Re: "Opkg update" fails in LXC container

Kouji Yamanaka · ‎07-09-2018

Hey Community,

I'm investigating the creation of LXC type containers.

I operated according to "Docker Images and Packages Repository".

https://developer.cisco.com/docs/iox/#!docker-images-and-packages-repository

Accessing the repository using docker daemon

[Step.1:Login to the Cisco devhub using generic user credentials.]

<<CODE SNIPPET>>

$ docker login -u iox_docker.gen -p AKCp2WX2yZXhwiQXG2xZjHvnrov8HA2HkXZyH3Z46ErGNMDz1fHQKAMRCBbEvseLowd7BQ8S1 devhub-docker.cisco.com

WARNING: login credentials saved in /home/user/.dockercfg.

Login Succeeded

<<Execution result>>

$ docker login -u iox_docker.gen -p AKCp2WX2yZXhwiQXG2xZjHvnrov8HA2HkXZyH3Z46ErGNMDz1fHQKAMRCBbEvseLowd7BQ8S1 devhub-docker.cisco.com

Error response from daemon: Get https://devhub-docker.cisco.com/v2/: unauthorized: BAD_CREDENTIAL

<<QUESTION>>

Is the password changed?

Please tell me the correct password.

[Step.2:Pull the docker image based on the target architecture using 'docker pull' command.]

<<CODE SNIPPET>>

$ docker pull devhub-docker.cisco.com/iox-docker/ir800/base-rootfs

<<Execution result>>

$ docker pull devhub-docker.cisco.com/iox-docker/ir800/base-rootfs

Using default tag: latest

latest: Pulling from iox-docker/ir800/base-rootfs

c8e49009c524: Pull complete

Digest: sha256:f14bed751e384496ca40645c8221990bc1ab8fec6cae53b452ae09e2e91db0d4

Status: Downloaded newer image for devhub-docker.cisco.com/iox-docker/ir800/base-rootfs:latest

<<QUESTION>>

Login to devhub failed but 'docker pull' worked.

Are there any problems with this procedure?

[Step.3:Running the image]

<<CODE SNIPPET>>

$ docker run -it devhub-docker.cisco.com/iox-docker/ir800/base-rootfs /bin/sh

Unable to find image 'devhub-docker.cisco.com/iox-docker/ir800/base-rootfs:latest' locally

latest: Pulling from iox-docker/ir800/base-rootfs

/ #

<<Execution result>>

$ docker run -it devhub-docker.cisco.com/iox-docker/ir800/base-rootfs /bin/sh

/ #

<<QUESTION>>

no problem.

Because I pull the image in Step 2,

[Step.4:Update opkg package repository]

<<CODE SNIPPET>>

/ # opkg update

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-1.7.2/ir800/core2-64/Packages.gz.

Updated source 'packages'.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-1.7.2/ir800/ir800_lxc/Packages.gz.

Updated source 'ir800_lxc'.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-1.7.2/ir800/../all/Packages.gz.

Updated source 'all'.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-1.7.2/ir800/core2-64/Packages.gz.

Updated source 'packages_delta'.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-1.7.2/ir800/ir800_lxc/Packages.gz.

Updated source 'ir800_lxc_delta'.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-1.7.2/ir800/../all/Packages.gz.

Updated source 'all_delta'.

<<Execution result>>

/ # opkg update

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/core2-64/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/ir800_lxc/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/all/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/core2-64/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/ir800_lxc/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/all/Packages.gz.

Collected errors:

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/core2-64/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/ir800_lxc/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/all/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/core2-64/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/ir800_lxc/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/all/Packages.gz headers: HTTP response code said error.

<<QUESTION>>

Have I affected by failing login to devhub at Step.1?

It seems that the password used in Step 1 differs from the password described in "opkg.conf" of the pull image,

but can it be different?

