jdx/mise · error · eyre::Report

mise oci needs to run as root to install apk system packages

Error message

mise oci needs to run as root to install apk system packages because apk executes package scripts in a chroot

What it means

apk executes package maintainer scripts inside a chroot of the image rootfs, which requires root privileges (chroot(2) needs CAP_SYS_CHROOT, and apk's script environment assumes uid 0). validate_host_requirements enforces is_root() before attempting the install so the failure surfaces immediately instead of as a cryptic chroot error mid-build.

Source

Thrown at src/oci/packages.rs:140

            .join(", ")
    );
    Ok(Some(SystemPackagesLayer {
        blob: layer::build_layer_from_dir_preserve_metadata(&diff_dir, "")?,
        manager: manager.name(),
    }))
}

fn validate_host_requirements(manager: OciPackageManager) -> Result<()> {
    match manager {
        OciPackageManager::Apk => {
            if std::env::consts::OS != "linux" {
                bail!("mise oci needs a Linux host to install apk system packages into an image");
            }
            if file::which("apk").is_none() {
                bail!("mise oci needs `apk` on PATH to install apk system packages into the image");
            }
            if !crate::system::sudo::is_root() {
                bail!(
                    "mise oci needs to run as root to install apk system packages because apk \
                     executes package scripts in a chroot"
                );
            }
        }
        OciPackageManager::Apt => {
            if file::which("apt-get").is_none() {
                bail!(
                    "mise oci needs `apt-get` on PATH to install apt system packages into the image"
                );
            }
            if file::which("dpkg").is_none() {
                bail!(
                    "mise oci needs `dpkg` on PATH to install apt system packages into the image"
                );
            }
        }
    }

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

Run the build as root: sudo -E mise oci build (preserve env so mise settings survive).
In CI, run the job in a container whose default user is root (typical for alpine images).
Or switch to apt/debian, whose path does not require root (dpkg-based extraction with --root).

Example fix

# before
mise oci build                 # non-root on alpine

# after
sudo -E mise oci build          # root + preserved mise env

Defensive patterns

Strategy: validation

Validate before calling

import os, sys
if apk_entries(config) and os.geteuid() != 0:
    sys.exit("apk layer builds need root; re-run with sudo -E or a root CI container")

Prevention

Run apk-based builds as root (sudo -E mise oci build) or in root-default CI containers.
Prefer the apt/debian path on hosts where running as root is unacceptable.
Verify effective uid, not the sudo flag — dropped privileges still trip the chroot later.

When it happens

Trigger: mise oci build with apk packages on an Alpine host while running as a non-root user (no sudo, or sudo mise loses env).

Common situations: Default non-root CI user; running mise via sudo but with a restricted env; alpine dev container running as normal user.

Related errors

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/f1cea3f992c9cd5b. Report an issue: GitHub.