通过Jenkins Pipeline构建.NET 8 Docker镜像遇APT脚本执行错误

错误现象 #

构建时触发APT缓存清理脚本执行失败，本地构建正常但Jenkins Pipeline中失败：

#6 3.287 Reading package lists...
#6 4.462 E: Problem executing scripts APT::Update::Post-Invoke 'rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true'
#6 4.462 E: Sub-process returned an error code
#6 ERROR: executor failed running [/bin/sh -c apt-get update       && apt-get install -y psmisc dos2unix p7zip-full       && rm -rf /var/lib/apt/lists/*]: exit code: 100
------
 > [ 2/14] RUN apt-get update       && apt-get install -y psmisc dos2unix p7zip-full       && rm -rf /var/lib/apt/lists/*:
1.072 Get:1 http://deb.debian.org/debian bookworm InRelease [151 kB]
1.108 Get:2 http://deb.debian.org/debian bookworm-updates InRelease [52.1 kB]
1.109 Get:3 http://deb.debian.org/debian-security bookworm-security InRelease [48.0 kB]
1.303 Get:4 http://deb.debian.org/debian bookworm/main amd64 Packages [8787 kB]
1.747 Get:5 http://deb.debian.org/debian bookworm-updates/main amd64 Packages [12.7 kB]
1.748 Get:6 http://deb.debian.org/debian-security bookworm-security/main amd64 Packages [134 kB]

4.462 E: Problem executing scripts APT::Update::Post-Invoke 'rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true'
4.462 E: Sub-process returned an error code
------
ERROR: failed to solve: executor failed running [/bin/sh -c apt-get update       && apt-get install -y psmisc dos2unix p7zip-full       && rm -rf /var/lib/apt/lists/*]: exit code: 100

原因分析 #

该错误由APT默认的Post-Invoke缓存清理脚本执行失败导致——尽管脚本末尾加了|| true，但APT仍判定为错误。本地构建正常而Jenkins失败，大概率是Jenkins Agent的Docker环境中，APT缓存目录的权限或存储驱动特性导致清理操作无法完成。

解决方法 #

方法1：临时禁用APT的Post-Invoke清理脚本 #

在执行apt-get update前添加配置，直接禁用默认清理脚本：

ARG DOTNET_BASE_IMAGE=mcr.microsoft.com/dotnet/sdk
ARG DOTNET_VERSION=8.0.100-1-bookworm-slim
ARG LIB_JPEG=libjpeg62
FROM ${DOTNET_BASE_IMAGE}:${DOTNET_VERSION}

# 禁用APT默认的Post-Invoke清理脚本，避免执行错误
RUN echo 'APT::Update::Post-Invoke { "true"; };' > /etc/apt/apt.conf.d/disable-post-invoke-clean

# 合并所有APT安装命令，减少镜像层并避免多次触发清理逻辑
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        psmisc dos2unix p7zip-full \
        libgdiplus ${LIB_JPEG} \
        openjdk-17-jre \
    && rm -rf /var/lib/apt/lists/*

# 安装所需PowerShell模块
RUN pwsh -Command "Install-Module -Name Pester -RequiredVersion 5.5.0 -Scope AllUsers -Force" \
    && pwsh -Command "Install-Module -Name PSScriptAnalyzer -RequiredVersion 1.21.0 -Scope AllUsers -Force" \
    && pwsh -Command "Install-Module -Name SqlServer -RequiredVersion 22.1.1 -Scope AllUsers -Force" \
    && pwsh -Command "Install-Module -Name AWSPowerShell.NetCore -RequiredVersion 4.1.484 -Scope AllUsers -Force"

# 复制PSScriptAnalyzer输出转XML的模块
COPY /pwsh_modules /pwsh_modules

方法2：合并APT命令并手动控制缓存清理 #

将多个apt-get update和install合并为一个RUN指令，减少APT清理脚本的触发次数，同时显式执行缓存清理：

ARG DOTNET_BASE_IMAGE=mcr.microsoft.com/dotnet/sdk
ARG DOTNET_VERSION=8.0.100-1-bookworm-slim
ARG LIB_JPEG=libjpeg62
FROM ${DOTNET_BASE_IMAGE}:${DOTNET_VERSION}

# 合并所有APT操作，仅执行一次update
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        psmisc dos2unix p7zip-full \
        libgdiplus ${LIB_JPEG} \
        openjdk-17-jre \
    # 显式清理缓存，替代APT默认的Post-Invoke脚本
    && rm -rf /var/lib/apt/lists/* \
    && rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin

# 安装所需PowerShell模块
RUN pwsh -Command "Install-Module -Name Pester -RequiredVersion 5.5.0 -Scope AllUsers -Force" \
    && pwsh -Command "Install-Module -Name PSScriptAnalyzer -RequiredVersion 1.21.0 -Scope AllUsers -Force" \
    && pwsh -Command "Install-Module -Name SqlServer -RequiredVersion 22.1.1 -Scope AllUsers -Force" \
    && pwsh -Command "Install-Module -Name AWSPowerShell.NetCore -RequiredVersion 4.1.484 -Scope AllUsers -Force"

# 复制PSScriptAnalyzer输出转XML的模块
COPY /pwsh_modules /pwsh_modules

方法3：检查Jenkins Agent的Docker配置 #

如果上述方法无效，检查Jenkins Agent的Docker存储驱动是否为overlay2——部分环境下该驱动会引发文件权限问题。可以尝试切换存储驱动，或确保Jenkins用户拥有足够的Docker操作权限。

内容的提问来源于stack exchange，提问作者Gani P