jdx/mise · error · eyre::Report

apt-get failed while installing OCI system packages: {} {}

Error message

apt-get failed while installing OCI system packages: {}
{}

What it means

mise runs host `apt-get` (with DEBIAN_FRONTEND=noninteractive and dpkg force-not-root options) against the unpacked base image rootfs. This error means an apt-get invocation exited non-zero; the exit status and apt's stderr are included in the message, which is where the real cause (unable to locate package, repo 404, hash mismatch) appears.

Source

Thrown at src/oci/packages.rs:498

        "APT::Sandbox::User=root".to_string(),
        "-o".to_string(),
        format!("APT::Architecture={}", apt_architecture(architecture)?),
        "-o".to_string(),
        format!("DPkg::Options::=--root={}", rootfs.display()),
        "-o".to_string(),
        "DPkg::Options::=--force-not-root".to_string(),
    ])
}

fn run_apt_get(args: Vec<String>) -> Result<()> {
    info!("apt-get {}", args.join(" "));
    let output = Command::new("apt-get")
        .args(&args)
        .env("DEBIAN_FRONTEND", "noninteractive")
        .output()
        .wrap_err("running apt-get for OCI system packages")?;
    if !output.status.success() {
        bail!(
            "apt-get failed while installing OCI system packages: {}\n{}",
            output.status,
            String::from_utf8_lossy(&output.stderr).trim()
        );
    }
    Ok(())
}

/// Normalize the non-reproducible state that apt/dpkg postinstall scripts
/// leave behind, so re-running `mise oci build` with identical inputs yields a
/// byte-identical package layer (the reproducibility guarantee mise documents).
/// Everything cleared here is a regenerable cache, a timestamped log, or a
/// first-boot sentinel, never real package content.
fn clean_apt_transients(rootfs: &Path) -> Result<()> {
    // apt's own download cache and package lists.
    remove_dir_children(&rootfs.join("var/cache/apt/archives"))?;
    remove_path(&rootfs.join("var/cache/apt/pkgcache.bin"))?;
    remove_path(&rootfs.join("var/cache/apt/srcpkgcache.bin"))?;

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

1. Read the stderr in the message — apt prints the exact failing package/repo line
2. Reproduce with `docker run --rm debian:bookworm-slim sh -c 'apt-get update && apt-get install -y <pkgs>'` to validate names and pins for that suite
3. Bump the base image to a supported release if the suite is EOL
4. Fix the pin: use `"any"` or a `name=version` that exists in the base's suite

Example fix

# before (mise.toml) — old Ubuntu suite, package renamed
base_image = "ubuntu:20.04"
[bootstrap.packages.apt]
ripgrep = "11.0.2-1build1"

# after — current base, unpinned
base_image = "ubuntu:24.04"
[bootstrap.packages.apt]
ripgrep = "any"

# Resolve the package set against the matching Debian/Ubuntu suite first:
docker run --rm debian:bookworm-slim sh -c 'apt-get update -qq && apt-get install --dry-run ripgrep' >/dev/null \
  && echo ok || echo "package/repo problem — fix before mise oci build"

// When shelling out to `mise oci build`:
let out = std::process::Command::new("mise").args(["oci", "build"]).output()?;
if !out.status.success() {
    let msg = String::from_utf8_lossy(&out.stderr);
    if msg.contains("apt-get failed while installing") {
        // apt's stderr (E: Unable to locate package, 404 repo, hash mismatch)
        // is appended after the newline — branch on it:
        // 'Unable to locate' → fix names; '404'/'Hash Sum' → base suite issue.
        eprintln!("apt-get failure — inspect embedded stderr:\n{msg}");
    }
}

When it happens

Trigger: `apt-get update`/`apt-get install` failing inside the prepared rootfs: mistyped package name, version pin not in the suite, stale or unreachable apt mirrors, GPG/hash-sum-mismatch on stale indexes, or an architecture mismatch for the target platform.

Common situations: Debian/Ubuntu base pinned to an EOL suite whose archives moved to archive.debian.org; package renamed between releases; CI runners with flaky egress to deb.debian.org; private apt mirrors requiring auth not present in the base image.

Related errors

• apk failed while installing OCI system packages: {} {}
• dpkg-query failed: {}
• mise oci found apt packages in [bootstrap.packages], but the
• apt system packages are not supported for OCI architecture {
• mise oci: no project mise config found in the current direct

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/a83d7207b93ce84e. Report an issue: GitHub.