[docker] Add Debian Trixie to the docker-in-docker and docker-outside-of-docker distro lists #1442

skatsubo · 2025-08-14T09:17:20Z

Closes #1059.

Related: #1367.
I'm wondering too if we can relax the distro check a bit and improve support for newly arriving distros in these docker-* extensions. For example, print the "unsupported ..." text in big red letters and then continue setup, in hopes it will work out. Maybe with extra knob (env var) to manage this, keeping current behavior by default.

skatsubo · 2025-08-14T09:18:13Z

@microsoft-github-policy-service agree

samstride · 2025-08-14T20:12:55Z

@AlvaroRausell , any chance you can review and approve?

svallebro · 2025-08-17T23:16:28Z

Is there a way to use this without it being merged?

samstride · 2025-08-18T11:29:55Z

@svallebro , you could try the following:

Assuming you are using docker-outside-of-docker, create a directory called docker-outside-of-docker inside your .devcontainer folder and download these 2 files into that folder.

https://raw.githubusercontent.com/devcontainers/features/refs/heads/main/src/docker-outside-of-docker/install.sh
https://raw.githubusercontent.com/devcontainers/features/refs/heads/main/src/docker-outside-of-docker/devcontainer-feature.json

Update the values of following in install.sh:

MICROSOFT_GPG_KEYS_URI="https://packages.microsoft.com/keys/microsoft-2025.asc"
DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES="trixie bookworm buster bullseye bionic focal jammy noble plucky"
DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES="trixie bookworm buster bullseye bionic focal hirsute impish jammy noble plucky"

Update devcontainer.json to look like this:

	"features": {
		"./docker-outside-of-docker": {}
	},

Rebuild without cache.

@skatsubo , I think you need to update the MICROSOFT_GPG_KEYS_URI to:

MICROSOFT_GPG_KEYS_URI="https://packages.microsoft.com/keys/microsoft-2025.asc"

Thanks.

skatsubo · 2025-08-18T14:30:36Z

@samstride

need to update the MICROSOFT_GPG_KEYS_URI

Thanks for pointing out!

It took some time to find info about the change:

A brief description of the keys used on packages.microsoft.com:

microsoft.asc (BC528686B50D79E339D3721CEB3E94ADBE1229CF):
This key was Microsoft’s standard Linux-signing key until Spring 2025, as discussed above. This key will not be used for newly-created repositories.

microsoft-2025.asc (AA86F75E427A19DD33346403EE4D7792F748182B):
This is the current standard Linux-signing key that will be used in newly-created repositories. It will work properly in distributions that disallow SHA1 signatures.

microsoft-rolling.asc:
This is currently a copy of microsoft-2025.asc. The intention is that this file will be updated in the future to include new keys as they are created and begin being used.

Fix

The fix should somehow include both keys 🫤
Because

Trixie does not work with microsoft.asc
Bookworm does not work with microsoft-2025.asc

See the test script/results below behind spoilers.

Test debian versions vs MS GPG keys

Script

TRY_UPDATE=$(cat <<'EOF'
MICROSOFT_GPG_KEYS_URI="$MICROSOFT_GPG_KEYS_URI"
. /etc/os-release
architecture="$(dpkg --print-architecture)"
apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y gpg curl
curl -sSL ${MICROSOFT_GPG_KEYS_URI} | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg
echo "deb [arch=${architecture} signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/microsoft-${ID}-${VERSION_CODENAME}-prod ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/microsoft.list
apt-get update
EOF
)

for ver in bookworm trixie ; do
  for key in https://packages.microsoft.com/keys/microsoft.asc https://packages.microsoft.com/keys/microsoft-2025.asc ; do
    echo ; echo "--- $ver vs $key ---"
    echo "$TRY_UPDATE" | docker run --rm -i -e MICROSOFT_GPG_KEYS_URI="$key" debian:"$ver"-slim bash | grep -A10 -B3 'packages.microsoft.com'
  done
done

Results

--- bookworm vs microsoft.asc ---
pub   rsa2048 2015-10-28 [SC]
      BC528686B50D79E339D3721CEB3E94ADBE1229CF
uid                      Microsoft (Release signing) <gpgsecurity@microsoft.com>

Hit:1 http://deb.debian.org/debian bookworm InRelease
Hit:2 http://deb.debian.org/debian bookworm-updates InRelease
Hit:3 http://deb.debian.org/debian-security bookworm-security InRelease
Get:4 https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm InRelease [3618 B]
Get:5 https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm/main arm64 Packages [31.4 kB]
Get:6 https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm/main all Packages [573 B]
Fetched 35.6 kB in 1s (53.9 kB/s)
Reading package lists...


