How to use apt-get install in docker when there is a Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied) issue safely?

Question

I want to run opam init in docker but get the error:

(iit_synthesis) brandomiranda~ ❯ docker build -t brandojazz/pycoq:test_brando ~/pycoq/tutorial/
[+] Building 1.5s (12/19)                                                                                                                                                                                                                              
 => [internal] load build definition from Dockerfile                                                                                                                                                                                              0.0s
 => => transferring dockerfile: 2.33kB                                                                                                                                                                                                            0.0s
 => [internal] load .dockerignore                                                                                                                                                                                                                 0.0s
 => => transferring context: 2B                                                                                                                                                                                                                   0.0s
 => [internal] load metadata for docker.io/library/ubuntu:20.04                                                                                                                                                                                   0.2s
 => CACHED https://api.github.com/repos/IBM/pycoq/git/refs/heads/main                                                                                                                                                                             0.0s
 => [ 1/15] FROM docker.io/library/ubuntu:20.04@sha256:fd92c36d3cb9b1d027c4d2a72c6bf0125da82425fc2ca37c414d4f010180dc19                                                                                                                           0.0s
 => CACHED [ 2/15] RUN apt-get update   && apt-get install -y --no-install-recommends     ssh     git     m4     libgmp-dev     opam     wget     ca-certificates     rsync     strace                                                            0.0s
 => CACHED [ 3/15] RUN useradd -m bot                                                                                                                                                                                                             0.0s
 => CACHED [ 4/15] WORKDIR /home/bot                                                                                                                                                                                                              0.0s
 => CACHED [ 5/15] RUN wget https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-x86_64.sh   && bash Miniconda3-latest-Linux-x86_64.sh -b -f                                                                                               0.0s
 => CACHED [ 6/15] RUN conda create -n pycoq python=3.9 -y                                                                                                                                                                                        0.0s
 => CACHED [ 7/15] ADD https://api.github.com/repos/IBM/pycoq/git/refs/heads/main version.json                                                                                                                                                    0.0s
 => ERROR [ 8/15] RUN apt-get update && apt-get install -y --no-install-recommends bubblewrap                                                                                                                                                     1.2s
------                                                                                                                                                                                                                                                 
 > [ 8/15] RUN apt-get update && apt-get install -y --no-install-recommends bubblewrap:
#12 0.237 Reading package lists...
#12 1.118 E: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)
#12 1.118 E: Unable to lock directory /var/lib/apt/lists/
------
executor failed running [/bin/sh -c apt-get update && apt-get install -y --no-install-recommends bubblewrap]: exit code: 100

I am able to fix it with (How to install new packages into non-root Docker Container?):

USER root
RUN apt-get update && apt-get install -y --no-install-recommends bubblewrap
RUN opam init

but unsure if that is the right way to solve this.

Is it?

Dockerfile up to that point:

FROM ubuntu:20.04

RUN apt-get update \
  && apt-get install -y --no-install-recommends \
    ssh \
    git \
    m4 \
    libgmp-dev \
    opam \
    wget \
    ca-certificates \
    rsync \
    strace

RUN useradd -m bot
WORKDIR /home/bot
USER bot

RUN wget https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-x86_64.sh \
  && bash Miniconda3-latest-Linux-x86_64.sh -b -f
ENV PATH="/home/bot/miniconda3/bin:${PATH}"
RUN conda create -n pycoq python=3.9 -y
# somehow this "works" but conda isn't fully aware of this. Fix later?
ENV PATH="/home/bot/miniconda3/envs/pycoq/bin:${PATH}"

ADD https://api.github.com/repos/IBM/pycoq/git/refs/heads/main version.json

# TODO: doesn't seem to work...try later perhaps: https://stackoverflow.com/questions/55123637/activate-conda-environment-in-docker
# TODO: if you run VP's image and attack a volume that seems enough for now.
# RUN conda init bash
# RUN echo "conda activate pycoq" > ~/.bashrc
# RUN conda activate pycoq
#RUN conda update -n base -c defaults conda
#RUN conda install conda-build

# - setp up opam
#RUN conda install -c conda-forge opam
#USER root
RUN apt-get update && apt-get install -y --no-install-recommends bubblewrap
RUN opam init

Note I did try to run it as one command with apt-get update but it failed as suggested here Apt-get not working within ubuntu dockerfile.

I also saw: Docker apt-get update fails but didn't understand it.

Note this also works opam init fails on docker

opam init --disable-sandboxing

but unsure if that is correct.

Answer 1

I was running into the same issue as you with a Dockerfile, permission issue with apt. I did not have the USER line that you added in my original file, once I added it in the Dockerfile the apt ran without any problem. I'm brand new to Docker so I can't tell you if your solution is the correct answer to not but I'm going to keep the USER line in my file until I'm told it's incorrect. In my opinion, it makes sense because I use sudo at the command line to run apt.