mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix: clear stale APT lists before apt-get update in Dockerfiles
Some checks failed
ci/woodpecker/push/coordinator Pipeline failed
Details
ci/woodpecker/push/api Pipeline failed
Details
ci/woodpecker/push/orchestrator Pipeline failed
Details
ci/woodpecker/push/web Pipeline failed
Details

Browse Source 
Kaniko's layer extraction can leave base-image APT metadata with
expired GPG signatures, causing "invalid signature" failures during
apt-get update in CI builds. Adding rm -rf /var/lib/apt/lists/*
before apt-get update ensures a clean state.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jason Woltje
2026-02-16 19:44:36 -06:00
parent d58bf47cd7
commit 0c93be417a
4 changed files with 20 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
apps/api/Dockerfile
View File

@@ -61,7 +61,11 @@ FROM node:24-slim AS production
RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
# Install dumb-init for proper signal handling # Install dumb-init for proper signal handling
RUN apt-get update && apt-get install -y --no-install-recommends dumb-init \ # Clear stale APT lists first — Kaniko's layer extraction can leave
# base-image metadata with expired GPG signatures (bookworm InRelease).
RUN rm -rf /var/lib/apt/lists/* \
&& apt-get update \
&& apt-get install -y --no-install-recommends dumb-init \
&& rm -rf /var/lib/apt/lists/* && rm -rf /var/lib/apt/lists/*
# Create non-root user # Create non-root user

8
apps/coordinator/Dockerfile
View File

@@ -4,9 +4,11 @@ FROM python:3.11-slim AS builder
WORKDIR /app WORKDIR /app
# Install build dependencies # Install build dependencies
RUN apt-get update && \ # Clear stale APT lists first — Kaniko's layer extraction can leave
apt-get install -y --no-install-recommends \ # base-image metadata with expired GPG signatures (bookworm InRelease).
build-essential \ RUN rm -rf /var/lib/apt/lists/* \
&& apt-get update \
&& apt-get install -y --no-install-recommends build-essential \
&& rm -rf /var/lib/apt/lists/* && rm -rf /var/lib/apt/lists/*
# Copy dependency files and private registry config # Copy dependency files and private registry config

6
apps/orchestrator/Dockerfile
View File

@@ -73,7 +73,11 @@ LABEL org.opencontainers.image.description="Agent orchestration service for Mosa
RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
# Install wget and dumb-init # Install wget and dumb-init
RUN apt-get update && apt-get install -y --no-install-recommends wget dumb-init \ # Clear stale APT lists first — Kaniko's layer extraction can leave
# base-image metadata with expired GPG signatures (bookworm InRelease).
RUN rm -rf /var/lib/apt/lists/* \
&& apt-get update \
&& apt-get install -y --no-install-recommends wget dumb-init \
&& rm -rf /var/lib/apt/lists/* && rm -rf /var/lib/apt/lists/*
# Create non-root user # Create non-root user

6
apps/web/Dockerfile
View File

@@ -86,7 +86,11 @@ RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
RUN corepack enable && corepack prepare pnpm@10.27.0 --activate RUN corepack enable && corepack prepare pnpm@10.27.0 --activate
# Install dumb-init for proper signal handling # Install dumb-init for proper signal handling
RUN apt-get update && apt-get install -y --no-install-recommends dumb-init \ # Clear stale APT lists first — Kaniko's layer extraction can leave
# base-image metadata with expired GPG signatures (bookworm InRelease).
RUN rm -rf /var/lib/apt/lists/* \
&& apt-get update \
&& apt-get install -y --no-install-recommends dumb-init \
&& rm -rf /var/lib/apt/lists/* && rm -rf /var/lib/apt/lists/*
# Create non-root user # Create non-root user