Docker / Self-Hosting

Docker's Install Script Silently Half-Fails in a Fresh LXC Container

Docker can report itself installed in a fresh LXC and still not run. This happens when you install it over a non-interactive SSH session. That is exactly what a provisioning script is.

The symptom

Install docker with command apt-get install docker-ce over a plain SSH command on a freshly provisioned Ubuntu or Debian LXC. The install partially fails.

dpkg: error processing package docker-ce (--configure):

Then you try to use docker and get this.

Failed to resolve group docker: No such process

docker.socket will not start. The docker group does not exist. The package's own post-install step is supposed to create that group. It never got that far.

BE WARNED: dpkg -l will still list docker-ce as installed. This reads like a permissions problem. It is not.

Why it happens

The postinst script for docker-ce wants an interactive debconf frontend. A scripted SSH session does not have one.

Instead of skipping the interactive parts, the postinst fails partway. The package ends up half configured. Present, but not set up.

This does not hit every container. I provisioned several LXCs the same way and only some of them broke. It may depend on timing or ordering inside the install. Do not assume a provisioning script that worked last time will work this time. Check for this after every non-interactive docker install.

The fix

Finish the interrupted postinst, then start the pieces it never started.

DEBIAN_FRONTEND=noninteractive dpkg --configure -a
systemctl enable --now docker.socket docker.service

The first command re-runs configuration with the frontend forced. That is what creates the docker group.

The second brings up the socket and the daemon. Do not assume they start on their own.

Worth adding to any provisioning script targeting fresh containers

Run both fix commands right after the install step. Every time. They are harmless on a container where the install worked.

They save you from debugging a "docker isn't working" report that traces back to a postinst that never finished.