Hello, I am currently trying to set up Discourse on a new machine. I checked out the discourse_docker repository and ran ./launcher rebuild app. (I skipped bootstrapping because I had configurations from before). Rebuilding resulted in the following output: WARNING: We are about to start downloading the Discourse base image This process may take anywhere between a few minutes to an hour, depending on your network speed Please be patient ERRO[0001] Metadata for targets expired ERRO[0002] Metadata for targets expired /usr/bin/docker: Error: remote repository docker.io/discourse/base out-of-date: targets expired at Mon Nov 18 12:52:09 -0500 2019. See '/usr/bin/docker run --help'. Your Docker installation is not working correctly See: https://meta.discourse.org/t/docker-error-on-bootstrap/13657/18?u=sam To get to the root of the problem I checked the command that is run and ran it in debug mode: /usr/bin/docker --debug run -i --rm -a stdout -a stderr discourse/base:2.0.20191219-2109 echo working See: discourse_docker/launcher at 1b3dd3a41b544592be46b39db563bb757f88bbad · discourse/discourse_docker · GitHub The output of the command: DEBU[0000] reading certificate directory: /root/.docker/tls/notary.docker.io DEBU[0000] No yubikey found, using alternative key storage: no library found DEBU[0000] Making dir path: /root/.docker/trust/tuf/docker.io/discourse/base/changelist DEBU[0000] entered ValidateRoot with dns: docker.io/discourse/base DEBU[0000] found the following root keys: [5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8] DEBU[0000] found 1 valid leaf certificates for docker.io/discourse/base: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0000] found 1 leaf certs, of which 1 are valid leaf certs for docker.io/discourse/base DEBU[0000] checking root against trust_pinning config for docker.io/discourse/base DEBU[0000] checking trust-pinning for cert: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0000] role has key IDs: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0000] verifying signature for key ID: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0000] root validation succeeded for docker.io/discourse/base DEBU[0000] entered ValidateRoot with dns: docker.io/discourse/base DEBU[0000] found the following root keys: [5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8] DEBU[0000] found 1 valid leaf certificates for docker.io/discourse/base: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0000] found 1 leaf certs, of which 1 are valid leaf certs for docker.io/discourse/base DEBU[0000] checking root against trust_pinning config for docker.io/discourse/base DEBU[0000] checking trust-pinning for cert: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0000] role has key IDs: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0000] verifying signature for key ID: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0000] root validation succeeded for docker.io/discourse/base DEBU[0000] updating TUF client DEBU[0000] Loading timestamp... DEBU[0001] 200 when retrieving metadata for timestamp DEBU[0001] timestamp role has key IDs: db679e1f17a2a2bdd9952b6f37c9048635611f162bc6a0957ec30fbb1412d366 DEBU[0001] verifying signature for key ID: db679e1f17a2a2bdd9952b6f37c9048635611f162bc6a0957ec30fbb1412d366 DEBU[0001] timestamp role has key IDs: db679e1f17a2a2bdd9952b6f37c9048635611f162bc6a0957ec30fbb1412d366 DEBU[0001] verifying signature for key ID: db679e1f17a2a2bdd9952b6f37c9048635611f162bc6a0957ec30fbb1412d366 DEBU[0001] successfully verified downloaded timestamp DEBU[0001] Loading snapshot... DEBU[0001] snapshot role has key IDs: e88a99d5b23301178976a4a103df4716f7943301d9972db0541bfa17c94cb75b DEBU[0001] verifying signature for key ID: e88a99d5b23301178976a4a103df4716f7943301d9972db0541bfa17c94cb75b DEBU[0001] successfully verified cached snapshot DEBU[0001] Loading targets... DEBU[0001] no targets in cache, must download DEBU[0001] 200 when retrieving metadata for targets.09b50021560effa664eb8271cd16e2212ed55b7b63b2127cf9a0e69cfe2b47b7 DEBU[0001] targets role has key IDs: c016860a9293a48bc98f27b9c36d81515f4bcc3dd2ec93bb2d6d8af8f37a39d2 DEBU[0001] verifying signature for key ID: c016860a9293a48bc98f27b9c36d81515f4bcc3dd2ec93bb2d6d8af8f37a39d2 ERRO[0001] Metadata for targets expired DEBU[0001] downloaded targets.09b50021560effa664eb8271cd16e2212ed55b7b63b2127cf9a0e69cfe2b47b7 is invalid: targets expired at Mon Nov 18 12:52:09 -0500 2019 DEBU[0001] Client Update (Targets): targets expired at Mon Nov 18 12:52:09 -0500 2019 DEBU[0001] Error occurred. Root will be downloaded and another update attempted DEBU[0001] Resetting the TUF builder... DEBU[0001] entered ValidateRoot with dns: docker.io/discourse/base DEBU[0001] found the following root keys: [5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8] DEBU[0001] found 1 valid leaf certificates for docker.io/discourse/base: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0001] found 1 leaf certs, of which 1 are valid leaf certs for docker.io/discourse/base DEBU[0001] found the following root keys: [5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8] DEBU[0001] found 1 valid leaf certificates for docker.io/discourse/base: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0001] found 1 valid root leaf certificates for docker.io/discourse/base: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0001] role has key IDs: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0001] verifying signature for key ID: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0001] checking root against trust_pinning config for docker.io/discourse/base DEBU[0001] checking trust-pinning for cert: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0001] role has key IDs: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0001] verifying signature for key ID: 5f5ba22b20768b8f2d49e9035400a1922ae761aa70b5bb0d930fe91dd06bd5d8 DEBU[0001] root validation succeeded for docker.io/discourse/base DEBU[0001] successfully verified cached root DEBU[0001] retrying TUF client update DEBU[0001] Loading timestamp... DEBU[0002] 200 when retrieving metadata for timestamp DEBU[0002] timestamp role has key IDs: db679e1f17a2a2bdd9952b6f37c9048635611f162bc6a0957ec30fbb1412d366 DEBU[0002] verifying signature for key ID: db679e1f17a2a2bdd9952b6f37c9048635611f162bc6a0957ec30fbb1412d366 DEBU[0002] successfully verified downloaded timestamp DEBU[0002] Loading snapshot... DEBU[0002] snapshot role has key IDs: e88a99d5b23301178976a4a103df4716f7943301d9972db0541bfa17c94cb75b DEBU[0002] verifying signature for key ID: e88a99d5b23301178976a4a103df4716f7943301d9972db0541bfa17c94cb75b DEBU[0002] successfully verified cached snapshot DEBU[0002] Loading targets... DEBU[0002] no targets in cache, must download DEBU[0002] 200 when retrieving metadata for targets.09b50021560effa664eb8271cd16e2212ed55b7b63b2127cf9a0e69cfe2b47b7 DEBU[0002] targets role has key IDs: c016860a9293a48bc98f27b9c36d81515f4bcc3dd2ec93bb2d6d8af8f37a39d2 DEBU[0002] verifying signature for key ID: c016860a9293a48bc98f27b9c36d81515f4bcc3dd2ec93bb2d6d8af8f37a39d2 ERRO[0002] Metadata for targets expired DEBU[0002] downloaded targets.09b50021560effa664eb8271cd16e2212ed55b7b63b2127cf9a0e69cfe2b47b7 is invalid: targets expired at Mon Nov 18 12:52:09 -0500 2019 DEBU[0002] Client Update (Targets): targets expired at Mon Nov 18 12:52:09 -0500 2019 /usr/bin/docker: Error: remote repository docker.io/discourse/base out-of-date: targets expired at Mon Nov 18 12:52:09 -0500 2019. See '/usr/bin/docker run --help'. I have no idea why this happens. I checked the git history and reverted to the previously used base image to check if that works. The result was the same. See: Bump base image · discourse/discourse_docker@1b3dd3a · GitHub Any help would be welcome :slight_smile: Update #1 I have created a post in the Docker forum to discuss this problem as suggested by @Falco. [תמונה] [Issue] Metadata for targets expired Docker Engine General Hello, I have an issue pulling a certain image: $ docker pull discourse/base:2.0.20191219-2109 ERRO[0001] Metadata for targets expired ERRO[0002] Metadata for targets expired Error: remote repository docker.io/discourse/base out-of-date:...

