Can't install docker-in-docker

[mikoto2000]

I try this devcontainer.json.

Then, I got this error.

It says 1.560 E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed. so I think the problem is with the apt certificate, but how can I resolve this?

 > [dev_containers_target_stage 5/5] RUN --mount=type=bind,from=dev_containers_feature_content_source,source=docker-in-docker_0,target=/tmp/build-features-src/docker-in-docker_0     cp -ar /tmp/build-features-src/docker-in-docker_0 /tmp/dev-container-features  && chmod -R 0755 /tmp/dev-container-features/docker-in-docker_0  && cd /tmp/dev-container-features/docker-in-docker_0  && chmod +x ./devcontainer-features-install.sh  && ./devcontainer-features-install.sh  && rm -rf /tmp/dev-container-features/docker-in-docker_0:
0.206 ===========================================================================
0.206 Feature       : Docker (Docker-in-Docker)
0.206 Description   : Create child containers *inside* a container, independent from the host's docker instance. Installs Docker extension in the container along with needed CLIs.
0.206 Id            : ghcr.io/devcontainers/features/docker-in-docker
0.206 Version       : 2.14.0
0.206 Documentation : https://github.com/devcontainers/features/tree/main/src/docker-in-docker
0.206 Options       :
0.206     VERSION="latest"
0.206     MOBY="true"
0.206     MOBYBUILDXVERSION="latest"
0.206     DOCKERDASHCOMPOSEVERSION="v2"
0.206     AZUREDNSAUTODETECTION="true"
0.206     DOCKERDEFAULTADDRESSPOOL=""
0.206     INSTALLDOCKERBUILDX="true"
0.206     INSTALLDOCKERCOMPOSESWITCH="false"
0.206     DISABLEIP6TABLES="false"
0.206 ===========================================================================
0.211 (*) bookworm is supported for Moby installation  - setting up Microsoft repository
0.214 find: '/var/lib/apt/lists/*': No such file or directory
0.215 Running apt-get update...
0.336 Get:1 http://deb.debian.org/debian bookworm InRelease [151 kB]
0.353 Get:2 https://dl.yarnpkg.com/debian stable InRelease
0.382 Err:2 https://dl.yarnpkg.com/debian stable InRelease
0.382   The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>
0.396 Get:3 http://deb.debian.org/debian bookworm-updates InRelease [55.4 kB]
0.417 Get:4 http://deb.debian.org/debian-security bookworm-security InRelease [48.0 kB]
0.439 Get:5 http://deb.debian.org/debian bookworm/main amd64 Packages [8792 kB]
0.727 Get:6 http://deb.debian.org/debian bookworm-updates/main amd64 Packages [6924 B]
0.727 Get:7 http://deb.debian.org/debian-security bookworm-security/main amd64 Packages [292 kB]
1.280 Reading package lists...
1.560 W: GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>
1.560 E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed.
1.561 ERROR: Feature "Docker (Docker-in-Docker)" (ghcr.io/devcontainers/features/docker-in-docker) failed to install! Look at the documentation at https://github.com/devcontainers/features/tree/main/src/docker-in-docker for help troubleshooting this error.
------

[ViktorVerstraelenCoC]

We're seeing the same issue for the docker-outside-of-docker feature

[SimonHaas]

I temporarily fixed it with a custom dockerfile for now:

FROM mcr.microsoft.com/devcontainers/go:2-1.25-bookworm
USER root
RUN rm -f /etc/apt/sources.list.d/yarn.list \
    && rm -f /usr/share/keyrings/yarn.gpg \
    && apt-get update

devcontainer.json

	//"image": "mcr.microsoft.com/devcontainers/go:2-1.25-bookworm",
    "build": {
        // Path is relative to the devcontainer.json file.
        "dockerfile": "Dockerfile"
    },

	// Features to add to the dev container. More info: https://containers.dev/features.
	"features": {
		"ghcr.io/devcontainers/features/docker-outside-of-docker:latest": {},
	 	"ghcr.io/devcontainers/features/node:latest": {}
	},

[eimhin-rover]

Yea these issues are coming from yarn itself yarnpkg/yarn#9216.

If you are using the node feature anywhere, you can pass a installYarnUsingApt option set to false to bypass using apt which seems to work (see here).

This won't work for this exact issue though since you'd need to change the options inside the dependencies of docker-in-docker feature though just as an fyi. Just noticed the node feature is not actually a dependency of the docker-in-docker one so guess it's something else

Edit 2: Ah I didn't realise your devcontainer go image had a dependency on the node feature that makes sense now.

[ayorgo]

Another temporary fix for docker-in-docker:

1. Copy devcontainer-feature.json and install.sh from the source to .devcontainer/features/docker-in-docker/ locally.
2. Append --allow-insecure-repositories to both line 70 and line 448 in install.sh.
3. Point devcontainer.json to the local version of the feature:

   "features": {
     "./features/docker-in-docker": {}
   }

[Daniel15]

This has been resolved in Yarn - the GPG key has been updated to expire in 2030. I'm not familiar with this part of devcontainers, but just pulling the latest GPG key should resolve it.

[iliatimofeev]

Problem
Devcontainer builds fail during feature installation (e.g. ghcr.io/devcontainers/features/docker-in-docker) because the feature runs apt-get update, which errors out with an expired Yarn repo signature (e.g. EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>). This happens before onCreateCommand / postCreateCommand, so it cannot be fixed at runtime.

Change image → build
With "image": "..." we can’t run any custom steps before features are installed. Switching to:

"build": { "dockerfile": "Dockerfile" }

Workaround
The Yarn APT repo in this base image is configured with:

• /etc/apt/sources.list.d/yarn.list referencing
  signed-by=/usr/share/keyrings/yarn-archive-keyring.gpg

Generate the keyring file (run in recovery mode)

curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg \
  | gpg --dearmor > .devcontainer/yarn-archive-keyring.gpg

.devcontainer/Dockerfile

# syntax=docker/dockerfile:1
FROM mcr.microsoft.com/vscode/devcontainers/miniconda:0-3

# Workaround for Yarn APT repo key expiration during devcontainer feature install.
COPY yarn-archive-keyring.gpg /usr/share/keyrings/yarn-archive-keyring.gpg
RUN chmod a+r /usr/share/keyrings/yarn-archive-keyring.gpg