jdx/mise · error · eyre::Report

apk failed while installing OCI system packages: {} {}

Error message

apk failed while installing OCI system packages: {}
{}

What it means

mise runs the host `apk` binary with `--root <tmp rootfs>` to install the requested packages into the unpacked base image. This error means the apk subprocess exited non-zero; mise surfaces the exit status plus apk's stderr verbatim, so the actual cause (unknown package, bad version pin, unreachable repo, DNS failure) is in the message body.

Source

Thrown at src/oci/packages.rs:376

        "--root".to_string(),
        rootfs.display().to_string(),
        "--arch".to_string(),
        apk_architecture(architecture)?.to_string(),
        "--no-cache".to_string(),
        "add".to_string(),
        "--".to_string(),
    ];
    args.extend(requests.iter().map(|request| match &request.version {
        Some(version) => format!("{}={version}", request.name),
        None => request.name.clone(),
    }));
    info!("apk {}", args.join(" "));
    let output = Command::new("apk")
        .args(&args)
        .output()
        .wrap_err("running apk for OCI system packages")?;
    if !output.status.success() {
        bail!(
            "apk failed while installing OCI system packages: {}\n{}",
            output.status,
            String::from_utf8_lossy(&output.stderr).trim()
        );
    }
    Ok(())
}

fn apt_install_into_rootfs(
    rootfs: &Path,
    requests: &[PackageRequest],
    architecture: &str,
) -> Result<()> {
    let status = rootfs.join("var/lib/dpkg/status");
    if let Some(parent) = status.parent() {
        file::create_dir_all(parent)?;
    }
    if !status.exists() {

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

Read the stderr appended to the message — apk names the exact failing package or repository there
Reproduce outside mise: `docker run --rm alpine:3.20 apk add <same packages>` to confirm the names/pins resolve for that release
Fix the pin: use `"any"` or a version that exists in the base image's Alpine release channel
Ensure the host has working DNS/network and, if behind a proxy, that the rootfs resolv.conf/repositories are reachable

Example fix

# before (mise.toml) — version only in Alpine edge
[bootstrap.packages.apk]
ripgrep = "14.1.1-r0"

# after — unpin or pin to the base release's version
[bootstrap.packages.apk]
ripgrep = "any"

Defensive patterns

Strategy: try-catch

Validate before calling

# Resolve the exact package set against the matching Alpine release first:
docker run --rm alpine:3.20 apk add --simulate curl ripgrep
# Exit 0 → names/pins are valid for that release; anything else fails fast
# before mise oci build spends time unpacking layers.

Try / catch

// When shelling out to `mise oci build`:
let out = std::process::Command::new("mise").args(["oci", "build"]).output()?;
if !out.status.success() {
    let msg = String::from_utf8_lossy(&out.stderr);
    if msg.contains("apk failed while installing") {
        // stderr of apk is embedded after the newline — surface it verbatim;
        // 'unable to select packages' → fix names/pins, network errors → retry.
        eprintln!("apk failure — inspect embedded apk stderr:\n{msg}");
    }
}

Prevention

Dry-run package resolution (`apk add --simulate`) against the same Alpine release in CI before the oci build
Prefer `"any"` over hard version pins unless reproducibility demands them, and verify pins exist for the base's release channel
Ensure build hosts can reach dl-cdn.alpinelinux.org (or your mirror) and DNS works inside the prepared rootfs

When it happens

Trigger: `apk add --root ... <pkgs>` failing: package name or `name=version` pin that does not exist in the base's repository branch (e.g. an edge-only version pinned on a v3.20 image), DNS/resolver missing in the chroot, missing repository signing keys, target-arch packages unavailable, or temp disk exhaustion.

Common situations: Network-restricted CI runners blocking dl-cdn.alpinelinux.org; version pins copied from a different Alpine release; corporate proxies stripping TLS; repackaged/private Alpine mirrors not configured in the base image.

Related errors

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/2898919833ae0ccf. Report an issue: GitHub.