Docker 28.2.0 deb packages fail to install

[BGarber42]

#1195 seems to have changed things to user systemd-sysusers, but doesn't actually run it to add the group, so the installation fails.

Setting up nftables (1.0.9-1build1) ...
Setting up slirp4netns (1.2.1-1build2) ...
Setting up libnetfilter-conntrack3:amd64 (1.0.9-6build1) ...
Setting up iptables (1.8.10-3ubuntu2) ...
update-alternatives: using /usr/sbin/iptables-legacy to provide /usr/sbin/iptables (iptables) in auto mode
update-alternatives: using /usr/sbin/ip6tables-legacy to provide /usr/sbin/ip6tables (ip6tables) in auto mode
update-alternatives: using /usr/sbin/iptables-nft to provide /usr/sbin/iptables (iptables) in auto mode
update-alternatives: using /usr/sbin/ip6tables-nft to provide /usr/sbin/ip6tables (ip6tables) in auto mode
update-alternatives: using /usr/sbin/arptables-nft to provide /usr/sbin/arptables (arptables) in auto mode
update-alternatives: using /usr/sbin/ebtables-nft to provide /usr/sbin/ebtables (ebtables) in auto mode
Setting up docker-ce (5:28.2.0-1~ubuntu.24.04~noble) ...
Created symlink /etc/systemd/system/multi-user.target.wants/docker.service → /usr/lib/systemd/system/docker.service.
Created symlink /etc/systemd/system/sockets.target.wants/docker.socket → /usr/lib/systemd/system/docker.socket.
Could not execute systemctl:  at /usr/bin/deb-systemd-invoke line 148.
Processing triggers for man-db (2.12.0-4build2) ...
Processing triggers for libc-bin (2.39-0ubuntu8) ...

root@LT-1WNGW44:~# systemctl start docker
A dependency job for docker.service failed. See 'journalctl -xe' for details.

May 28 14:51:48 LT-1WNGW44 systemd[1]: Starting docker.socket - Docker Socket for the API...
░░ Subject: A start job for unit docker.socket has begun execution
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit docker.socket has begun execution.
░░
░░ The job identifier is 1557.
May 28 14:51:49 LT-1WNGW44 (sd-chown)[1791]: docker.socket: Failed to resolve group docker: No such process

root@LT-1WNGW44:~# systemd-sysusers
Creating group 'docker' with GID 989.
root@LT-1WNGW44:~# systemctl start docker
root@LT-1WNGW44:~#

[BGarber42]

Mentioning relevant users: @vvoland @thaJeztah @p5

[p5]

I guess we need some post-install step that effectively says "run sysusers". Will look into itand make a PR shortly.

I tested this on a Fedora Silverblue installation where packages aren't installed on running systems, but rather staged for the next deployment, which is probably why I did not run into this.

Edit: this appears to be built-in to the dh_installsysusers script which we wanted to use, but couldn't.
https://man7.org/linux/man-pages/man1/dh_installsysusers.1.html

Edit 2: I'm thinking we revert the Debian changes and revisit at a time when we can use the helper.

[vvoland]

Thanks for the report!

I'm rebuilding packages without the offending change.

[keuko]

Debian and Ubuntu don't use systemd-sysusers, affecting also us in kolla openstack project, I've just seen in CI runs.

This is my localhost test

/var/log/syslog:2025-05-28T21:30:40.207214+02:00 pixla (sd-chown)[95140]: docker.socket: Failed to resolve group docker: No such process

When the new revision is expected to be in repository ?

Thank you for your support !

[vvoland]

It should be up in the staging repository in around 1h, and then in the production repository in 2h from now.

(https://download-stage.docker.com/ vs https://download.docker.com - if you're in hurry and willing to temporarily switch your repo)

[shawnewjeans]

You all are my heroes today. 👍

[keuko]

Hmm, btw if i masked both docker.service and docker.socket ...group was created :) ... and then unmask enable and start ... Just an additional info

[keuko]

@vvoland Can I check somewhere some upload queue or something ? It's more then one hour ans till nothing in stage..

[vvoland]

ETA on staging is ~10 minutes. Unfortunately the pipeline is public so I can't share the progress directly.

