apt-get failed while installing OCI system packages

Error message

apt-get failed while installing OCI system packages: {}
{}

What it means

mise runs the host `apt-get` binary (with DEBIAN_FRONTEND=noninteractive) to install system packages into the OCI rootfs; a non-zero exit status produces this error carrying the status and trimmed stderr. It indicates an apt-level failure such as unresolvable dependencies or missing packages.

Solutions

Read the stderr in the error message; fix or remove the offending package from `[bootstrap.packages]`.
Ensure apt lists are fresh (mise's prepare step usually updates; check the base image wasn't trimmed).
Check network access to Debian/Ubuntu mirrors in the build environment.
Verify the package exists for the mapped apt architecture (amd64/arm64).

Example fix

# before (mise.toml)
[bootstrap.packages]
apt = ["build-essental"]  # typo

# after
[bootstrap.packages]
apt = ["build-essential"]

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-check that package names exist in Debian/Ubuntu repos
// apt-cache policy <pkg> or rmadison <pkg> before adding to [bootstrap.packages]

Try / catch

try { await miseOciBuild(cfg) } catch (e) { if (String(e).startsWith('apt-get failed while installing OCI system packages')) { console.error('apt-get stderr:', e.message.split('\n').slice(1).join('\n')); process.exit(1); } throw e; }

Prevention

Verify package names with `apt-cache`/`rmadison` before adding them to config.
Ensure CI can reach Debian/Ubuntu mirrors.
Use a base image whose apt lists are up to date.
Confirm package availability for the mapped apt arch (amd64/arm64).

When it happens

Trigger: `apt_install_into_rootfs` -> `run_apt_get` executes `apt-get install ...` against the rootfs and the process exits non-zero.

Common situations: Typo'd apt package names; apt lists not updated in the base image (run `apt-get update` first); unreachable Ubuntu/Debian mirrors from CI; architecture-unavailable packages.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/a83d7207b93ce84e. Report an issue: GitHub.

Appendix: source

Thrown at src/oci/packages.rs:498

        "APT::Sandbox::User=root".to_string(),
        "-o".to_string(),
        format!("APT::Architecture={}", apt_architecture(architecture)?),
        "-o".to_string(),
        format!("DPkg::Options::=--root={}", rootfs.display()),
        "-o".to_string(),
        "DPkg::Options::=--force-not-root".to_string(),
    ])
}

fn run_apt_get(args: Vec<String>) -> Result<()> {
    info!("apt-get {}", args.join(" "));
    let output = Command::new("apt-get")
        .args(&args)
        .env("DEBIAN_FRONTEND", "noninteractive")
        .output()
        .wrap_err("running apt-get for OCI system packages")?;
    if !output.status.success() {
        bail!(
            "apt-get failed while installing OCI system packages: {}\n{}",
            output.status,
            String::from_utf8_lossy(&output.stderr).trim()
        );
    }
    Ok(())
}

/// Normalize the non-reproducible state that apt/dpkg postinstall scripts
/// leave behind, so re-running `mise oci build` with identical inputs yields a
/// byte-identical package layer (the reproducibility guarantee mise documents).
/// Everything cleared here is a regenerable cache, a timestamped log, or a
/// first-boot sentinel, never real package content.
fn clean_apt_transients(rootfs: &Path) -> Result<()> {
    // apt's own download cache and package lists.
    remove_dir_children(&rootfs.join("var/cache/apt/archives"))?;
    remove_path(&rootfs.join("var/cache/apt/pkgcache.bin"))?;
    remove_path(&rootfs.join("var/cache/apt/srcpkgcache.bin"))?;

View on GitHub (pinned to 533346cc37)