Re: [PATCH 2/4] tests/docker/dockerfiles/ubuntu2404.docker: add missing apt update
On 7/7/26 23:46, Pierrick Bouvier wrote: RUN statements should always use apt update && apt install together: https://docs.docker.com/build/building/best-practices/#apt-get Signed-off-by: Pierrick Bouvier --- tests/docker/dockerfiles/ubuntu2404.docker | 3 ++- tests/lcitool/refresh | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) Reviewed-by: Philippe Mathieu-Daudé
Re: [PATCH 2/4] tests/docker/dockerfiles/ubuntu2404.docker: add missing apt update
On 7/7/2026 2:46 PM, Pierrick Bouvier wrote: > RUN statements should always use apt update && apt install together: > https://docs.docker.com/build/building/best-practices/#apt-get > > Signed-off-by: Pierrick Bouvier > --- > tests/docker/dockerfiles/ubuntu2404.docker | 3 ++- > tests/lcitool/refresh | 3 ++- > 2 files changed, 4 insertions(+), 2 deletions(-) > > diff --git a/tests/docker/dockerfiles/ubuntu2404.docker > b/tests/docker/dockerfiles/ubuntu2404.docker > index 26bc2dd94f4..27992e34fd9 100644 > --- a/tests/docker/dockerfiles/ubuntu2404.docker > +++ b/tests/docker/dockerfiles/ubuntu2404.docker > @@ -160,7 +160,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 > ENV RUSTDOC=/usr/bin/rustdoc-1.83 > ENV CARGO_HOME=/usr/local/cargo > ENV PATH=$CARGO_HOME/bin:$PATH > -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ > +RUN apt update && \ > + DEBIAN_FRONTEND=noninteractive eatmydata \ >apt install -y --no-install-recommends cargo > RUN cargo install --locked bindgen-cli > # As a final step configure the user (if env is defined) > diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh > index 1fdd37440c9..bbbc6d3c46a 100755 > --- a/tests/lcitool/refresh > +++ b/tests/lcitool/refresh > @@ -157,7 +157,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 > ENV RUSTDOC=/usr/bin/rustdoc-1.83 > ENV CARGO_HOME=/usr/local/cargo > ENV PATH=$CARGO_HOME/bin:$PATH > -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ > +RUN apt update && \ > + DEBIAN_FRONTEND=noninteractive eatmydata \ >apt install -y --no-install-recommends cargo > RUN cargo install --locked bindgen-cli > """ Adding missing reviewed-by to be able to send a PR for this. Reviewed-by: Pierrick Bouvier Regards, Pierrick
Re: [PATCH 2/4] tests/docker/dockerfiles/ubuntu2404.docker: add missing apt update
On 7/8/2026 1:19 AM, Daniel P. Berrangé wrote: > On Tue, Jul 07, 2026 at 02:46:53PM -0700, Pierrick Bouvier wrote: >> RUN statements should always use apt update && apt install together: >> https://docs.docker.com/build/building/best-practices/#apt-get >> >> Signed-off-by: Pierrick Bouvier >> --- >> tests/docker/dockerfiles/ubuntu2404.docker | 3 ++- >> tests/lcitool/refresh | 3 ++- >> 2 files changed, 4 insertions(+), 2 deletions(-) >> >> diff --git a/tests/docker/dockerfiles/ubuntu2404.docker >> b/tests/docker/dockerfiles/ubuntu2404.docker >> index 26bc2dd94f4..27992e34fd9 100644 >> --- a/tests/docker/dockerfiles/ubuntu2404.docker >> +++ b/tests/docker/dockerfiles/ubuntu2404.docker >> @@ -160,7 +160,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 >> ENV RUSTDOC=/usr/bin/rustdoc-1.83 >> ENV CARGO_HOME=/usr/local/cargo >> ENV PATH=$CARGO_HOME/bin:$PATH >> -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ >> +RUN apt update && \ >> + DEBIAN_FRONTEND=noninteractive eatmydata \ >>apt install -y --no-install-recommends cargo >> RUN cargo install --locked bindgen-cli >> # As a final step configure the user (if env is defined) >> diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh >> index 1fdd37440c9..bbbc6d3c46a 100755 >> --- a/tests/lcitool/refresh >> +++ b/tests/lcitool/refresh >> @@ -157,7 +157,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 >> ENV RUSTDOC=/usr/bin/rustdoc-1.83 >> ENV CARGO_HOME=/usr/local/cargo >> ENV PATH=$CARGO_HOME/bin:$PATH >> -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ >> +RUN apt update && \ >> + DEBIAN_FRONTEND=noninteractive eatmydata \ >>apt install -y --no-install-recommends cargo >> RUN cargo install --locked bindgen-cli > > So lcitool already ran 'apt update' earlier, but if we're trying to > avoid caching issues, I guess running it again is needed. Should we > also run 'apt dist-upgrade' though, as already installed content in > the cached layer can be outdated. > upgrade/dist-upgrade are not needed, we just address the packages listing issue, not the fact they are up to date or not. In fact, if you want an updated container, the good practice is to rebuild them from scratch. For our use case, it's definitely not needed as we don't have security concerns to address for local containers. > With regards, > Daniel
