I have a Dockerfile which is built in a CI/CD pipeline. It starts with a Drupal image based on Debian 9 stretch and installs Node 10. Building the image has worked for the past three years but it just stopped working yesterday.

To reproduce the issue I can run the container without any of the instructions from the Dockerfile:

docker run -it drupal:8.6.1-apache bash

Then in the container I run this script which should install Node 10:

curl -fsSL https://deb.nodesource.com/setup_10.x | bash -

The script fails when trying to install apt-transport-https. If I try to install it directly so I can see the error I get:

apt-get update && apt-get install -y apt-transport-https
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 apt-transport-https : Depends: apt (>= 1.5~alpha4) but 1.4.8 is to be installed
E: Unable to correct problems, you have held broken packages.

If I try to run this to install that specific version:

apt-get install -y apt=1.5~alpha4
E: Version '1.5~alpha4' for 'apt' was not found

If I run this to see the list of available versions of apt:

apt list -a apt
apt/stable-updates amd64 [upgradable from: 1.4.8]
apt/stable,stable amd64
apt/oldstable 1.4.11 amd64
apt/oldstable 1.4.10 amd64
apt/now 1.4.8 amd64 [installed,upgradable to:]

Then if I:

apt-get install -y apt=
The following packages have unmet dependencies:
 apt : Depends: libapt-pkg5.0 (>= 1.7.0~alpha3~) but 1.4.8 is to be installed
       Depends: libgnutls30 (>= 3.6.6) but 3.5.8-5+deb9u5 is to be installed
E: Unable to correct problems, you have held broken packages.

Then if I try to install the required version of libapt-pkg5.0:

The following packages have unmet dependencies:
 libapt-pkg5.0 : Depends: libc6 (>= 2.27) but 2.24-11+deb9u4 is to be installed
                 Depends: libzstd1 (>= 1.3.2) but 1.1.2-1+deb9u1 is to be installed
                 Breaks: apt (< 1.6~) but 1.4.8 is to be installed
                 Recommends: apt (>= but 1.4.8 is to be installed

Then if I run:

apt-get install -y libzstd1=1.3.8+dfsg-3+deb10u2 # this seems to install fine
apt-get install -y libc6=2.28-10

The libc6 installation fails with:

Reading package lists... 0%
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
Use 'apt autoremove' to remove it.
Suggested packages:
  glibc-doc libc-l10n locales
Recommended packages:
The following packages will be upgraded:
1 upgraded, 0 newly installed, 0 to remove and 57 not upgraded.
Need to get 2867 kB of archives.
After this operation, 1693 kB of additional disk space will be used.
Get:1 http://deb.debian.org/debian buster/main amd64 libc6 amd64 2.28-10 [2867 kB]
Fetched 2867 kB in 1s (1858 kB/s)
debconf: delaying package configuration, since apt-utils is not installed
dpkg: warning: 'ldconfig' not found in PATH or not executable
dpkg: error: 1 expected program not found in PATH or not executable
Note: root's PATH should usually contain /usr/local/sbin, /usr/sbin and /sbin
E: Sub-process /usr/bin/dpkg returned an error code (2)

At this point I've spent hours troubleshooting this issue and I'm wondering if it's worth it to keep going in this direction or if there is another way to resolve this.

I was able to satisfy all the dependencies using aptitude in a fresh container like this:

apt-get update
apt-get install -y aptitude
aptitude install apt-transport-https

It asks me:

The following NEW packages will be installed:
  apt-transport-https libseccomp2{a}
The following packages will be upgraded:
  apt{b} libapt-pkg5.0{b}
2 packages upgraded, 2 newly installed, 0 to remove and 59 not upgraded.
Need to get 2575 kB of archives. After unpacking 1189 kB will be used.
The following packages have unmet dependencies:
 apt : Depends: libgnutls30 (>= 3.6.6) but 3.5.8-5+deb9u3 is installed and it is kept back
       Breaks: aptitude (< 0.8.10) but 0.8.7-1 is installed
 libapt-pkg5.0 : Depends: libc6 (>= 2.27) but 2.24-11+deb9u3 is installed and it is kept back
                 Depends: libzstd1 (>= 1.3.2) but it is not going to be installed
                 Breaks: aptitude (< 0.8.9) but 0.8.7-1 is installed
The following actions will resolve these dependencies:

     Keep the following packages at their current version:
1)     apt [1.4.8 (now)]
2)     apt-transport-https [Not Installed]
3)     libapt-pkg5.0 [1.4.8 (now)]

Accept this solution? [Y/n/q/?]

