Documentation on adding download.docker.com/linux/debian as debian repo not working

[ArnoSen]

File: engine/install/debian.md

Hi,

I followed the instructions how to add download.docker.com/linux/debian as debian repo but I cannot get it to work.

The error is when running apt update:

Get:3 https://download.docker.com/linux/debian bullseye InRelease [43.3 kB]
Err:3 https://download.docker.com/linux/debian bullseye InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7EA0A9C3F273FCD8

I did setup the repo as below:

$ sudo mkdir -p /etc/apt/keyrings
$ curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

I checked that the key was there and it has the correct format.

Then I did:

$ echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

This results in the following file:

$ cat /etc/apt/sources.list.d/docker.list
deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian   bullseye stable

I also tried adding read perms to key but that did not change the error:
$ sudo chmod a+r /etc/apt/keyrings/docker.gpg

I also tried to import the particular key id manually but then I got:

$ gpg --keyring /etc/apt/trusted.gpg --recv-keys 7EA0A9C3F273FCD8 
gpg: key 8D81803C0EBFCD88: "Docker Release (CE deb) <docker@docker.com>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

[thaJeztah]

I tried the steps from the documentation, but wasn't able to reproduce the issue;

# (optional; only needed if existing, other packages of these were installed)
sudo apt-get remove docker docker-engine docker.io containerd runc

sudo apt-get update

sudo apt-get install \
    ca-certificates \
    curl \
    gnupg \
    lsb-release

sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt-get update

sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose-plugin

After this, docker is installed;

docker version
Client: Docker Engine - Community
 Version:           20.10.23
 API version:       1.41
 Go version:        go1.18.10
 Git commit:        7155243
 Built:             Thu Jan 19 17:34:13 2023
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.23
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.18.10
  Git commit:       6051f14
  Built:            Thu Jan 19 17:32:04 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.15
  GitCommit:        5b842e528e99d4d4c1686467debf2bd4b88ecd86
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

cat /etc/apt/sources.list.d/docker.list
deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian   bullseye stable

Did you have docker installed before this? Or was this on a fresh system?

[ArnoSen]

This is a fresh system.

[ArnoSen]

I am running a fully updated version Debian 11.

$ uname -a 
5.10.0-20-amd64 #1 SMP Debian 5.10.158-2 (2022-12-13) x86_64 GNU/Linux

[ArnoSen]

(BTW: interesting to talk to you after so many years! I am your old friend from Lisse living at the Heereweg. We spent quite some time together in the old days! Good to talk to you again! I hope you are doing well!)

[thaJeztah]

(BTW: interesting to talk to you after so many years! I am your old friend from Lisse living at the Heereweg. We spent quite some time together in the old days! Good to talk to you again! I hope you are doing well!)

Oh, wow! That's been a really long time! I'm doing fine; how you are doing good as well!

I am running a fully updated version Debian 11.

Hm.. interesting; so I tried it on a fresh droplet on DigitalOcean; kernel version there is (although I doubt kernel version should be related to this 🤔)

uname -a
Linux debian-s-1vcpu-1gb-ams3-01 5.10.0-11-amd64 #1 SMP Debian 5.10.92-1 (2022-01-18) x86_64 GNU/Linux

We do get a lot of installs on Debian, so it doesn't appear to be a "general" issue, but definitely possible that there's something that depends on how the system is configured. Now the fun bit: discovering what could trigger this.

I see there was at least one report were permissions of the directory also had to be updated (no idea if it resulted in the same issue though); see #16362

[ArnoSen]

Doing fine here!

I did some more testing. The directory permissions are indeed the culprit! And yes, the solution provided in #16362 solve the problem. Thanks for your help!
Please give my regards to Edwin and your parents!

[ArnoSen]

When reading https://wiki.debian.org/DebianRepository/UseThirdParty, it mentions the required directory permissions:

In releases older than Debian 12 and Ubuntu 22.04, /etc/apt/keyrings does not exist by default. It SHOULD be created with permissions 0755 if it is needed and does not already exist. 

The above SHOULD should be read as MUST.

[thaJeztah]

Oh! Completely forgot to reply!

Please give my regards to Edwin and your parents!

I did, and told them that I "ran into you". They're all doing well, and said "hi!"

I did some more testing. The directory permissions are indeed the culprit! And yes, the solution provided in #16362 solve the problem. Thanks for your help!

Great to hear that that fixed the issue! 🎉

[ArnoSen]

Good to hear from them!
I am closing the issue.

[docker-robott]

Closed issues are locked after 30 days of inactivity.
This helps our team focus on active issues.

If you have found a problem that seems similar to this, please open a new issue.

/lifecycle locked