Re: [PATCH 2/4] tests/docker/dockerfiles/ubuntu2404.docker: add missing apt update
On 7/8/2026 7:54 AM, Michael Tokarev wrote: > On 08.07.2026 17:28, Philippe Mathieu-Daudé wrote: >> On 8/7/26 11:27, Michael Tokarev wrote: > >>> No, running it again should not be needed. Unless we change >>> /etc/apt/sources.list. >> >> The problem we want to address is wrt remote content going out of >> sync; we need to run 'apt update' previous to any 'apt' call which >> use the remote. > > It's definitely not required to be this way. Running `apt update' once, > when creating containers, is enough. Any subsequent apt install &Co > will be run "soon enough" to avoid worrying about cache going out of > sync. Even if meanwhile a new version of some package has been uploaded, > old version is available for some time (usually at least a day). > > So no, running `apt update' before every `apt install' and similar > is not necessary. > > And sure, you can do it - it's just some wasted time. > Sorry but that's an incorrect view of how docker layer is working. There is no guarantee of how "soon enough" a previous RUN statement will be ran, before a next one. As long as command line associated to RUN is not modified, or that base image is not pulled again, all previous RUN statements are cached by default. That's why Richard observed that his container was broken for weeks, and it could have been broken until the end of times. The recommendation given to him was to make a build without cache, which is not the right way to fix it. If you want a good analogy, let's imagine you have a build system with a missing dependency: you can either fix it, or suggest to run "clean" and start over. The latter was suggested. In the case of apt install, concerned package might not be available anymore between previous and current RUN statement. That's why you need apt update with every apt install. Those links, including official docker documentation, explain the same: - https://docs.docker.com/build/building/best-practices/#apt-get - https://stackoverflow.com/questions/34248439/in-docker-why-is-it-recommended-to-run-apt-get-update-in-the-dockerfile - https://medium.com/@janscheffler/lessons-learned-apt-install-in-docker-images-bfad0e026f6d Another common example is a previous RUN statement that downloads something from a (now) broken link. New builds will fail, while cached one will work. That's why building containers from scratch daily CI is a good practice. It's similar to what we observe with QEMU functional tests assets that are cached in our CI, but are missing regularly, until someone unfortunate discovers that. Running apt upgrade/dist-upgrade manually is not recommended, and the best way to have updated containers (especially for production purpose) is to rebuild them from scratch. > Thanks, > > /mjt Regards, Pierrick
Re: [PATCH 2/4] tests/docker/dockerfiles/ubuntu2404.docker: add missing apt update
On 08.07.2026 17:28, Philippe Mathieu-Daudé wrote: On 8/7/26 11:27, Michael Tokarev wrote: No, running it again should not be needed. Unless we change /etc/apt/sources.list. The problem we want to address is wrt remote content going out of sync; we need to run 'apt update' previous to any 'apt' call which use the remote. It's definitely not required to be this way. Running `apt update' once, when creating containers, is enough. Any subsequent apt install &Co will be run "soon enough" to avoid worrying about cache going out of sync. Even if meanwhile a new version of some package has been uploaded, old version is available for some time (usually at least a day). So no, running `apt update' before every `apt install' and similar is not necessary. And sure, you can do it - it's just some wasted time. Thanks, /mjt
Re: [PATCH 2/4] tests/docker/dockerfiles/ubuntu2404.docker: add missing apt update
