From 520dc06d615794f42dd08f10a8e9fcedb24b4b53 Mon Sep 17 00:00:00 2001 From: Ruoyu Zhong Date: Sun, 3 May 2026 19:54:32 +0800 Subject: [PATCH] Dockerfile: do not let `apt-get update` errors slip through When `apt-get update` fails to fetch from a repository due to a transient network error, its default behavior is to issue a warning and continue [^1]. When the git-core PPA is unavailable (which is currently the case due to an ongoing DDoS incident), this causes `apt-get install` to install an outdated version of `git` from the default Ubuntu repositories. To avoid this, let's set `--error-on=any` for `apt-get update`, which causes it to error out on such transient network errors [^2]. This option is available since Ubuntu 21.04 and is equivalent to the APT option `APT::Update::Error-Mode=any` [^3]. See below how `--error-on=any` turns the warning into an error: linuxbrew@c557e2acccfe:~$ sudo apt-get update Hit:1 https://cli.github.com/packages stable InRelease Hit:2 http://archive.ubuntu.com/ubuntu jammy InRelease Hit:3 http://security.ubuntu.com/ubuntu jammy-security InRelease Hit:4 http://archive.ubuntu.com/ubuntu jammy-updates InRelease Hit:5 http://archive.ubuntu.com/ubuntu jammy-backports InRelease Ign:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease Ign:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease Ign:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease Err:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease Could not connect to ppa.launchpadcontent.net:443 (185.125.190.80), connection timed out Reading package lists... Done W: Failed to fetch https://ppa.launchpadcontent.net/git-core/ppa/ubuntu/dists/jammy/InRelease Could not connect to ppa.launchpadcontent.net:443 (185.125.190.80), connection timed out W: Some index files failed to download. They have been ignored, or old ones used instead. linuxbrew@c557e2acccfe:~$ sudo apt-get update --error-on=any Hit:1 https://cli.github.com/packages stable InRelease Hit:2 http://archive.ubuntu.com/ubuntu jammy InRelease Hit:3 http://security.ubuntu.com/ubuntu jammy-security InRelease Hit:4 http://archive.ubuntu.com/ubuntu jammy-updates InRelease Hit:5 http://archive.ubuntu.com/ubuntu jammy-backports InRelease Ign:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease Ign:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease Ign:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease Err:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease Could not connect to ppa.launchpadcontent.net:443 (185.125.190.80), connection timed out Reading package lists... Done E: Failed to fetch https://ppa.launchpadcontent.net/git-core/ppa/ubuntu/dists/jammy/InRelease Could not connect to ppa.launchpadcontent.net:443 (185.125.190.80), connection timed out E: Some index files failed to download. They have been ignored, or old ones used instead. [^1]: https://github.com/Debian/apt/blob/6b128124271e94bdb0f4e7850d9286170d712b04/apt-pkg/update.cc#L136-L139 [^2]: https://manpages.debian.org/trixie/apt/apt-get.8.en.html [^3]: https://lists.ubuntu.com/archives/ubuntu-devel/2021-February/041374.html --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 549b5ff694..28116d422c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -19,10 +19,10 @@ RUN touch /var/mail/ubuntu && chown ubuntu /var/mail/ubuntu && userdel -r ubuntu # We need `[` instead of `[[` because the shell is `/bin/sh`. # shellcheck disable=SC1091,SC2154,SC2292 RUN retry() { bash -c 'for i in {1..5}; do "$@" && exit 0; [[ $((i)) -lt 5 ]] && sleep $((i)); done; exit 1' -- "$@"; } \ - && retry apt-get update \ + && retry apt-get update --error-on=any \ && apt-get install -y --no-install-recommends software-properties-common gnupg-agent \ && if [ "$(uname -m)" != aarch64 ]; then retry add-apt-repository -y ppa:git-core/ppa; fi \ - && apt-get update \ + && retry apt-get update --error-on=any \ && apt-get install -y --no-install-recommends \ acl \ bzip2 \