apk update/add in the docker container under proxy giving permission denied

[pktippa]

Running docker in a host (centos Red Hat Enterprise Linux Server release 7.2 (Maipo)) which is under proxy, able to pull alpine:3.4 by following steps in stackoverflow.

Now starting the container form alpine:3.4, setting proxy, and running apk --update add curl giving me permission denied

[root@xxx ~]# docker run -it alpine:3.4 sh
/ # export http_proxy=http://proxyuser:proxypassword@proxyip:proxyport
/ # export https_proxy=http://proxyuser:proxypassword@proxyip:proxyport
/ # apk --update add curl
fetch http://dl-cdn.alpinelinux.org/alpine/v3.4/main/x86_64/APKINDEX.tar.gz
ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.4/main: Permission denied
WARNING: Ignoring APKINDEX.167438ca.tar.gz: No such file or directory
fetch http://dl-cdn.alpinelinux.org/alpine/v3.4/community/x86_64/APKINDEX.tar.gz
ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.4/community: Permission denied
WARNING: Ignoring APKINDEX.a2e6dac0.tar.gz: No such file or directory
ERROR: unsatisfiable constraints:
  curl (missing):
    required by: world[curl]
/ #

[WTFKr0]

Got something similar with the python:2.7-alpine image :

FROM python:2.7-alpine
RUN pip install virtualenv
RUN apk add --update git && rm -rf /var/cache/apk/*

Give me :

fetch http://dl-cdn.alpinelinux.org/alpine/v3.4/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.4/community/x86_64/APKINDEX.tar.gz
(1/6) Installing ca-certificates (20160104-r4)
(2/6) Installing libssh2 (1.7.0-r0)
(3/6) Installing libcurl (7.49.1-r0)
(4/6) Installing expat (2.1.1-r1)
(5/6) Installing pcre (8.38-r1)
(6/6) Installing git (2.8.3-r0)
ERROR: git-2.8.3-r0: Permission denied
Executing busybox-1.24.2-r9.trigger
Executing ca-certificates-20160104-r4.trigger
1 errors; 15 MiB in 23 packages

[absulation]

Got something similar with the nginx:alpine image :

FROM nginx:alpine

MAINTAINER Mahmoud Zalt <mahmoud@zalt.me>

ENV http_proxy 'http://user:pass@10.78.2.60:9090'
ENV https_proxy 'http://user:pass@10.78.2.60:9090'

ADD nginx.conf /etc/nginx/
ADD laravel.conf /etc/nginx/conf.d/laravel.conf

ARG PHP_UPSTREAM=php-fpm

RUN apk update \
    && apk upgrade \
    && apk add --no-cache bash \
    && adduser -D -H -u 1000 -s /bin/bash www-data \
    && rm /etc/nginx/conf.d/default.conf \
    && echo "upstream php-upstream { server ${PHP_UPSTREAM}:9000; }" > /etc/nginx/conf.d/upstream.conf

CMD ["nginx"]

EXPOSE 80 443

Error Result :

Step 8 : RUN apk update     && apk upgrade     && apk add --no-cache bash     && adduser -D -H -u 1000 -s /bin/bash www-data     && rm /etc/nginx/conf.d/default.conf     && echo "upstream php-upstream { server ${PHP_UPSTREAM}:9000; }" > /etc/nginx/conf.d/upstream.conf
 ---> Running in 204aabee34a1
fetch http://dl-cdn.alpinelinux.org/alpine/v3.3/main/x86_64/APKINDEX.tar.gz
ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.3/main: Permission denied
WARNING: Ignoring APKINDEX.5a59b88b.tar.gz: No such file or directory
fetch http://dl-cdn.alpinelinux.org/alpine/v3.3/community/x86_64/APKINDEX.tar.gz
ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.3/community: Permission denied
WARNING: Ignoring APKINDEX.7c1f02d6.tar.gz: No such file or directory
2 errors; 31 distinct packages available
ERROR: Service 'nginx' failed to build: The command '/bin/sh -c apk update     && apk upgrade     && apk add --no-cache bash     && adduser -D -H -u 1000 -s /bin/bash www-data     && rm /etc/nginx/conf.d/default.conf     && echo "upstream php-upstream { server ${PHP_UPSTREAM}:9000; }" > /etc/nginx/conf.d/upstream.conf' returned a non-zero code: 2

[kiranpradeep]

I tried this and saw that, it is just the apk tool that is failing. When I tried wget on alpine:3.4 docker container under proxy, wget succeeds. But apk tool continue giving permission denied error. Does the apk tool under alpine, honor http_proxy/https_proxy environment variables ?

[stevezxu]

I am seeing the same thing, permission denied. Is there any solution or workaround for this?