On 8/7/26 11:27, Michael Tokarev wrote: On 08.07.2026 11:19, Daniel P. Berrangé wrote: On Tue, Jul 07, 2026 at 02:46:53PM -0700, Pierrick Bouvier wrote: RUN statements should always use apt update && apt install together: https://docs.docker.com/build/building/best-practices/#apt-get Signed-off-by: Pierrick Bouvier --- tests/docker/dockerfiles/ubuntu2404.docker | 3 ++- tests/lcitool/refresh | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/docker/dockerfiles/ubuntu2404.docker b/tests/ docker/dockerfiles/ubuntu2404.docker index 26bc2dd94f4..27992e34fd9 100644 --- a/tests/docker/dockerfiles/ubuntu2404.docker +++ b/tests/docker/dockerfiles/ubuntu2404.docker @@ -160,7 +160,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 ENV RUSTDOC=/usr/bin/rustdoc-1.83 ENV CARGO_HOME=/usr/local/cargo ENV PATH=$CARGO_HOME/bin:$PATH -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ +RUN apt update && \ + DEBIAN_FRONTEND=noninteractive eatmydata \ apt install -y --no-install-recommends cargo RUN cargo install --locked bindgen-cli # As a final step configure the user (if env is defined) diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh index 1fdd37440c9..bbbc6d3c46a 100755 --- a/tests/lcitool/refresh +++ b/tests/lcitool/refresh @@ -157,7 +157,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 ENV RUSTDOC=/usr/bin/rustdoc-1.83 ENV CARGO_HOME=/usr/local/cargo ENV PATH=$CARGO_HOME/bin:$PATH -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ +RUN apt update && \ + DEBIAN_FRONTEND=noninteractive eatmydata \ apt install -y --no-install-recommends cargo RUN cargo install --locked bindgen-cli So lcitool already ran 'apt update' earlier, but if we're trying to avoid caching issues, I guess running it again is needed. Should we No, running it again should not be needed. Unless we change /etc/apt/sources.list. The problem we want to address is wrt remote content going out of sync; we need to run 'apt update' previous to any 'apt' call which use the remote. also run 'apt dist-upgrade' though, as already installed content in the cached layer can be outdated. Um. Or maybe when we add more layers which contains outdated cache? Apt has just one cache - /var/lib/apt/lists/ - of the packages which are available online. This cache needs to be kept up to date for installation from network to work. It is not, in any way, related to the installed software - apt knows which packages are installed without the cache, it always looks at the current dpkg database for that. Thanks, /mjt With regards, Daniel
Re: [PATCH 2/4] tests/docker/dockerfiles/ubuntu2404.docker: add missing apt update
On 08.07.2026 11:19, Daniel P. Berrangé wrote: On Tue, Jul 07, 2026 at 02:46:53PM -0700, Pierrick Bouvier wrote: RUN statements should always use apt update && apt install together: https://docs.docker.com/build/building/best-practices/#apt-get Signed-off-by: Pierrick Bouvier --- tests/docker/dockerfiles/ubuntu2404.docker | 3 ++- tests/lcitool/refresh | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/docker/dockerfiles/ubuntu2404.docker b/tests/docker/dockerfiles/ubuntu2404.docker index 26bc2dd94f4..27992e34fd9 100644 --- a/tests/docker/dockerfiles/ubuntu2404.docker +++ b/tests/docker/dockerfiles/ubuntu2404.docker @@ -160,7 +160,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 ENV RUSTDOC=/usr/bin/rustdoc-1.83 ENV CARGO_HOME=/usr/local/cargo ENV PATH=$CARGO_HOME/bin:$PATH -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ +RUN apt update && \ + DEBIAN_FRONTEND=noninteractive eatmydata \ apt install -y --no-install-recommends cargo RUN cargo install --locked bindgen-cli # As a final step configure the user (if env is defined) diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh index 1fdd37440c9..bbbc6d3c46a 100755 --- a/tests/lcitool/refresh +++ b/tests/lcitool/refresh @@ -157,7 +157,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 ENV RUSTDOC=/usr/bin/rustdoc-1.83 ENV CARGO_HOME=/usr/local/cargo ENV PATH=$CARGO_HOME/bin:$PATH -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ +RUN apt update && \ + DEBIAN_FRONTEND=noninteractive eatmydata \ apt install -y --no-install-recommends cargo RUN cargo install --locked bindgen-cli So lcitool already ran 'apt update' earlier, but if we're trying to avoid caching issues, I guess running it again is needed. Should we No, running it again should not be needed. Unless we change /etc/apt/sources.list. also run 'apt dist-upgrade' though, as already installed content in the cached layer can be outdated. Um. Or maybe when we add more layers which contains outdated cache? Apt has just one cache - /var/lib/apt/lists/ - of the packages which are available online. This cache needs to be kept up to date for installation from network to work. It is not, in any way, related to the installed software - apt knows which packages are installed without the cache, it always looks at the current dpkg database for that. Thanks, /mjt With regards, Daniel