--- bookworm vs microsoft-2025.asc ---
pub   rsa4096 2023-11-15 [SC]
      AA86F75E427A19DD33346403EE4D7792F748182B
uid                      Microsoft Corporation - General GPG Signer <gpgsign@microsoft.com>

Hit:1 http://deb.debian.org/debian bookworm InRelease
Hit:2 http://deb.debian.org/debian bookworm-updates InRelease
Hit:3 http://deb.debian.org/debian-security bookworm-security InRelease
Get:4 https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm InRelease [3618 B]
Err:4 https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EB3E94ADBE1229CF
Reading package lists...
W: GPG error: https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EB3E94ADBE1229CF
E: The repository 'https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm InRelease' is not signed.


--- bookworm vs microsoft-rolling.asc ---
pub   rsa4096 2023-11-15 [SC]
      AA86F75E427A19DD33346403EE4D7792F748182B
uid                      Microsoft Corporation - General GPG Signer <gpgsign@microsoft.com>

Hit:1 http://deb.debian.org/debian bookworm InRelease
Hit:2 http://deb.debian.org/debian bookworm-updates InRelease
Hit:3 http://deb.debian.org/debian-security bookworm-security InRelease
Get:4 https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm InRelease [3618 B]
Err:4 https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EB3E94ADBE1229CF
Reading package lists...
W: GPG error: https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EB3E94ADBE1229CF
E: The repository 'https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm InRelease' is not signed.


--- trixie vs microsoft.asc ---
pub   rsa2048 2015-10-28 [SC]
      BC528686B50D79E339D3721CEB3E94ADBE1229CF
uid                      Microsoft (Release signing) <gpgsecurity@microsoft.com>

Hit:1 http://deb.debian.org/debian trixie InRelease
Hit:2 http://deb.debian.org/debian trixie-updates InRelease
Hit:3 http://deb.debian.org/debian-security trixie-security InRelease
Get:4 https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie InRelease [3952 B]
Err:4 https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key EE4D7792F748182B, which is needed to verify signature.
Reading package lists...
W: OpenPGP signature verification failed: https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key EE4D7792F748182B, which is needed to verify signature.
E: The repository 'https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie InRelease' is not signed.


--- trixie vs microsoft-2025.asc ---
pub   rsa4096 2023-11-15 [SC]
      AA86F75E427A19DD33346403EE4D7792F748182B
uid                      Microsoft Corporation - General GPG Signer <gpgsign@microsoft.com>

Hit:1 http://deb.debian.org/debian trixie InRelease
Hit:2 http://deb.debian.org/debian trixie-updates InRelease
Hit:3 http://deb.debian.org/debian-security trixie-security InRelease
Get:4 https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie InRelease [3952 B]
Get:5 https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie/main all Packages [342 B]
Fetched 4294 B in 1s (5364 B/s)
Reading package lists...


--- trixie vs microsoft-rolling.asc ---
pub   rsa4096 2023-11-15 [SC]
      AA86F75E427A19DD33346403EE4D7792F748182B
uid                      Microsoft Corporation - General GPG Signer <gpgsign@microsoft.com>

Hit:1 http://deb.debian.org/debian trixie InRelease
Hit:2 http://deb.debian.org/debian trixie-updates InRelease
Hit:3 http://deb.debian.org/debian-security trixie-security InRelease
Get:4 https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie InRelease [3952 B]
Get:5 https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie/main all Packages [342 B]
Fetched 4294 B in 1s (4115 B/s)
Reading package lists...

Eldogor447-ui · 2025-08-20T09:04:09Z

Cierra #1059 .

Relacionado: #1367 . Me pregunto si podríamos flexibilizar un poco la comprobación de la distribución y mejorar la compatibilidad con las nuevas distribuciones en estas extensiones docker-*. Por ejemplo, imprimir el texto "no compatible..." en letras rojas grandes y continuar con la configuración, con la esperanza de que funcione. Quizás con un control adicional (variable de entorno) para gestionar esto, manteniendo el comportamiento actual por defecto.

skatsubo · 2025-08-20T19:52:06Z

Ready for review.

Fixing MS keys

The fix should somehow include both keys 🫤 Because

Trixie does not work with microsoft.asc

Bookworm does not work with microsoft-2025.asc

Added both microsoft.asc and microsoft-2025.asc to the keyring. Now apt update is happy on both Debian versions. See spoiler below.

