{"record":{"id":"a83d7207b93ce84e","repo":"jdx/mise","slug":"apt-get-failed-while-installing-oci-system-package","errorCode":null,"errorMessage":"apt-get failed while installing OCI system packages: {}\n{}","messagePattern":"apt-get failed while installing OCI system packages: (.+?)\n(.+?)","errorType":"exception","errorClass":"eyre::Report","httpStatus":null,"severity":"error","filePath":"src/oci/packages.rs","lineNumber":498,"sourceCode":"        \"APT::Sandbox::User=root\".to_string(),\n        \"-o\".to_string(),\n        format!(\"APT::Architecture={}\", apt_architecture(architecture)?),\n        \"-o\".to_string(),\n        format!(\"DPkg::Options::=--root={}\", rootfs.display()),\n        \"-o\".to_string(),\n        \"DPkg::Options::=--force-not-root\".to_string(),\n    ])\n}\n\nfn run_apt_get(args: Vec<String>) -> Result<()> {\n    info!(\"apt-get {}\", args.join(\" \"));\n    let output = Command::new(\"apt-get\")\n        .args(&args)\n        .env(\"DEBIAN_FRONTEND\", \"noninteractive\")\n        .output()\n        .wrap_err(\"running apt-get for OCI system packages\")?;\n    if !output.status.success() {\n        bail!(\n            \"apt-get failed while installing OCI system packages: {}\\n{}\",\n            output.status,\n            String::from_utf8_lossy(&output.stderr).trim()\n        );\n    }\n    Ok(())\n}\n\n/// Normalize the non-reproducible state that apt/dpkg postinstall scripts\n/// leave behind, so re-running `mise oci build` with identical inputs yields a\n/// byte-identical package layer (the reproducibility guarantee mise documents).\n/// Everything cleared here is a regenerable cache, a timestamped log, or a\n/// first-boot sentinel, never real package content.\nfn clean_apt_transients(rootfs: &Path) -> Result<()> {\n    // apt's own download cache and package lists.\n    remove_dir_children(&rootfs.join(\"var/cache/apt/archives\"))?;\n    remove_path(&rootfs.join(\"var/cache/apt/pkgcache.bin\"))?;\n    remove_path(&rootfs.join(\"var/cache/apt/srcpkgcache.bin\"))?;","sourceCodeStart":480,"sourceCodeEnd":516,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/oci/packages.rs#L480-L516","documentation":"mise runs host `apt-get` (with DEBIAN_FRONTEND=noninteractive and dpkg force-not-root options) against the unpacked base image rootfs. This error means an apt-get invocation exited non-zero; the exit status and apt's stderr are included in the message, which is where the real cause (unable to locate package, repo 404, hash mismatch) appears.","triggerScenarios":"`apt-get update`/`apt-get install` failing inside the prepared rootfs: mistyped package name, version pin not in the suite, stale or unreachable apt mirrors, GPG/hash-sum-mismatch on stale indexes, or an architecture mismatch for the target platform.","commonSituations":"Debian/Ubuntu base pinned to an EOL suite whose archives moved to archive.debian.org; package renamed between releases; CI runners with flaky egress to deb.debian.org; private apt mirrors requiring auth not present in the base image.","solutions":["Read the stderr in the message — apt prints the exact failing package/repo line","Reproduce with `docker run --rm debian:bookworm-slim sh -c 'apt-get update && apt-get install -y <pkgs>'` to validate names and pins for that suite","Bump the base image to a supported release if the suite is EOL","Fix the pin: use `\"any\"` or a `name=version` that exists in the base's suite"],"exampleFix":"# before (mise.toml) — old Ubuntu suite, package renamed\nbase_image = \"ubuntu:20.04\"\n[bootstrap.packages.apt]\nripgrep = \"11.0.2-1build1\"\n\n# after — current base, unpinned\nbase_image = \"ubuntu:24.04\"\n[bootstrap.packages.apt]\nripgrep = \"any\"","handlingStrategy":"try-catch","validationCode":"# Resolve the package set against the matching Debian/Ubuntu suite first:\ndocker run --rm debian:bookworm-slim sh -c 'apt-get update -qq && apt-get install --dry-run ripgrep' >/dev/null \\\n  && echo ok || echo \"package/repo problem — fix before mise oci build\"","typeGuard":null,"tryCatchPattern":"// When shelling out to `mise oci build`:\nlet out = std::process::Command::new(\"mise\").args([\"oci\", \"build\"]).output()?;\nif !out.status.success() {\n    let msg = String::from_utf8_lossy(&out.stderr);\n    if msg.contains(\"apt-get failed while installing\") {\n        // apt's stderr (E: Unable to locate package, 404 repo, hash mismatch)\n        // is appended after the newline — branch on it:\n        // 'Unable to locate' → fix names; '404'/'Hash Sum' → base suite issue.\n        eprintln!(\"apt-get failure — inspect embedded stderr:\\n{msg}\");\n    }\n}","preventionTips":["Dry-run `apt-get install --dry-run` against the same suite in CI before the oci build","Keep base images on supported (non-EOL) releases so mirrors stay reachable","Prefer `\"any\"` pins; verify exact `name=version` pins exist in the base's suite"],"tags":["mise","oci","apt","subprocess","package-install","debian","ubuntu"],"backgroundTag":"package-install-failed","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}