[ncopa]

can you try running strace apk update and see what it tries to connect to? apk should honor http_proxy and HTTP_PROXY. Not sure if it honors the https variants.

[kiranpradeep]

@ncopa strace isn't installed in alpine image and so we cannot run it. Is strace for alpine downloadable from any URL ?. I could use wget if we have URL.

[ncopa]

@kiranpradeep apk add --no-cache strace

[kiranpradeep]

@ncopa :) I downloaded(wget) strace from here(1) and installed it as apk add strace-4.13-r0.apk. Then ran strace apk add --no-cache vim to get the attached error log

It seems that apk uses libfetch, which accepts HTTP_PROXY_AUTH environment variable. I could workaround this issue as following:

export http_proxy=http://proxyhost:proxyport
export HTTP_PROXY_AUTH=basic:*:proxyuser:proxypass

Please note that upper case letters must be used for HTTP_PROXY_AUTH .

[cridam]

Come back to that issue. The work around doens't work when no authentication is requried at proxy side. I m running over docker 1.12.1 (I see docker info | grep Security => seccomp). Running strace fails with also Operation not permitted.
My guess is something goes wrong with security options, but how to deal with ?

I still get the sequences :
docker run -it alpine:3.3 sh
apk update
fetch http://dl-cdn.alpinelinux.org/alpine/v3.3/main/x86_64/APKINDEX.tar.gz
^C
wget http://dl-cdn.alpinelinux.org/alpine/v3.3/main/x86_64/APKINDEX.tar.gz
Connecting to dl-cdn.alpinelinux.org (151.101.44.249:80)
^C
/ # export http_proxy=http://proxyhost:proxyport
/ # export https_proxy=http://proxyhost:proxyport
/ # wget http://dl-cdn.alpinelinux.org/alpine/v3.3/main/x86_64/APKINDEX.tar.gz
Connecting to proxy (proxy)
APKINDEX.tar.gz 100%
/ # apk update
fetch http://dl-cdn.alpinelinux.org/alpine/v3.3/main/x86_64/APKINDEX.tar.gz
ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.3/main: Permission denied
/ strace apk update
strace: ptrace(PTRACE_TRACEME, ...): Operation not permitted

[cridam]

docker run -v /apk/addons:/custo --security-opt seccomp:unconfined --cap-add SYS_PTRACE -e http_proxy=http://proxyhost:proxyport -e https_proxy=http://proxyhost:proxyport -it alpine:3.3 sh
/# apk add /custo/strace-4.13-r0.apk
/# strace apk update
=> get a 407 .
The mistake comes with the proxy i was using.
Just to close the thread adding the tip for running strace over 1.12 docker.

[andyshinn]

Closing as it sounds like the workaround here is to set HTTP_PROXY_AUTH=basic:*:proxyuser:proxypass as well as your normal proxy information.

[unoexperto]

I have same problem with plain vanilla alpine on

docker run -it --name test alpine:latest /bin/ash

I have no proxy. What should I do ?

I can't install strace either

/ # wget http://dl-4.alpinelinux.org/alpine/edge/main/x86_64/strace-4.14-r0.apk
Connecting to dl-4.alpinelinux.org (74.117.189.114:80)
wget: server returned error: HTTP/1.1 403 Forbidden

It's happening only on AWS EC2 instance. Here is export output

declare -x AWS_AUTO_SCALING_HOME="/opt/aws/apitools/as"
declare -x AWS_CLOUDWATCH_HOME="/opt/aws/apitools/mon"
declare -x AWS_ELB_HOME="/opt/aws/apitools/elb"
declare -x AWS_PATH="/opt/aws"
declare -x EC2_AMITOOL_HOME="/opt/aws/amitools/ec2"
declare -x EC2_HOME="/opt/aws/apitools/ec2"
declare -x HISTCONTROL="ignoredups"
declare -x HISTSIZE="1000"
declare -x HOSTNAME="ip-172-30-0-247"
declare -x JAVA_HOME="/usr/lib/jvm/java"
declare -x LANG="en_US.UTF-8"
declare -x LESSOPEN="||/usr/bin/lesspipe.sh %s"
declare -x LESS_TERMCAP_mb=""
declare -x LESS_TERMCAP_md=""
declare -x LESS_TERMCAP_me=""
declare -x LESS_TERMCAP_se=""
declare -x LESS_TERMCAP_ue=""
declare -x LESS_TERMCAP_us=""
declare -x PATH="/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/opt/aws/bin"
declare -x SHELL="/bin/bash"
declare -x SHLVL="1"
declare -x SSH_TTY="/dev/pts/0"
declare -x TERM="xterm-256color"