@Falco I have created a post on the Docker forums and got a reply. The problem is connected to DOCKER_CONTENT_TRUST=1. To reproduce this issue you can run the following commands: $ export DOCKER_CONTENT_TRUST=1 $ docker pull discourse/base:2.0.20191219-2109

Can you update docker to the latest version available for your OS and try again?

Thank you for your reply @Falco. I am running the latest version of Docker: Docker version 19.03.5, build 633a0ea838 See: Docker Engine version 29 release notes | Docker Docs Sorry, for not mentioning this before :roll_eyes:

[תמונה] Falco: docker pull discourse/base:2.0.20191219-2109 Yes. This command fails the same way as described in my initial post: ERRO[0001] Metadata for targets expired ERRO[0002] Metadata for targets expired Error: remote repository docker.io/discourse/base out-of-date: targets expired at Mon Nov 18 12:52:09 -0500 2019

That is very weird. Is your server clock right? Do you have any weird caching, firewall or something?

@Falco My clock seems to be synced: $ timedatectl status Local time: Fr 2019-12-27 19:57:48 CET Universal time: Fr 2019-12-27 18:57:48 UTC RTC time: Fr 2019-12-27 18:57:49 Time zone: Europe/Berlin (CET, +0100) System clock synchronized: yes systemd-timesyncd.service active: yes RTC in local TZ: no I am running Ubuntu 18.04 LTS.

I also want to mention that other containers run just fine. So it seems to be somehow related to the Discourse image.

Well, I can docker pull discourse/base:2.0.20191219-2109 just fine, across many OSs, in different cloud providers in different continents so I’d say it’s something particular to your local computer/docker install. As this comes from the docker service, try seeking help on https://forums.docker.com/

Will do @Falco. Thank you for your help so far :slight_smile:

Oh I see. Why did you set this flag on your local machine? It doesn’t come enabled by default in Ubuntu.

Discourse docker images are not signed

תמיכה התקנה

Falco (Falco) 27 בדצמבר,‏ 2019,‏ 6:51pm 4

So a simple

docker pull discourse/base:2.0.20191219-2109

is failing?

נושא		תגובות	צפיות
500 Error trying to upgrade discourse Self-hosting	10	564	17 באפריל,‏ 2024
Is Docker image discourse/discourse considered safe and production-ready? Self-hosting hosting	30	3723	26 במאי,‏ 2026
Community supported official docker image Development	35	9308	22 ביולי,‏ 2022
Tag 1.3.10 not found on reload Product Support	6	1382	17 בינואר,‏ 2017
Manually update Discourse and Docker image to latest Self-Hosting how-to	13	112345	16 בינואר,‏ 2025

Discourse docker images are not signed

נושאים קשורים