{"record":{"id":"f1cea3f992c9cd5b","repo":"jdx/mise","slug":"mise-oci-needs-to-run-as-root-to-install-apk-syste","errorCode":null,"errorMessage":"mise oci needs to run as root to install apk system packages because apk executes package scripts in a chroot","messagePattern":"mise oci needs to run as root to install apk system packages because apk executes package scripts in a chroot","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/oci/packages.rs","lineNumber":140,"sourceCode":"            .join(\", \")\n    );\n    Ok(Some(SystemPackagesLayer {\n        blob: layer::build_layer_from_dir_preserve_metadata(&diff_dir, \"\")?,\n        manager: manager.name(),\n    }))\n}\n\nfn validate_host_requirements(manager: OciPackageManager) -> Result<()> {\n    match manager {\n        OciPackageManager::Apk => {\n            if std::env::consts::OS != \"linux\" {\n                bail!(\"mise oci needs a Linux host to install apk system packages into an image\");\n            }\n            if file::which(\"apk\").is_none() {\n                bail!(\"mise oci needs `apk` on PATH to install apk system packages into the image\");\n            }\n            if !crate::system::sudo::is_root() {\n                bail!(\n                    \"mise oci needs to run as root to install apk system packages because apk \\\n                     executes package scripts in a chroot\"\n                );\n            }\n        }\n        OciPackageManager::Apt => {\n            if file::which(\"apt-get\").is_none() {\n                bail!(\n                    \"mise oci needs `apt-get` on PATH to install apt system packages into the image\"\n                );\n            }\n            if file::which(\"dpkg\").is_none() {\n                bail!(\n                    \"mise oci needs `dpkg` on PATH to install apt system packages into the image\"\n                );\n            }\n        }\n    }","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/oci/packages.rs#L122-L158","documentation":"apk executes maintainer package scripts inside a chroot of the target image filesystem, which requires root privileges. mise checks `crate::system::sudo::is_root()` and refuses to install apk packages when not running as root.","triggerScenarios":"Running `mise oci build` with `[bootstrap.packages] apk = [...]` on a Linux host with apk on PATH, but the current user is not root (no effective sudo/root).","commonSituations":"Running mise oci build as an unprivileged user locally; CI runners with non-root users; forgetting `sudo` for image-building commands.","solutions":["Run the build with root privileges (e.g. `sudo -E mise oci build` or root CI container)","In CI, configure the job's container/user to run as root","Use a builder (e.g. inside a privileged Docker container) where root is available","Alternatively avoid apk packages and pre-bake them into a base image"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"[ \"$(id -u)\" -eq 0 ] || echo \"apk image installs must run as root\"","typeGuard":null,"tryCatchPattern":"match build() {\n    Err(e) if e.to_string().contains(\"needs to run as root\") => {\n        eprintln!(\"rerun with sudo or in a root CI container\");\n    }\n    r => r,\n}","preventionTips":["Run image-building commands under sudo or a root container","Configure CI jobs to execute as root when apk layers are involved","Avoid interleaving root-required builds with unprivileged scripts","Consider pre-baked base images to avoid needing root locally"],"tags":["oci","apk","permissions","root"],"backgroundTag":"insufficient-permissions","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}