[keuko]

@vvoland ah, ok, if you will be here ...let us know when prod will be ready ... If no ..nevermind

[keuko]

@vvoland thank you for your support !

[vvoland]

@keuko staging should be up!

Production should also be up soon.

If you're in hurry though...

You need to replace your repo url from https://download.docker.com to https://download-stage.docker.com
or if you use the get.docker.com convenience script:

$ curl https://get.docker.com | DOWNLOAD_URL=https://download-stage.docker.com  sh -

[keuko]

@vvoland staging works :)

root@pixla:/home/michalarbet/ultimum/git/upstream/ansible-collection-kolla# sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin Reading package lists... Done Building dependency tree... Done Reading state information... Done containerd.io is already the newest version (1.7.27-1). Suggested packages: cgroupfs-mount | cgroup-lite docker-model-plugin The following NEW packages will be installed: docker-buildx-plugin docker-ce docker-ce-cli docker-ce-rootless-extras docker-compose-plugin 0 upgraded, 5 newly installed, 0 to remove and 201 not upgraded. Need to get 42.1 MB/90.6 MB of archives. After this operation, 319 MB of additional disk space will be used. Get:1 https://download-stage.docker.com/linux/ubuntu noble/stable amd64 docker-ce-cli amd64 5:28.2.1-1~ubuntu.24.04~noble [16.2 MB] Get:2 https://download-stage.docker.com/linux/ubuntu noble/stable amd64 docker-ce amd64 5:28.2.1-1~ubuntu.24.04~noble [19.4 MB] Get:3 https://download-stage.docker.com/linux/ubuntu noble/stable amd64 docker-ce-rootless-extras amd64 5:28.2.1-1~ubuntu.24.04~noble [6,478 kB] Fetched 42.1 MB in 6s (6,967 kB/s) Selecting previously unselected package docker-ce-cli. (Reading database ... 432781 files and directories currently installed.) Preparing to unpack .../docker-ce-cli_5%3a28.2.1-1~ubuntu.24.04~noble_amd64.deb ... Unpacking docker-ce-cli (5:28.2.1-1~ubuntu.24.04~noble) ... Selecting previously unselected package docker-ce. Preparing to unpack .../docker-ce_5%3a28.2.1-1~ubuntu.24.04~noble_amd64.deb ... Unpacking docker-ce (5:28.2.1-1~ubuntu.24.04~noble) ... Selecting previously unselected package docker-buildx-plugin. Preparing to unpack .../docker-buildx-plugin_0.24.0-1~ubuntu.24.04~noble_amd64.deb ... Unpacking docker-buildx-plugin (0.24.0-1~ubuntu.24.04~noble) ... Selecting previously unselected package docker-ce-rootless-extras. Preparing to unpack .../docker-ce-rootless-extras_5%3a28.2.1-1~ubuntu.24.04~noble_amd64.deb ... Unpacking docker-ce-rootless-extras (5:28.2.1-1~ubuntu.24.04~noble) ... Selecting previously unselected package docker-compose-plugin. Preparing to unpack .../docker-compose-plugin_2.36.2-1~ubuntu.24.04~noble_amd64.deb ... Unpacking docker-compose-plugin (2.36.2-1~ubuntu.24.04~noble) ... Setting up docker-buildx-plugin (0.24.0-1~ubuntu.24.04~noble) ... Setting up docker-compose-plugin (2.36.2-1~ubuntu.24.04~noble) ... Setting up docker-ce-cli (5:28.2.1-1~ubuntu.24.04~noble) ... Setting up docker-ce-rootless-extras (5:28.2.1-1~ubuntu.24.04~noble) ... Setting up docker-ce (5:28.2.1-1~ubuntu.24.04~noble) ... Created symlink /etc/systemd/system/multi-user.target.wants/docker.service → /usr/lib/systemd/system/docker.service. Created symlink /etc/systemd/system/sockets.target.wants/docker.socket → /usr/lib/systemd/system/docker.socket. Processing triggers for man-db (2.12.0-4build2) ... root@pixla:/home/michalarbet/ultimum/git/upstream/ansible-collection-kolla# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

[vvoland]

Thanks for testing! ❤