This solution does nothing but if I enter n it then asks me:

The following actions will resolve these dependencies:

      Install the following packages:
1)      libboost-iostreams1.67.0 [1.67.0-13+deb10u1 (stable)]
2)      libboost-system1.67.0 [1.67.0-13+deb10u1 (stable)]
3)      libgpm2 [1.20.4-6.2+b1 (oldstable)]
4)      libncursesw6 [6.1+20181013-2+deb10u2 (stable)]
5)      libtinfo6 [6.1+20181013-2+deb10u2 (stable)]
6)      libunistring2 [0.9.10-1 (stable)]
7)      libzstd1 [1.3.8+dfsg-3+deb10u2 (stable)]

      Upgrade the following packages:
8)      aptitude [0.8.7-1 (now, oldstable) -> 0.8.11-7 (stable)]
9)      aptitude-common [0.8.7-1 (now, oldstable) -> 0.8.11-7 (stable)]
10)     libc-bin [2.24-11+deb9u3 (now) -> 2.28-10 (stable)]
11)     libc-dev-bin [2.24-11+deb9u3 (now) -> 2.28-10 (stable)]
12)     libc6 [2.24-11+deb9u3 (now) -> 2.28-10 (stable)]
13)     libc6-dev [2.24-11+deb9u3 (now) -> 2.28-10 (stable)]
14)     libcwidget3v5 [0.5.17-4+b1 (now, oldstable) -> 0.5.17-11 (stable)]
15)     libgnutls30 [3.5.8-5+deb9u3 (now) -> 3.6.7-4+deb10u4 (stable)]
16)     libhogweed4 [3.3-1+b2 (now, oldstable) -> 3.4.1-1 (stable)]
17)     libidn2-0 [0.16-1+deb9u1 (now, oldstable) -> 2.0.5-1+deb10u1 (stable)]
18)     libnettle6 [3.3-1+b2 (now, oldstable) -> 3.4.1-1 (stable)]
19)     libp11-kit0 [0.23.3-2 (now, oldstable) -> 0.23.15-2+deb10u1 (stable)]
20)     libtasn1-6 [4.10-1.1+deb9u1 (now, oldstable) -> 4.13-3 (stable)]
21)     libxapian30 [1.4.3-2+deb9u3 (now, oldstable) -> 1.4.11-1 (stable)]

Accept this solution? [Y/n/q/?]

Accepting this solution works - apt-transport-https is successfully installed and then I am able to run the curl -fsSL https://deb.nodesource.com/setup_10.x | bash - script to install Node. However, this is an interactive solution which requires me to enter n once, then y twice, and I couldn't figure out a way to have that happen automatically during a Docker build.

2 Answers 2


The image is configured to reject packages from Debian 10 (buster), but not from updates (buster-updates), so it ends up trying to pull apt-transport-https from the latter. To fix that, edit /etc/apt/preferences.d/argon2-buster so that it reads

Package: *
Pin: release n=buster*
Pin-Priority: -10

Package: libargon2*
Pin: release n=buster
Pin-Priority: 990

I.e. add * after the first buster. This will allow apt-transport-https to be installed without issue.

You can automate this with

sed -i '2,2s/buster/buster*/' /etc/apt/preferences.d/argon2-buster

In my case, I am working with a docker image based on php:7.2.15-apache-stretch. I figured out that the script was trying to install apt-transport-https version=1.4.11.

However when running apt apt-transport-https -v inside a container built before this problem appeared, I got that the version was 1.4.10. So I changed it and it was solved.

Just added the install before the node curl.

FROM php:7.2.15-apache-stretch
RUN apt-get update
RUN apt-get install -y apt-transport-https=1.4.10
RUN curl -sL https://deb.nodesource.com/setup_15.x | bash -
  • This was the case for me, I too was able to double check in the container in production, was running 1.4.9. But that version is no longer available for some reason. So I crossed my fingers and installed 1.4.10 using the technique above and all went well. Thanks a lot! The NodeJS setup looks for a few packages and installs if not present, just had to pull those out and intall them earlier in the Dockerfile so I could control the version. Jul 3, 2021 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.