Test two keys in keyring (script and its output)

Script

TRY_UPDATE_WITH_BOTH_KEYS=$(cat <<'EOF'
MICROSOFT_GPG_KEY_OLD_URI="https://packages.microsoft.com/keys/microsoft.asc"
MICROSOFT_GPG_KEY_ROLLING_URI="https://packages.microsoft.com/keys/microsoft-rolling.asc"
. /etc/os-release
architecture="$(dpkg --print-architecture)"
apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y gpg curl 2>&1
{
    curl -sSL ${MICROSOFT_GPG_KEY_OLD_URI}
    curl -sSL ${MICROSOFT_GPG_KEY_ROLLING_URI}
} | gpg --show-keys 2>&1
{
    curl -sSL ${MICROSOFT_GPG_KEY_OLD_URI}
    curl -sSL ${MICROSOFT_GPG_KEY_ROLLING_URI}
} | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg
echo "deb [arch=${architecture} signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/microsoft-${ID}-${VERSION_CODENAME}-prod ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/microsoft.list
cat /etc/apt/sources.list.d/microsoft.list
apt-get update
EOF
)

for ver in bookworm trixie ; do
  echo "\n\n--- $ver ---"
  echo "$TRY_UPDATE_WITH_BOTH_KEYS" | docker run --rm -i debian:"$ver"-slim bash | grep -A8 -B2 -i 'microsoft'
done

Output

--- bookworm ---
pub   rsa2048 2015-10-28 [SC]
      BC528686B50D79E339D3721CEB3E94ADBE1229CF
uid                      Microsoft (Release signing) <[email protected]>

pub   rsa4096 2023-11-15 [SC]
      AA86F75E427A19DD33346403EE4D7792F748182B
uid                      Microsoft Corporation - General GPG Signer <[email protected]>

deb [arch=arm64 signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm main
Hit:1 http://deb.debian.org/debian bookworm InRelease
Hit:2 http://deb.debian.org/debian bookworm-updates InRelease
Hit:3 http://deb.debian.org/debian-security bookworm-security InRelease
Get:4 https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm InRelease [3618 B]
Get:5 https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm/main arm64 Packages [31.7 kB]
Get:6 https://packages.microsoft.com/repos/microsoft-debian-bookworm-prod bookworm/main all Packages [573 B]
Fetched 35.8 kB in 0s (90.0 kB/s)
Reading package lists...


--- trixie ---
pub   rsa2048 2015-10-28 [SC]
      BC528686B50D79E339D3721CEB3E94ADBE1229CF
uid                      Microsoft (Release signing) <[email protected]>

pub   rsa4096 2023-11-15 [SC]
      AA86F75E427A19DD33346403EE4D7792F748182B
uid                      Microsoft Corporation - General GPG Signer <[email protected]>

deb [arch=arm64 signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie main
Hit:1 http://deb.debian.org/debian trixie InRelease
Hit:2 http://deb.debian.org/debian trixie-updates InRelease
Hit:3 http://deb.debian.org/debian-security trixie-security InRelease
Get:4 https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie InRelease [3952 B]
Get:5 https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie/main all Packages [342 B]
Fetched 4294 B in 0s (9471 B/s)
Reading package lists...

Installling MS moby ...oh, wait

Anyway, there are no packages yet in the trixie repo https://packages.microsoft.com/debian/13/prod/pool/main/ (compare to bookworm https://packages.microsoft.com/debian/12/prod/pool/main/).

Extension installation attempt with default settings - failed due to missing packages in MS Trixie repo:

* Fetching feature: docker-outside-of-docker_0_file-path
...
Feature       : Docker (docker-outside-of-docker)
Version       : 1.6.4
Options       :
    MOBY="true"
...
Distro codename  'trixie'  matched filter  'trixie bookworm buster bullseye bionic focal jammy noble plucky'
Hit:1 http://deb.debian.org/debian trixie InRelease
Hit:2 http://deb.debian.org/debian trixie-updates InRelease                 
Hit:3 http://deb.debian.org/debian-security trixie-security InRelease       
Get:4 https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie InRelease [3952 B]
Get:5 https://packages.microsoft.com/repos/microsoft-debian-trixie-prod trixie/main all Packages [342 B]
Fetched 4294 B in 1s (4337 B/s)
Reading package lists... Done
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Unable to locate package moby-cli
E: Unable to locate package moby-buildx

Extension installation attempt with moby=false - successful:

	"features": {
		"./docker-outside-of-docker": { "moby": false }
	},

* Fetching feature: docker-outside-of-docker_0_file-path
...
Get:2 https://download.docker.com/linux/debian trixie/stable arm64 docker-ce-cli arm64 5:28.3.3-1~debian.13~trixie [14.9 MB]                
Get:3 https://download.docker.com/linux/debian trixie/stable arm64 docker-compose-plugin arm64 2.39.1-1~debian.13~trixie [12.3 MB]

@samstride Thanks for the hint about local testing.

Kaniska244

Hello @skatsubo ,

Thank you for the contribution. Would you kindly add test cases for debian trixie for both docker-outside-of-docker and docker-in-docker features.

…allation

skatsubo · 2025-08-21T14:32:28Z

Hey @Kaniska244

Would you kindly add test cases for debian trixie for both docker-outside-of-docker and docker-in-docker features.