Re: [PATCH 2/4] tests/docker/dockerfiles/ubuntu2404.docker: add missing apt update
On Tue, Jul 07, 2026 at 02:46:53PM -0700, Pierrick Bouvier wrote: > RUN statements should always use apt update && apt install together: > https://docs.docker.com/build/building/best-practices/#apt-get > > Signed-off-by: Pierrick Bouvier > --- > tests/docker/dockerfiles/ubuntu2404.docker | 3 ++- > tests/lcitool/refresh | 3 ++- > 2 files changed, 4 insertions(+), 2 deletions(-) > > diff --git a/tests/docker/dockerfiles/ubuntu2404.docker > b/tests/docker/dockerfiles/ubuntu2404.docker > index 26bc2dd94f4..27992e34fd9 100644 > --- a/tests/docker/dockerfiles/ubuntu2404.docker > +++ b/tests/docker/dockerfiles/ubuntu2404.docker > @@ -160,7 +160,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 > ENV RUSTDOC=/usr/bin/rustdoc-1.83 > ENV CARGO_HOME=/usr/local/cargo > ENV PATH=$CARGO_HOME/bin:$PATH > -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ > +RUN apt update && \ > + DEBIAN_FRONTEND=noninteractive eatmydata \ >apt install -y --no-install-recommends cargo > RUN cargo install --locked bindgen-cli > # As a final step configure the user (if env is defined) > diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh > index 1fdd37440c9..bbbc6d3c46a 100755 > --- a/tests/lcitool/refresh > +++ b/tests/lcitool/refresh > @@ -157,7 +157,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 > ENV RUSTDOC=/usr/bin/rustdoc-1.83 > ENV CARGO_HOME=/usr/local/cargo > ENV PATH=$CARGO_HOME/bin:$PATH > -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ > +RUN apt update && \ > + DEBIAN_FRONTEND=noninteractive eatmydata \ >apt install -y --no-install-recommends cargo > RUN cargo install --locked bindgen-cli So lcitool already ran 'apt update' earlier, but if we're trying to avoid caching issues, I guess running it again is needed. Should we also run 'apt dist-upgrade' though, as already installed content in the cached layer can be outdated. With regards, Daniel -- |: https://berrange.com ~~https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~https://fstop138.berrange.com :|
[PATCH 2/4] tests/docker/dockerfiles/ubuntu2404.docker: add missing apt update
RUN statements should always use apt update && apt install together: https://docs.docker.com/build/building/best-practices/#apt-get Signed-off-by: Pierrick Bouvier --- tests/docker/dockerfiles/ubuntu2404.docker | 3 ++- tests/lcitool/refresh | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/docker/dockerfiles/ubuntu2404.docker b/tests/docker/dockerfiles/ubuntu2404.docker index 26bc2dd94f4..27992e34fd9 100644 --- a/tests/docker/dockerfiles/ubuntu2404.docker +++ b/tests/docker/dockerfiles/ubuntu2404.docker @@ -160,7 +160,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 ENV RUSTDOC=/usr/bin/rustdoc-1.83 ENV CARGO_HOME=/usr/local/cargo ENV PATH=$CARGO_HOME/bin:$PATH -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ +RUN apt update && \ + DEBIAN_FRONTEND=noninteractive eatmydata \ apt install -y --no-install-recommends cargo RUN cargo install --locked bindgen-cli # As a final step configure the user (if env is defined) diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh index 1fdd37440c9..bbbc6d3c46a 100755 --- a/tests/lcitool/refresh +++ b/tests/lcitool/refresh @@ -157,7 +157,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 ENV RUSTDOC=/usr/bin/rustdoc-1.83 ENV CARGO_HOME=/usr/local/cargo ENV PATH=$CARGO_HOME/bin:$PATH -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ +RUN apt update && \ + DEBIAN_FRONTEND=noninteractive eatmydata \ apt install -y --no-install-recommends cargo RUN cargo install --locked bindgen-cli """ -- 2.47.3
