fix: detect missing apt-get in chiseled images and fall back to tooling container#1634
Conversation
…ng container Some Debian-based images (e.g., dotnet/aspnet:8.0-noble-chiseled-extra) have a dpkg status file but no apt-get binary. Previously, installUpdates would attempt to run apt-get update on the target image, failing with 'exec: apt-get: executable file not found in /var/home/kushald/.local/bin:/var/home/kushald/.local/bin:/var/home/kushald/.local/bin:/var/home/kushald/.local/bin:/var/home/kushald/.local/bin:/var/home/kushald/.local/bin:/var/home/kushald/.nvm/versions/node/v24.15.0/bin:/var/home/kushald/.local/bin:/var/home/kushald/bin:/var/home/kushald/.hermes/hermes-agent/venv/bin:/var/home/kushald/.hermes/hermes-agent/node_modules/.bin:/var/home/kushald/.hermes/node/bin:/var/home/kushald/.local/bin:/var/home/kushald/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/var/home/kushald/.local/share/JetBrains/Toolbox/scripts'. Now probeAptGet checks for apt-get availability after detecting DPKGStatusFile, and falls back to the tooling container path (unpackAndMergeUpdates) when it's absent. Signed-off-by: Arunesh Dwivedi <arunesh.devops@gmail.com>
AruneshDwivedi
requested review from
ashnamehrotra,
jeremyrickard,
omercnet,
robert-cronin and
sozercan
as code owners
There was a problem hiding this comment.
Pull request overview
This PR fixes a failure when patching Debian-based "chiseled" images (e.g. dotnet/aspnet:8.0-noble-chiseled-extra) that ship a dpkg status file but no apt-get binary. Previously InstallUpdates would run apt-get update directly against such target images and fail with exec: apt-get: executable file not found in $PATH. The change adds a probeAptGet step in probeDPKGStatus so that, when apt-get is missing, the manager flips to the distroless code path that runs apt-get inside the tooling container instead.
Changes:
- Added a
hasAptGetfield todpkgManager. - In the
DPKGStatusFilebranch, probe the target image forapt-get; when absent, setisDistroless = true. - Added
probeAptGet, which runs a shell probe in the target image and usesbuildkit.TryExtractFileFromStateto detect a marker file.
| dm.hasAptGet = dm.probeAptGet(ctx, imageStateCurrent) | ||
| if !dm.hasAptGet { | ||
| dm.isDistroless = true | ||
| } |
| state := imageState.Run( | ||
| llb.Shlex(fmt.Sprintf(`sh -c 'command -v apt-get > /dev/null && touch %s'`, aptGetMarker)), | ||
| llb.WithCustomName("Probing for apt-get"), | ||
| ).Root() |
|
Thanks for the review. The first point about empty packageInfo is not an issue in this code — probeAptGet sets isDistroless for status-file images but probeDPKGStatus returns nil immediately after, so InstallUpdates never reaches unpackAndMergeUpdates for this status type. The isDistroless flag is only consulted after probeDPKGStatus returns nil. For the second point about the probe command — fixed by adding |
Some Debian-based images like dotnet/aspnet:8.0-noble-chiseled-extra have a dpkg status file but no apt-get binary. installUpdates was running apt-get update directly on the target image, which fails with "exec: apt-get: executable file not found in $PATH".
Now probeAptGet checks for apt-get availability after detecting DPKGStatusFile. When apt-get is absent, the code sets isDistroless=true and falls back to unpackAndMergeUpdates, which runs apt-get in the tooling container instead of the target image.