[[Setting up opkg.conf]]

/ # cat /etc/opkg/opkg.conf

# Must have one or more source entries of the form:

#

# src <src-name> <source-url>

#

# and one or more destination entries of the form:

#

# dest <dest-name> <target-path>

#

# where <src-name> and <dest-names> are identifiers that

# should match [a-zA-Z0-9._-]+, <source-url> should be a

# URL that points to a directory containing a Familiar

# Packages file, and <target-path> should be a directory

# that exists on the target system.

# Proxy Support

#option http_proxy http://proxy.tld:3128

#option ftp_proxy http://proxy.tld:3128

#option proxy_username <username>

#option proxy_password <password>

# Enable GPGME signature

# option check_signature 1

option http_auth iox_docker.gen:AKCp5bAif2Tzg1MtWAJbLoTXweosuqqSgSEyKApikowUq5sycevTsK7LcQ7EKLbzQFuyc9WCk

# Offline mode (for use in constructing flash images offline)

#option offline_root target

#src/gz base http://downloads.openwrt.org/snapshots/trunk/x86/64/packages/base/

#src/gz packages http://downloads.openwrt.org/snapshots/trunk/x86/64/packages/packages/

src/gz packages https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/core2-64

src/gz ir800_lxc https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/ir800_lxc

src/gz all https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/all

src/gz packages_alpha https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/core2-64

src/gz ir800_lxc_alpha https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/ir800_lxc

src/gz all_alpha https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/all

dest root /

[STEP.5:The docker base image to create a custom image.]

<<CODE SNIPPET>>

$ ls

cpp_app Dockerfile

$ cat Dockerfile

FROM devhub-docker.cisco.com/iox-docker/ir800/base-rootfs

COPY cpp_app /opt/apps/

RUN opkg update

RUN opkg install libstdc++

$ docker build -t cpp-app .

Sending build context to Docker daemon 2.56 kB

Step 1/4 : FROM devhub-docker.cisco.com/iox-docker/ir800/base-rootfs

---> 4d39f5d04ab4

Step 2/4 : COPY cpp_app /opt/apps/

---> 38d9fa9c6adb

Removing intermediate container 746e8301fa7a

Step 3/4 : RUN opkg update

---> Running in 9003634832a3

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-1.7.2/ir800/core2-64/Packages.gz.

Updated source 'packages'.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-1.7.2/ir800/ir800_lxc/Packages.gz.

Updated source 'ir800_lxc'.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-1.7.2/ir800/../all/Packages.gz.

Updated source 'all'.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-1.7.2/ir800/core2-64/Packages.gz.

Updated source 'packages_delta'.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-1.7.2/ir800/ir800_lxc/Packages.gz.

Updated source 'ir800_lxc_delta'.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-1.7.2/ir800/../all/Packages.gz.

Updated source 'all_delta'.

---> 5bf91eac8d96

Removing intermediate container 9003634832a3

Step 4/4 : RUN opkg install libstdc++

---> Running in d5dfc986ae0f

Installing libstdc++6 (4.9.1-r0) on root.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-1.7.2/ir800/core2-64/libstdc++6_4.9.1-r0_core2-64.ipk.

Installing libgcc1 (4.9.1-r0) on root.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-1.7.2/ir800/core2-64/libgcc1_4.9.1-r0_core2-64.ipk.

Configuring libgcc1.

Configuring libstdc++6.

---> a70aaa99e63d

Removing intermediate container d5dfc986ae0f

Successfully built a70aaa99e63d

<<Execution result>>

$ ls

cpp_app docker-test

$ cat docker-test

FROM devhub-docker.cisco.com/iox-docker/ir800/base-rootfs

COPY cpp_app /opt/apps/

RUN opkg update

RUN opkg install libstdc++

$ docker build -t cpp-app .

Sending build context to Docker daemon 2.56kB

Step 1/4 : FROM devhub-docker.cisco.com/iox-docker/ir800/base-rootfs

---> 5dc0d1ddffa1

Step 2/4 : COPY cpp_app /opt/apps/

---> 1cdf921f7a49

Removing intermediate container 186cafc268e3

Step 3/4 : RUN opkg update

---> Running in c726ef92d9fd

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/core2-64/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/ir800_lxc/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/all/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/core2-64/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/ir800_lxc/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/all/Packages.gz.

Collected errors:

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/core2-64/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/ir800_lxc/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/all/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/core2-64/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/ir800_lxc/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/all/Packages.gz headers: HTTP response code said error.

The command '/bin/sh -c opkg update' returned a non-zero code: 6

<<QUESTION>>

Have I affected by failing login to devhub at Step.1?

==== Supplement ====

Since "apt-get update" succeeds in the execution environment, I think that there is no problem with the network.

