GPG error in Ubuntu 21.04 after second apt-get update during Docker build - docker

Getting error while building the following Docker file
FROM ubuntu:21.04
RUN apt-get update && \
apt-get install --no-install-recommends -y curl=7.\* && \
apt-get install --no-install-recommends -y unzip=6.\* &&\
rm -rf /var/lib/apt/lists/*
RUN apt-get update && \
mkdir -p /usr/share/man/man1 && \
apt-get install --no-install-recommends -y maven=3.6.3-5 && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*
The error occurs when the second apt-get update runs.
The error is as follows :-
E: The repository 'http://security.ubuntu.com/ubuntu hirsute-security InRelease' is not signed.
W: GPG error: http://archive.ubuntu.com/ubuntu hirsute InRelease: gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
E: The repository 'http://archive.ubuntu.com/ubuntu hirsute InRelease' is not signed.
W: GPG error: http://archive.ubuntu.com/ubuntu hirsute-updates InRelease: gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
E: The repository 'http://archive.ubuntu.com/ubuntu hirsute-updates InRelease' is not signed.
W: GPG error: http://archive.ubuntu.com/ubuntu hirsute-backports InRelease: gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
E: The repository 'http://archive.ubuntu.com/ubuntu hirsute-backports InRelease' is not signed.
Any kind of help would be appreciated.

That's a bug in the docker / seccomp / glibc interaction: https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1916485

I've run your docker file and get the same error. Playing around with various ways to disable the verification also produced no good results. Neither did removing the version constraints and just installing the latest versions of the tools. The only solution I could find was to downgrade ubuntu to 20.04, but there is no 3.6.3-5 version of maven for that version of the OS, only 3.6.3-1 (afaik).
The closest I could get working is quite different from your desired image:
FROM ubuntu:20.04
RUN apt update && \
apt install --no-install-recommends -y curl=7.\* unzip=6.\* maven=3.6.3-1 && \
apt clean && \
rm -rf /var/lib/apt/lists/* && \
mkdir -p /usr/share/man/man1
Also note how I use apt rather than apt-get and I only do a single run (which makes a simpler image by having only a single layer) and only a single apt update and chain the things I want to install into a single apt install rather than separate ones. This is just quicker and easier.
However, if you want a maven build box, perhaps you'd be better advised using one of the prebuilt maven images from docker hub that are themselves based on openjdk images. For java the underlying linux distro rarely matters and the openjdk images are pretty well respected:
from maven:3.6.3-jdk-11
run apt update && apt install -y curl unzip && apt clean

This bug does not occur if using a newer version of Docker (tested with 20.10). If using an older version of Docker, I recommend switching to a previous version of the ubuntu image. I tested ubuntu:20.10 with Docker 19.03 and it worked just fine. This is discussed here: https://bugs.launchpad.net/cloud-images/+bug/1928218

Update Docker version to the latest to solve this issue.
For ubuntu users follow these steps:
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
For others please refer this link: https://docs.docker.com/engine/install/

I ran into this problem when I was running the Ubuntu 21.04 image under Rootless Docker, but the apt-get update command worked fine under the system Docker (invoked via sudo). Since my need was just for a manual test of an environment setup script, I just ran under the system Docker but, depending on your application, that might not be secure.

Substituting apt-get with apt has worked for me.

Related

The repository 'http://packages.cloud.google.com/apt gcsfuse-bionic InRelease' is not signed

