["Dry-run package resolution (`apk add --simulate`) against the same Alpine release in CI before the oci build","Prefer `\"any\"` over hard version pins unless reproducibility demands them, and verify pins exist for the base's release channel","Ensure build hosts can reach dl-cdn.alpinelinux.org (or your mirror) and DNS works inside the prepared rootfs"],"tags":["mise","oci","apk","subprocess","package-install","alpine"],"backgroundTag":"package-install-failed","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}