$ sudo apt-get update

[sudo] password for yamanaka:

Get:1 http://security.ubuntu.com/ubuntu xenial-security InRelease [107 kB]

Hit:2 https://apt.dockerproject.org/repo ubuntu-xenial InRelease

Hit:3 http://us.archive.ubuntu.com/ubuntu xenial InRelease

Get:4 http://us.archive.ubuntu.com/ubuntu xenial-updates InRelease [109 kB]

Get:5 http://us.archive.ubuntu.com/ubuntu xenial-backports InRelease [107 kB]

Fetched 323 kB in 1s (177 kB/s)

Reading package lists... Done

$

Thank you.

Kouji

yawming · ‎07-10-2018

I happen to see someone asked similar question and the solution :

Hope this can address your issue too.

`````````````

We have already identified this issue where anyone logged-in with the generic credential could change the API key and it will break the access to the devhub. Currently we are working on it and testing the open access to devhub repo where we could avoid this issue. Meanwhile as workaround can you add this line in the dockerfile before using opkg instructions:

RUN sed -i 's/$option http_auth iox_docker.gen:$.*/\1AKCp5bAif2Tzg1MtWAJbLoTXweosuqqSgSEyKApikowUq5sycevTsK7LcQ7EKLbzQFuyc9WCk/' /etc/opkg/opkg.conf

----------------

Kouji Yamanaka · ‎07-11-2018

Hi,yawchen

Thank you for your cooperation.

I tried the workaround I got taught, but I got an error.

<<Execution result>>

$ docker build -t cpp-app .

Sending build context to Docker daemon 2.56kB

Step 1/5 : FROM devhub-docker.cisco.com/iox-docker/ir800/base-rootfs

---> 5dc0d1ddffa1

Step 2/5 : COPY cpp_app /opt/apps/

---> 167cece90e7d

Removing intermediate container e4b395965182

Step 3/5 : RUN sed -i 's/$option http_auth iox_docker.gen:$.*/\1AKCp5bAif2Tzg1MtWAJbLoTXweosuqqSgSEyKApikowUq5sycevTsK7LcQ7EKLbzQFuyc9WCk/' /etc/opkg/opkg.conf

---> Running in 254ff1e20651

---> c7f1a5190e68

Removing intermediate container 254ff1e20651

Step 4/5 : RUN opkg update

---> Running in b86044767315

Collected errors:

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/core2-64/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/ir800_lxc/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/all/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/core2-64/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/ir800_lxc/Packages.gz headers: HTTP response code said error.

* opkg_validate_cached_file: Failed to download https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/all/Packages.gz headers: HTTP response code said error.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/core2-64/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/ir800/ir800_lxc/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg/yocto-2.1.1/all/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/core2-64/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/ir800/ir800_lxc/Packages.gz.

Downloading https://devhub.cisco.com/artifactory/IOx-Opkg-alpha/yocto-2.1.1/all/Packages.gz.

The command '/bin/sh -c opkg update' returned a non-zero code: 6

yawming · ‎07-11-2018

To be honest, I don't know which key to use can you please try the following if not working then I will ask subject matter expert for you.

RUN sed -i 's/$option http_auth iox_docker.gen:$.*/\1AKCp5bAt1aQQR9L3dk4FP6QLDjd9XYhZLuhCLaHuwYnoGmDPLc584stTT6cWSeNdYavPR3wAV/' /etc/opkg/opkg.conf

yawming · ‎07-11-2018

please use the latest.

The API key was updated after that and currently active key is “AKCp5bAt5nK9nJBeq1nFe3Ywntfokny8f1oHeTYpLrGCYG9iv9P3gkX9KFj6wzHcQoLkwP5Pa”

Kouji Yamanaka · ‎07-11-2018

Hi,yawchen

Thank you for your cooperation.

I was able to build successfully.

I also found a way to check the current API - Key in the devhub web UI.

It is frightening for anyone to regenerate API-Key.

Thank you.

Kouji

yawming · ‎07-12-2018

Glad it works for you.

tianyizh · ‎04-30-2019

Face the same issue,how can I find the right API-key ? which relevant steps in https://developer.cisco.com/docs/iox/#!docker-images-and-packages-repository/overview should I follow.Thanks a lot

mo7 · ‎07-14-2018

I just want to point out that the correct line in th Dockerfile has to be:

RUN sed -i 's/$option http_auth iox_docker.gen:$.*/\option http_auth iox_docker.gen:AKCp5bAt5nK9nJBeq1nFe3Ywntfokny8f1oHeTYpLrGCYG9iv9P3gkX9KFj6wzHcQoLkwP5Pa/' /etc/opkg/opkg.conf

Note: If the API Key changes the above line has to be adjusted.