I'm having an issue building a docker image from a dockerfile that used to work:
(My dockerfile has more steps, but this is enough to reproduce)
FROM gcr.io/deeplearning-platform-release/tf2-gpu.2-2
RUN apt-get update && \
apt-get install --no-install-recommends -y libsndfile-dev
ENTRYPOINT ["ls", "-l"]
When running docker build, I get the following errors (in step 2):
W: GPG error: http://packages.cloud.google.com/apt gcsfuse-bionic InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY [some key] NO_PUBKEY [some key]
E: The repository 'http://packages.cloud.google.com/apt gcsfuse-bionic InRelease' is not signed.
W: GPG error: http://packages.cloud.google.com/apt cloud-sdk-bionic InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY [some key] NO_PUBKEY [some key]
E: The repository 'http://packages.cloud.google.com/apt cloud-sdk-bionic InRelease' is not signed.
I've tried both on my local machine and cloud builds (on google cloud), with no success.
Starting from the image tf2-gpu.2-4 instead of tf2-gpu.2-2 works, but that version is incompatible with other dependencies I rely on.
Note that the combination tf2-gpu.2-2 and libsndfile-dev worked fine before but doesn't anymore.
Why am I getting those errors and what can I do to fix them ?
Thanks!
This is a known issue. Read this for more info.
You can first add the correct repository GPG key using the following command.
curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
Updated Dockerfile would be:
FROM gcr.io/deeplearning-platform-release/tf2-gpu.2-2
RUN curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
RUN apt-get update && \
apt-get install --no-install-recommends -y libsndfile-dev
ENTRYPOINT ["ls", "-l"]
Your issue seems related to this Github issue
A dirty workaround is adding --allow-unauthenticated to your apt-get install in order to bypass the signature issue. However, I recommend you dig deeper into it to find a fix instead of a workaround.
Most likely this has to do with either your Linux version (version of the source image), apt version, or even the package version itself could be deprecated.
So your Dockerfile would look like this:
FROM gcr.io/deeplearning-platform-release/tf2-gpu.2-2
RUN apt-get update && \
apt-get install --no-install-recommends -y libsndfile-dev
ENTRYPOINT ["ls", "-l"]
Hopefully, someone else more familiar with your packages can propose a better approach.

Unable to install apt-transport-https on Raspberry Pi 4

I want to install docker on raspberry, i used the script on docker:https://docs.docker.com/engine/install/debian/#install-using-the-convenience-script
I run the script, then i met this issue:
sudo sh get-docker.sh
# Executing docker install script, commit: 442e66405c304fa92af8aadaa1d9b31bf4b0ad94
+ sh -c apt-get update -qq >/dev/null
+ sh -c DEBIAN_FRONTEND=noninteractive apt-get -y install -qq apt-transport-https ca-certificates curl >/dev/null
E: Essential packages were removed and -y was used without --allow-remove-essential.
then i install this package alone, ca-certificates, curl is ok, but apt-transport-https met question agina:
sudo apt-get install apt-transport-https
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
python-apt-common python3-apt python3-debconf
Use 'sudo apt autoremove' to remove them.
The following additional packages will be installed:
libapt-pkg4.12
The following packages will be REMOVED:
apt apt-listchanges apt-utils tasksel tasksel-data
The following NEW packages will be installed:
apt-transport-https libapt-pkg4.12
WARNING: The following essential packages will be removed.
This should NOT be done unless you know exactly what you are doing!
apt
0 upgraded, 2 newly installed, 5 to remove and 0 not upgraded.
Need to get 847 kB of archives.
After this operation, 3,112 kB disk space will be freed.
You are about to do something potentially harmful.
To continue type in the phrase 'Yes, do as I say!'
?]

Prevent nvidia-docker from installing nvidia drivers with debian package

I am trying to create an nvidia-docker image with installed TensorRT for my specific application. I can't use any of the provided TensortRT base images, as they are using CUDA version not compatible with the application, but I have a custom TensorRT debian package which is used in my organization. The problem is, when I install it from the Dockerfile, it also installs nvidia drivers. As a result, the container is successfully created, but can't be started - the result is:
svc_moma_usr#PL1LXD-529389:~/gutkowsp/Docker_projects/test_cuda$ nvidia-docker run tensorrt-test
docker: Error response from daemon: OCI runtime create failed: container_linux.go:346: starting container process caused "process_linux.go:449: container init caused \"process_linux.go:432: running prestart hook 1 caused \\\"error running hook: exit status 1, stdout: , stderr: nvidia-container-cli: mount error: file creation failed: /var/lib/docker/overlay2/97f449ff2535b1ad304520dae75c613931888658a66b89235b0d040a872a625c/merged/usr/bin/nvidia-smi: file exists\\\\n\\\"\"": unknown.
ERRO[0001] error waiting for container: context canceled
The dockerfile is:
FROM nvidia/cuda:9.1-devel-ubuntu16.04
ENV DEBIAN_FRONTEND noninteractive
ENV CUDNN_VERSION 7.0.5.15
LABEL com.nvidia.cudnn.version="${CUDNN_VERSION}"
RUN apt update -y && \
apt install software-properties-common -y && \
apt-add-repository --yes --update ppa:ansible/ansible && \
apt install ansible -y
RUN apt update -y && \
apt install -y --no-install-recommends \
libcudnn7=$CUDNN_VERSION-1+cuda9.1 \
libcudnn7-dev=$CUDNN_VERSION-1+cuda9.1
RUN apt update -y && \
apt install tensorrt -y
How this problem of unnecessary drivers is solved? This seems to me like a common issue, as in general nvidia docker images typically have installed nvidia software, which usually comes with drivers. Maybe someone can share the dockerfiles for the TensorRT images for reference?
For anyone who facing the same issue:
If necessary use CUDNN enabled docker image, like 11.7.1-cudnn8-runtime-ubuntu18.04 to avoid the necessity to install it using apt
Run apt update
Run apt install <your package> -y --dry-run | grep nvidia
Add all listed nvidia packages to apt ignore list - add a dash after the package name with an asterisk in place of version number
apt install <your package> libnvidia-compute-*-server- \
libnvidia-compute-*- --dry-run | grep nvidia
Make sure that none of nvidia packages will be installed. If necessary add newly discovered packages to ignore list.
If everything is OK then remove --dry-run flag and install your package
apt install <your package> libnvidia-compute-*-server- libnvidia-compute-*-

