Repository: GoogleContainerTools/kaniko

Issue #793: Kaniko build fails on apt-get reporting "unable to fetch libraries"
Created: 2019-09-27T19:03:23Z
Actual behavior
Kaniko build fails on apt-get reporting "unable to fetch libraries" while the same build succeed under 'docker build'.
A changing the docker file to rebuild the package cache per this documentation (https://sites.google.com/site/longphanwiki/basic-skills/ubuntu-linux) will solve the problem, however, these directives are not needed when running the build via docker build.
Expected behavior
The container is built successfully.
To Reproduce
Steps to reproduce the behavior:

Perform a kaniko build of the docker file listed below
Perform a docker build of this same file
Compare output

Additional Information

Dockerfile

The dockerfile that's failing under kaniko is defined below:
FROM botpress/server:v12_0_0
RUN chmod -R gou+rw /botpress
WORKDIR /botpress

RUN apt-get update \
&& apt-get -y install curl gnupg \
&& curl -sL https://deb.nodesource.com/setup_11.x | bash \
&& apt-get -y install nodejs \
&& apt-get -y install rsync \
&& apt-get upgrade -y
 
RUN cd /botpress && npm install && npm install node-sp-auth --save-dev && npm install sp-request --save-dev && npm install activedirectory --save-dev
 
EXPOSE 3000-55000
CMD ["./bp"]


Build Context
N/A
Kaniko Image (fully qualified with digest)
gcr.io/kaniko-project/executor:debug

Notes:
If you add the following directives before the apt-get install, kaniko will build the container:
RUN apt-get clean \
 && cd /var/lib/apt \
 && mv lists lists.old \
 && mkdir -p lists/partial \
 && apt-get update \
 && apt-get upgrade -y 

Question:
Is this behavior anticipated? If not, is this a bug in kaniko?

Duplicate issue #940: Impossible to build a dockerfile with continuumio/miniconda3:4.7.12
Created: 2019-12-31T16:46:48Z
I'm trying to build the following dockerfile in kaniko:
Dockerfile.txt
The command is:
/kaniko/executor --dockerfile=./Dockerfile --context=./ --destination=registry.container-registry.svc.cluster.local:5000/templates/test1:0.0.1
Follows the log with the error:

INFO[0030] Resolved base name continuumio/miniconda3:4.7.12 to continuumio/miniconda3:4.7.12
INFO[0030] Resolved base name continuumio/miniconda3:4.7.12 to continuumio/miniconda3:4.7.12
INFO[0030] Retrieving image manifest continuumio/miniconda3:4.7.12
INFO[0061] Image continuumio/miniconda3:4.7.12 not found in cache
INFO[0061] Retrieving image manifest continuumio/miniconda3:4.7.12
INFO[0082] Built cross stage deps: map[]
INFO[0082] Retrieving image manifest continuumio/miniconda3:4.7.12
INFO[0092] Image continuumio/miniconda3:4.7.12 not found in cache
INFO[0092] Retrieving image manifest continuumio/miniconda3:4.7.12
INFO[0103] Unpacking rootfs as cmd RUN set -x && apt-get update && apt-get install --no-install-recommends --no-install-suggests -y libpq-dev build-essential && rm -rf /var/lib/apt/lists/* requires it.
INFO[0114] Taking snapshot of full filesystem...
INFO[0150] ENTRYPOINT [ "/bin/bash", "-c" ]
INFO[0150] EXPOSE 5000
INFO[0150] cmd: EXPOSE
INFO[0150] Adding exposed port: 5000/tcp
INFO[0150] RUN set -x && apt-get update && apt-get install --no-install-recommends --no-install-suggests -y libpq-dev build-essential && rm -rf /var/lib/apt/lists/*
INFO[0150] cmd: /bin/sh
INFO[0150] args: [-c set -x && apt-get update && apt-get install --no-install-recommends --no-install-suggests -y libpq-dev build-essential && rm -rf /var/lib/apt/lists/*]

apt-get update
Hit:1 http://deb.debian.org/debian buster InRelease
Hit:2 http://deb.debian.org/debian buster-updates InRelease
Hit:3 http://security.debian.org/debian-security buster/updates InRelease
Reading package lists...
E: Release file for http://deb.debian.org/debian/dists/buster-updates/InRelease is expired (invalid since 69d 2h 16min 4s). Updates for this repository will not be applied.
E: Release file for http://security.debian.org/debian-security/dists/buster/updates/InRelease is expired (invalid since 69d 1h 8min 37s). Updates for this repository will not be applied.
error building image: error building stage: failed to execute command: waiting for process to exit: exit status 100


I've tried to build it with docker and it's ok.
Do you have any idea why this behavior?
Thanks in advance.

Closing comment (2020-01-17T16:57:47Z): I also encountered this issue. After some debugging I noticed that apt-get update only "Hits" the urls, so no refreshing the content. Normally I would expect out-of-date lists to be fetched. However it seems apt bases this decision on the modification date of the fetched list.
So during kaniko build I get:
INFO[0041] args: [-c stat /var/lib/apt/lists/security.debian.org_debian-security_dists_buster_updates_InRelease] 
  File: /var/lib/apt/lists/security.debian.org_debian-security_dists_buster_updates_InRelease
  Size: 65372     	Blocks: 128        IO Block: 4096   regular file
Device: 5ah/90d	Inode: 1675188     Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2020-01-14 11:04:33.420231465 +0000
Modify: 2020-01-14 11:04:26.281185105 +0000
Change: 2020-01-14 11:04:26.281185105 +0000
 Birth: -

However the same file in docker is
stat /var/lib/apt/lists/security.debian.org_debian-security_dists_buster_updates_InRelease
  File: /var/lib/apt/lists/security.debian.org_debian-security_dists_buster_updates_InRelease
  Size: 65372     	Blocks: 128        IO Block: 4096   regular file
Device: 5ah/90d	Inode: 2795291     Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2019-12-02 23:51:32.000000000 +0000
Modify: 2019-12-02 23:51:32.000000000 +0000
Change: 2020-01-07 11:30:37.872005263 +0000
 Birth: -

So in kaniko my output is
INFO[0044] args: [-c apt-get update]                    
Hit:1 http://deb.debian.org/debian buster InRelease                                                 
Hit:2 http://deb.debian.org/debian buster-updates InRelease                                         
Hit:3 http://security-cdn.debian.org/debian-security buster/updates InRelease
Reading package lists... Done
E: Release file for http://deb.debian.org/debian/dists/buster-updates/InRelease is expired (invalid since 34d 8h 36min 34s). Updates for this repository will not be applied.
E: Release file for http://security.debian.org/debian-security/dists/buster/updates/InRelease is expired (invalid since 35d 11h 13min 8s). Updates for this repository will not be applied.

and in docker (notice that its says Get instead of Hit):
$ apt-get update
Hit:1 http://deb.debian.org/debian buster InRelease                                                                    
Get:2 http://deb.debian.org/debian buster-updates InRelease [49.3 kB]                                 
Get:3 http://security-cdn.debian.org/debian-security buster/updates InRelease [65.4 kB] 
Get:4 https://apt-archive.apps.openshift.grasp-cloud.com/repository/apt bionic/main all Packages [56.6 kB]
Get:5 https://apt-archive.apps.openshift.grasp-cloud.com/repository/apt bionic/main amd64 Packages [128 kB]
Get:6 http://security-cdn.debian.org/debian-security buster/updates/main amd64 Packages [171 kB]


I wonder if this could be related to #793