{"record":{"id":"f1cea3f992c9cd5b","repo":"jdx/mise","slug":"mise-oci-needs-to-run-as-root-to-install-apk-syste","errorCode":null,"errorMessage":"mise oci needs to run as root to install apk system packages because apk executes package scripts in a chroot","messagePattern":"mise oci needs to run as root to install apk system packages because apk executes package scripts in a chroot","errorType":"exception","errorClass":"eyre::Report","httpStatus":null,"severity":"error","filePath":"src/oci/packages.rs","lineNumber":140,"sourceCode":"            .join(\", \")\n    );\n    Ok(Some(SystemPackagesLayer {\n        blob: layer::build_layer_from_dir_preserve_metadata(&diff_dir, \"\")?,\n        manager: manager.name(),\n    }))\n}\n\nfn validate_host_requirements(manager: OciPackageManager) -> Result<()> {\n    match manager {\n        OciPackageManager::Apk => {\n            if std::env::consts::OS != \"linux\" {\n                bail!(\"mise oci needs a Linux host to install apk system packages into an image\");\n            }\n            if file::which(\"apk\").is_none() {\n                bail!(\"mise oci needs `apk` on PATH to install apk system packages into the image\");\n            }\n            if !crate::system::sudo::is_root() {\n                bail!(\n                    \"mise oci needs to run as root to install apk system packages because apk \\\n                     executes package scripts in a chroot\"\n                );\n            }\n        }\n        OciPackageManager::Apt => {\n            if file::which(\"apt-get\").is_none() {\n                bail!(\n                    \"mise oci needs `apt-get` on PATH to install apt system packages into the image\"\n                );\n            }\n            if file::which(\"dpkg\").is_none() {\n                bail!(\n                    \"mise oci needs `dpkg` on PATH to install apt system packages into the image\"\n                );\n            }\n        }\n    }","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/oci/packages.rs#L122-L158","documentation":"apk executes package maintainer scripts inside a chroot of the image rootfs, which requires root privileges (chroot(2) needs CAP_SYS_CHROOT, and apk's script environment assumes uid 0). validate_host_requirements enforces is_root() before attempting the install so the failure surfaces immediately instead of as a cryptic chroot error mid-build.","triggerScenarios":"mise oci build with apk packages on an Alpine host while running as a non-root user (no sudo, or sudo mise loses env).","commonSituations":"Default non-root CI user; running mise via sudo but with a restricted env; alpine dev container running as normal user.","solutions":["Run the build as root: sudo -E mise oci build (preserve env so mise settings survive).","In CI, run the job in a container whose default user is root (typical for alpine images).","Or switch to apt/debian, whose path does not require root (dpkg-based extraction with --root)."],"exampleFix":"# before\nmise oci build                 # non-root on alpine\n\n# after\nsudo -E mise oci build          # root + preserved mise env","handlingStrategy":"validation","validationCode":"import os, sys\nif apk_entries(config) and os.geteuid() != 0:\n    sys.exit(\"apk layer builds need root; re-run with sudo -E or a root CI container\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run apk-based builds as root (sudo -E mise oci build) or in root-default CI containers.","Prefer the apt/debian path on hosts where running as root is unacceptable.","Verify effective uid, not the sudo flag — dropped privileges still trip the chroot later."],"tags":["oci","packages","apk","root","privileges"],"backgroundTag":"insufficient-privileges","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}