When I run apt-get update inside a docker container, it fails with member 'control.tar': lzma error: Cannot allocate memory.

Start Debian (bookworm) docker (slim) container.
Copy set of locally built deb package file to the running container.
Create a local deb repo based on locally copied files

cd /tmp/local && dpkg-scanpackages -m . > Packages
echo 'deb [trusted=yes] file:/tmp/local /' > /etc/apt/sources.list.d/00_local.list
apt-get --yes update

The above command fails with

dpkg-deb (subprocess): decompressing archive './xyz_amd64.deb' (size=12723480) member 'control.tar': lzma error: Cannot allocate memory
tar: This does not look like a tar archive
tar: Exiting with failure status due to previous errors
dpkg-deb: error: tar subprocess returned error exit status 2
dpkg-scanpackages: error: couldn't parse control information from ./xyz_amd64.deb

The issue is not seen in all machines. Out of 100+ machines, it seen on two of them. There appears to be lots of memory available.

Edit 1: Three different machines reported the same issue

  2. 5.4.8-1.el7.elrepo.x86_64 (Centos 7)
  3. 5.15.0-76-generic (Ubuntu 20.04)
  • 1
    The solution selected in that question is to use Debian-11, but that is not an option for me. I have to use Debian-12.
    – AjaiS
    Jul 25, 2023 at 23:39
  • Understandable! Jul 25, 2023 at 23:40
  • This smells like your host Linux didn't support one if the syscalls the guest is doing - would you mind telling us the output of uname -r on the host? Jul 25, 2023 at 23:42
  • Two different m/c have reported the issue. 1) 2) 5.4.8-1.el7.elrepo.x86_64
    – AjaiS
    Jul 25, 2023 at 23:48
  • 1
    That seems like very important information that you should edit into your question, and not just have in your comments here. Jul 25, 2023 at 23:52

1 Answer 1


Problem is in clone3 syscall compatibility in Docker 20.10.8 & 20.10.9. Solution is to move to 20.10.10 version or above Release notes for 20.10.10. If not, you might have to resort to hacky W/A

242   clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fac716e4990, parent_tid=0x7fac716e4990, exit_signal=0, stack=0x7fac70ee4000, stack_size=0x7fff80, tls=0x7fac716e46c0} <unfinished ...>
243   brk(NULL <unfinished ...>
242   <... clone3 resumed>, 88)         = -1 EPERM (Operation not permitted)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .