ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.9/main: Permission denied

[cyrilfr]

A few hours ago, I was able to build an image based on openjdk:8-jre-alpine. Now, this step of the build:

Step 2/13 : RUN ["apk", "--update", "add", "bash"]

gives me an error:

[info]  ---> Running in a73860f5a032
[info] fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/main/x86_64/APKINDEX.tar.gz
[info] ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.9/main: Permission denied
[info] WARNING: Ignoring APKINDEX.b89edf6e.tar.gz: No such file or directory
[info] fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/community/x86_64/APKINDEX.tar.gz
[info] ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.9/community: Permission denied
[info] WARNING: Ignoring APKINDEX.737f7e01.tar.gz: No such file or directory
[info] ERROR: unsatisfiable constraints:
[info]   bash (missing):
[info]     required by: world[bash]
[info] Removing intermediate container a73860f5a032
[error] The command 'apk --update add bash' returned a non-zero code: 1

I build my image using sbt-native-packager plugin.

[wglambert]

Might be something to do with a proxy?
gliderlabs/docker-alpine#191

But I can't reproduce

$ docker run -it --rm openjdk:8-jre-alpine sh

/ # apk --update add bash
fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/community/x86_64/APKINDEX.tar.gz
(1/5) Installing ncurses-terminfo-base (6.1_p20190105-r0)
(2/5) Installing ncurses-terminfo (6.1_p20190105-r0)
(3/5) Installing ncurses-libs (6.1_p20190105-r0)
(4/5) Installing readline (7.0.003-r1)
(5/5) Installing bash (4.4.19-r1)
Executing bash-4.4.19-r1.post-install
Executing busybox-1.29.3-r10.trigger
OK: 93 MiB in 58 packages

Also we don't maintain Alpine variants of OpenJDK anymore #272

Alpine - not officially supported by the OpenJDK project #322, #211 (comment), #235 (comment)

You could also try asking over at the Docker Community Forums, Docker Community Slack, or Stack Overflow. Since these repos aren't really a user-help forum

[cyrilfr]

Might be something to do with a proxy?
gliderlabs/docker-alpine#191

But I can't reproduce

$ docker run -it --rm openjdk:8-jre-alpine sh

/ # apk --update add bash
fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/community/x86_64/APKINDEX.tar.gz
(1/5) Installing ncurses-terminfo-base (6.1_p20190105-r0)
(2/5) Installing ncurses-terminfo (6.1_p20190105-r0)
(3/5) Installing ncurses-libs (6.1_p20190105-r0)
(4/5) Installing readline (7.0.003-r1)
(5/5) Installing bash (4.4.19-r1)
Executing bash-4.4.19-r1.post-install
Executing busybox-1.29.3-r10.trigger
OK: 93 MiB in 58 packages

Also we don't maintain Alpine variants of OpenJDK anymore #272

Alpine - not officially supported by the OpenJDK project #322, #211 (comment), #235 (comment)

You could also try asking over at the Docker Community Forums, Docker Community Slack, or Stack Overflow. Since these repos aren't really a user-help forum

As I said, it just suddenly stopped to work. I'm not under a proxy.

[mrmstn]

Had the same issue with another alpine based container
"ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.11/main: Permission denied"

I guess the CDN is currently unstable so this issue isn't related to openjdk

[Cogitri]

Please report this over on Alpine's gitlab (https://gitlab.alpinelinux.org/alpine/aports) if you want support from the Alpine side. Please also mention what country you reside in since the CDN queries different servers depending on where in the world you are located.

[cyrilfr]

It was a DNS issue. It worked again after changing my DNS.

[robemmerson]

I've just been experience this issue and it's thanks to this thread that I identified that it was a proxy issue, so thank you for that!

If anyone else has this issue and would like a one-liner to solve the issue, use this:
sed -i 's/https/http/g' /etc/apk/repositories

It'll replace 'https' with 'http' in the repo list and should work with proxies.

[mrmstn]

@robemmerson From the security perspective, I wouldn't recommend a downgrade to http.

Maybe setting the HTTPS_PROXY Env Var would also solve this issue (see https://stackoverflow.com/a/50756105 for a solution during a build)

[robemmerson]

@mrmstn I would normally agree, but in this case it was only in a development environment that had a self signed certificate and a local McAfee client proxy on the host, so there's nothing I can set for HTTPS_PROXY to make it work AFAIK. When I build the container using GH Actions, it all works flawlessly without the downgrade to HTTP.

Probably should have added: I do not recommend this approach for production!