Docker build fails in apt-get

I'm getting an error during build. I've seen many similar questions but nothing seems to solve this issue.
I'm running Docker (Version 17.06.0-ce-mac18) on OS X El Capitan.
My Dockerfile is:
FROM ubuntu:14.04
RUN apt-get update && apt-get install -y -q git
I'm getting Bad Request 400 error from one of git dependencies:
Get:38 http://archive.ubuntu.com/ubuntu/ trusty-updates/main patch amd64 2.7.1-4ubuntu2.3 [86.4 kB]
Fetched 7619 kB in 5s (1367 kB/s)
E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/main/libx/libx11/libx11-data_1.6.2-1ubuntu2_all.deb 400 Bad Request [IP: 91.189.88.162 80]
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
The command '/bin/sh -c apt-get update && apt-get install -y -q git' returned a non-zero code: 100
Any explanations or ideas for workaround?
I think the mirror being used is not reachable at the moment,
You can try changing mirrors in for ubuntu from your docker file using sed.
You can also use ubuntu's mirror protocol, which will fetch mirrors located within your country:
FROM ubuntu:14.04
RUN sed -i -e 's/http:\/\/archive/mirror:\/\/mirrors/' -e 's/\/ubuntu\//\/mirrors.txt/' /etc/apt/sources.list
RUN apt-get update && apt-get install -y -q git
You can even specify a specific mirror you want to be used in the same way.
For more information about apt mirrors refer to this post
I think the problem come from the fact that you are using ubuntu:14.04 which is deprecated (https://askubuntu.com/questions/731891/not-able-to-install-anything-and-update-on-ubuntu-14-10)
Can you try with FROM ubuntu ? This will use the latest ubuntu image, which is 16.04.
EDIT: Ubuntu 14.04 is an LTS, so as pointed by #jwodder it should still be supported. I would still try to use the latest LTS (16.04) with FROM ubuntu as it might be an easy fix.

Docker Debian install fails

I have a Dockerfile that works, but if I add any new dependencies to the apt-get install command, it fails. For example, this works:
FROM debian:stable
RUN apt-get update
RUN apt-get install -y \
python \
...
apache2
But if I try this, it fails:
FROM debian:stable
RUN apt-get update
RUN apt-get install -y \
python \
...
apache2
python-mysqldb
I can replace python-mysqldb with anything else, git-core, for example, and it will still fail with the same error message:
Unable to correct missing packages.
E: Failed to fetch http://security.debian.org/pool/updates/main/l/linux/linux-libc-dev_3.16.7-ckt11-1+deb8u5_amd64.deb 404 Not Found [IP: 149.20.20.6 80]
E: Aborting install.
Any thoughts on why adding a new dependency causes the failure and how to fix it?
I've found that you need to join the update & install command into the same RUN block.
eg:
RUN apt-get update \
&& apt-get install -y \
python \
...
apache2 \
python-mysqldb
According to this post describing the issue
By default, Docker cache your commands to reduce time spent building
images. Unless there was any change before such commands (or at the
same line).
Meanwhile, I notice that the AWS examples separate them, as you have them. So I dunno if it works different there. Maybe they disable the cache by default.

Resources