MFE Docker image build failing — apt 404 errors on Debian bullseye packages

Community Show & Tell
,
1

Hi Everyone,

We’re running Open edX Ulmo on Tutor v21 (tutor, version 21.0.9) deployed on AWS EC2. The setup has no customizations apart from brand color and logo.

The build was working fine previously, but now when I run:

tutor images build mfe --no-cache

the build fails while installing system packages. Here are some of the relevant error logs:

E: Failed to fetch http://deb.debian.org/debian-security/pool/updates/main/p/perl/libperl5.32_5.32.1-4+deb11u5_amd64.deb  404  Not Found
E: Failed to fetch http://deb.debian.org/debian-security/pool/updates/main/g/glibc/libc-dev-bin_2.31-13+deb11u14_amd64.deb  404  Not Found
E: Failed to fetch http://deb.debian.org/debian-security/pool/updates/main/l/linux/linux-libc-dev_5.10.262-1_amd64.deb  404  Not Found
E: Failed to fetch http://deb.debian.org/debian-security/pool/updates/main/m/mesa/libglx-mesa0_20.3.5-1+deb11u1_amd64.deb  404  Not Found
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

The failure occurs at this step in the MFE Dockerfile:

Dockerfile:5
   5 | RUN apt update \
   6 |   && apt install -y git \
   ...
ERROR: failed to build: failed to solve: process "/bin/sh -c apt update && apt install -y git ..." did not complete successfully: exit code: 100

The 404 errors suggest the specific package versions being requested are no longer present on the Debian security mirror (likely because bullseye packages have been superseded by newer point-release versions, and the base image’s cached package index points to versions that have been removed from the mirror).

To rule out anything environment-specific, I spun up a fresh EC2 instance, installed Open edX Ulmo with Tutor v21.0.9, and ran the same tutor images build mfe --no-cache command — the build fails there with the same errors.

Full error logs are attached for reference.

Has anyone else run into this? What’s the recommended way to resolve it?

Thanks in advance!

MFE_ERROR_LOGS.txt (50.9 KB)

2

I found something more details is

MFE container is using Debian 11 Bullseye.

Debian 11 Bullseye reached LTS end-of-life on August 31, 2026 — only a few days ago. Debian officially says Bullseye is no longer receiving further security updates after August 31, 2026. Debian -- News -- Debian 11 Long Term Support reaches end-of-life

3

Your EOL diagnosis is right, though the specific failure is narrower than a stale index. bullseye-security’s Release file is still being served (dated Aug 31) and still advertises exactly the versions in your log (linux-libc-dev 5.10.262-1, libc-dev-bin 2.31-13+deb11u14, libperl5.32 5.32.1-4+deb11u5), while the matching pool .deb files already return 404. That’s why apt update succeeds and only the install step fails, and why --no-cache on a fresh instance reproduces it.

Two things that may help narrow it down: plain bullseye on Index of /debian is untouched (final point release, pool still intact), so only the security suite is affected. And that security Release carries Valid-Until: Mon, 07 Sep 2026 21:13:04 UTC, so shortly apt update itself will start failing on an expired Release rather than the install 404ing. archive.debian.org does not carry bullseye-security yet, so the usual repoint-to-archive recipe won’t cover it right now.

For scope, this is limited to the MFE image; the openedx image is Ubuntu 22.04 and is unaffected. We’re looking into the fix and will follow up here.

4

Hi I’ve submitted a pull request covering a potential fix for this issue, it could also be backported to Teak (where I’m also facing the same issue).

5

The new tutor-mfe release v22.1.0, containing a fix for this, is out. Thanks, @WillEVTdigital for your contribution.

6

No problem! For older releases not covered by this fix you can use a high priority ENV_TEMPLATE_ROOTS

e.g. Teak v20.1.0

customplugin/plugin.py

hooks.Filters.ENV_TEMPLATE_ROOTS.add_item(
    str(importlib_resources.files("customplugin") / "template_overrides"),
    priority=hooks.priorities.HIGH,
)

customplugin/template_overrides/mfe/build/mfe/Dockerfile

#~~FROM docker.io/node:20.18.0-bullseye-slim AS base~~
FROM docker.io/node:20.18.0-bookworm-slim AS base

RUN apt update \
  && apt install -y git \
    # required for cwebp-bin
    gcc libgl1 libxi6 make \
    # required for gifsicle, mozjpeg, and optipng (on arm)
    autoconf libtool pkg-config zlib1g-dev \
    # required for node-sass (on arm); bookworm has no python2 package
    #~~python g++ \~~    
    python3 python-is-python3 g++ \
    # required for image-webpack-loader (on arm)
    libpng-dev \
    # required for building node-canvas (on arm, for authoring)
    # https://www.npmjs.com/package/canvas
    libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev


#### COPY REST OF DOCKERFILE ####
7

We have back ported this fix to ulmo, teak, sumac and redwood as well, for more info refer to Tutor-mfe: bullseye EOL fix backported to Redwood, Sumac, Teak and Ulmo