mise oci needs to run as root to install apk system…

Error message

mise oci needs to run as root to install apk system packages because apk executes package scripts in a chroot

What it means

apk executes maintainer package scripts inside a chroot of the target image filesystem, which requires root privileges. mise checks `crate::system::sudo::is_root()` and refuses to install apk packages when not running as root.

Solutions

Run the build with root privileges (e.g. `sudo -E mise oci build` or root CI container)
In CI, configure the job's container/user to run as root
Use a builder (e.g. inside a privileged Docker container) where root is available
Alternatively avoid apk packages and pre-bake them into a base image

Defensive patterns

Strategy: validation

Validate before calling

[ "$(id -u)" -eq 0 ] || echo "apk image installs must run as root"

Try / catch

match build() {
    Err(e) if e.to_string().contains("needs to run as root") => {
        eprintln!("rerun with sudo or in a root CI container");
    }
    r => r,
}

Prevention

Run image-building commands under sudo or a root container
Configure CI jobs to execute as root when apk layers are involved
Avoid interleaving root-required builds with unprivileged scripts
Consider pre-baked base images to avoid needing root locally

When it happens

Trigger: Running `mise oci build` with `[bootstrap.packages] apk = [...]` on a Linux host with apk on PATH, but the current user is not root (no effective sudo/root).

Common situations: Running mise oci build as an unprivileged user locally; CI runners with non-root users; forgetting `sudo` for image-building commands.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/f1cea3f992c9cd5b. Report an issue: GitHub.

Appendix: source

Thrown at src/oci/packages.rs:140

            .join(", ")
    );
    Ok(Some(SystemPackagesLayer {
        blob: layer::build_layer_from_dir_preserve_metadata(&diff_dir, "")?,
        manager: manager.name(),
    }))
}

fn validate_host_requirements(manager: OciPackageManager) -> Result<()> {
    match manager {
        OciPackageManager::Apk => {
            if std::env::consts::OS != "linux" {
                bail!("mise oci needs a Linux host to install apk system packages into an image");
            }
            if file::which("apk").is_none() {
                bail!("mise oci needs `apk` on PATH to install apk system packages into the image");
            }
            if !crate::system::sudo::is_root() {
                bail!(
                    "mise oci needs to run as root to install apk system packages because apk \
                     executes package scripts in a chroot"
                );
            }
        }
        OciPackageManager::Apt => {
            if file::which("apt-get").is_none() {
                bail!(
                    "mise oci needs `apt-get` on PATH to install apt system packages into the image"
                );
            }
            if file::which("dpkg").is_none() {
                bail!(
                    "mise oci needs `dpkg` on PATH to install apt system packages into the image"
                );
            }
        }
    }

View on GitHub (pinned to 533346cc37)