Added tests using debian:trixie (because mcr.microsoft.com/devcontainers/base:trixie is not available yet). I looked at terraform tests as a reference.
Tested with

devcontainer features test -f docker-outside-of-docker --filter "trixie"
devcontainer features test -f docker-in-docker --filter "trixie"

Tests with moby: false are successful
Tests with moby: true predictably fail due to missing moby package in packages.microsoft.com/repos/microsoft-debian-trixie-prod

KarstenB · 2025-08-26T10:43:23Z

Is there any reason to hold this for longer? We are using moby: false and would happily migrate to Trixie rather sooner than later.

AlvaroRausell

LGTM! I removed the failing test for trixie with moby enabled, as we currently do not have a mechanism to test failures.
Also, apologies for the delay shipping this, I was away and did not have a direct backup. I am actively working on getting more people on board so this does not happen again!

Add Debian Trixie to the docker-* distro list

9452780

skatsubo requested a review from a team as a code owner August 14, 2025 09:17

DiamondJoseph mentioned this pull request Aug 14, 2025

test: Add example services as a submodule DiamondLightSource/blueapi#1155

Merged

meytalt previously approved these changes Aug 15, 2025

View reviewed changes

skatsubo mentioned this pull request Aug 18, 2025

OpenPGP signature verification failed (sqlsrv, trixie) mlocati/docker-php-extension-installer#1144

Open

osman856 approved these changes Aug 18, 2025

View reviewed changes

Grammar

0c61683

skatsubo dismissed meytalt’s stale review via 0c61683 August 20, 2025 19:03

skatsubo force-pushed the docker-support-debian-trixie branch from e6b8649 to 0c61683 Compare August 20, 2025 19:03

Fix Microsoft signing keys for Debian Trixie in docker-*

f1a842c

Kaniska244 suggested changes Aug 21, 2025

View reviewed changes

skatsubo changed the title ~~Add Debian Trixie to the docker-in-docker and docker-outside-of-docker distro lists~~ [docker] Add Debian Trixie to the docker-in-docker and docker-outside-of-docker distro lists Aug 21, 2025

skatsubo added 2 commits August 21, 2025 17:04

Test docker installation on debian trixie

b7b8309

Handle possibly missing moby package in docker-outside-of-docker inst…

7e668fb

…allation

Remove trixie test with moby: true

fd40a99

AlvaroRausell approved these changes Aug 28, 2025

View reviewed changes

AlvaroRausell merged commit da45251 into devcontainers:main Aug 28, 2025
120 checks passed

skatsubo mentioned this pull request Aug 29, 2025

Support for Debian "trixie" release in docker-outside-of-docker feature #1059

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[docker] Add Debian Trixie to the docker-in-docker and docker-outside-of-docker distro lists #1442

[docker] Add Debian Trixie to the docker-in-docker and docker-outside-of-docker distro lists #1442

Uh oh!

skatsubo commented Aug 14, 2025

Uh oh!

skatsubo commented Aug 14, 2025

Uh oh!

samstride commented Aug 14, 2025

Uh oh!

svallebro commented Aug 17, 2025

Uh oh!

samstride commented Aug 18, 2025

Uh oh!

skatsubo commented Aug 18, 2025

Uh oh!

Eldogor447-ui commented Aug 20, 2025

Uh oh!

skatsubo commented Aug 20, 2025

Uh oh!

Kaniska244 left a comment •

edited

Loading

Uh oh!

skatsubo commented Aug 21, 2025

Uh oh!

KarstenB commented Aug 26, 2025

Uh oh!

AlvaroRausell left a comment

Uh oh!

Uh oh!

Uh oh!

[docker] Add Debian Trixie to the docker-in-docker and docker-outside-of-docker distro lists #1442

[docker] Add Debian Trixie to the docker-in-docker and docker-outside-of-docker distro lists #1442

Uh oh!

Conversation

skatsubo commented Aug 14, 2025

Uh oh!

skatsubo commented Aug 14, 2025

Uh oh!

samstride commented Aug 14, 2025

Uh oh!

svallebro commented Aug 17, 2025

Uh oh!

samstride commented Aug 18, 2025

Uh oh!

skatsubo commented Aug 18, 2025

Fix

Test debian versions vs MS GPG keys

Uh oh!

Eldogor447-ui commented Aug 20, 2025

Uh oh!

skatsubo commented Aug 20, 2025

Fixing MS keys

Installling MS moby ...oh, wait

Uh oh!

Kaniska244 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

skatsubo commented Aug 21, 2025

Uh oh!

KarstenB commented Aug 26, 2025

Uh oh!

AlvaroRausell left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Kaniska244 left a comment •

edited

Loading