search

docker-library / openjdk

Docker Official Image packaging for EA builds of OpenJDK from Oracle
http://openjdk.java.net
MIT License
1.14k stars 471 forks source link

ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.9/main: Permission denied #402

Closed cyrilfr closed 4 years ago

cyrilfr commented 4 years ago

A few hours ago, I was able to build an image based on openjdk:8-jre-alpine. Now, this step of the build:

Step 2/13 : RUN ["apk", "--update", "add", "bash"]

gives me an error:


[info]  ---> Running in a73860f5a032
[info] fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/main/x86_64/APKINDEX.tar.gz
[info] ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.9/main: Permission denied
[info] WARNING: Ignoring APKINDEX.b89edf6e.tar.gz: No such file or directory
[info] fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/community/x86_64/APKINDEX.tar.gz
[info] ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.9/community: Permission denied
[info] WARNING: Ignoring APKINDEX.737f7e01.tar.gz: No such file or directory
[info] ERROR: unsatisfiable constraints:
[info]   bash (missing):
[info]     required by: world[bash]
[info] Removing intermediate container a73860f5a032
[error] The command 'apk --update add bash' returned a non-zero code: 1

I build my image using sbt-native-packager plugin.

wglambert commented 4 years ago

Might be something to do with a proxy? https://github.com/gliderlabs/docker-alpine/issues/191

But I can't reproduce

$ docker run -it --rm openjdk:8-jre-alpine sh

/ # apk --update add bash
fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/community/x86_64/APKINDEX.tar.gz
(1/5) Installing ncurses-terminfo-base (6.1_p20190105-r0)
(2/5) Installing ncurses-terminfo (6.1_p20190105-r0)
(3/5) Installing ncurses-libs (6.1_p20190105-r0)
(4/5) Installing readline (7.0.003-r1)
(5/5) Installing bash (4.4.19-r1)
Executing bash-4.4.19-r1.post-install
Executing busybox-1.29.3-r10.trigger
OK: 93 MiB in 58 packages

Also we don't maintain Alpine variants of OpenJDK anymore https://github.com/docker-library/openjdk/issues/272

Alpine - not officially supported by the OpenJDK project https://github.com/docker-library/openjdk/pull/322, https://github.com/docker-library/openjdk/issues/211#issuecomment-426708580, https://github.com/docker-library/openjdk/pull/235#issuecomment-424599754

You could also try asking over at the Docker Community Forums, Docker Community Slack, or Stack Overflow. Since these repos aren't really a user-help forum

cyrilfr commented 4 years ago

Might be something to do with a proxy? gliderlabs/docker-alpine#191

But I can't reproduce

$ docker run -it --rm openjdk:8-jre-alpine sh

/ # apk --update add bash
fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/community/x86_64/APKINDEX.tar.gz
(1/5) Installing ncurses-terminfo-base (6.1_p20190105-r0)
(2/5) Installing ncurses-terminfo (6.1_p20190105-r0)
(3/5) Installing ncurses-libs (6.1_p20190105-r0)
(4/5) Installing readline (7.0.003-r1)
(5/5) Installing bash (4.4.19-r1)
Executing bash-4.4.19-r1.post-install
Executing busybox-1.29.3-r10.trigger
OK: 93 MiB in 58 packages

Also we don't maintain Alpine variants of OpenJDK anymore #272

Alpine - not officially supported by the OpenJDK project #322, #211 (comment), #235 (comment)

You could also try asking over at the Docker Community Forums, Docker Community Slack, or Stack Overflow. Since these repos aren't really a user-help forum

As I said, it just suddenly stopped to work. I'm not under a proxy.

mrmstn commented 4 years ago

Had the same issue with another alpine based container "ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.11/main: Permission denied"

I guess the CDN is currently unstable so this issue isn't related to openjdk

Cogitri commented 4 years ago

Please report this over on Alpine's gitlab (https://gitlab.alpinelinux.org/alpine/aports) if you want support from the Alpine side. Please also mention what country you reside in since the CDN queries different servers depending on where in the world you are located.

cyrilfr commented 4 years ago

It was a DNS issue. It worked again after changing my DNS.

robemmerson commented 2 years ago

I've just been experience this issue and it's thanks to this thread that I identified that it was a proxy issue, so thank you for that!

If anyone else has this issue and would like a one-liner to solve the issue, use this: sed -i 's/https/http/g' /etc/apk/repositories

It'll replace 'https' with 'http' in the repo list and should work with proxies.

mrmstn commented 2 years ago

@robemmerson From the security perspective, I wouldn't recommend a downgrade to http.

Maybe setting the HTTPS_PROXY Env Var would also solve this issue (see https://stackoverflow.com/a/50756105 for a solution during a build)

robemmerson commented 2 years ago

@mrmstn I would normally agree, but in this case it was only in a development environment that had a self signed certificate and a local McAfee client proxy on the host, so there's nothing I can set for HTTPS_PROXY to make it work AFAIK. When I build the container using GH Actions, it all works flawlessly without the downgrade to HTTP.

Probably should have added: I do not recommend this approach for production!