While updating my Rails devcontainer to use the latest Ruby 3.4 image, I hit two cryptic build failures on Debian Trixie. If you’re running into similar DevContainer build errors, these fixes will save you some debugging time.

The Errors

Error 1: APT Hash Sum Mismatch

E: Failed to fetch .../libdav1d7_1.5.1-1_arm64.deb  Hash Sum mismatch
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

Error 2: Moby Package Not Found

(!) The 'moby' option is not supported on Debian 'trixie' because 'moby-cli'
and related system packages have been removed from that distribution.

The Fixes

Fix 1: Reorder APT Commands in Dockerfile

Before (broken):

1
2
3
4

RUN rm -rf /var/lib/apt/lists/* \
  && apt-get clean \
  && apt-get update \
  && apt-get install -y chromium gnupg curl

After (working):

1
2
3

RUN apt-get update \
  && apt-get install -y --no-install-recommends chromium gnupg curl \
  && rm -rf /var/lib/apt/lists/*

Why? Clearing the package lists before apt-get update can cause the build to hit stale CDN caches. When you then fetch packages, the checksums don’t match what’s actually on the mirrors. Moving cleanup to after the install follows Docker best practices and avoids this race condition.

Fix 2: Disable Moby in docker-outside-of-docker Feature

Before (broken):

1

"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {}

After (working):

1
2
3

"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
  "moby": false
}

Why? The docker-outside-of-docker feature defaults to installing Docker via Debian’s moby-cli package. But Debian Trixie removed all moby packages from its repositories. Setting "moby": false tells the feature to install the official Docker CLI directly from Docker Inc instead.

Both options give you the same docker command—it’s just a matter of which repository the package comes from.

When You’ll Hit This

  • Using the official Rails devcontainer image (ghcr.io/rails/devcontainer/images/ruby:3.4.x)
  • Any Debian Trixie-based image with the docker-outside-of-docker feature
  • Building with --no-cache (more likely to hit mirror sync issues)

If you’re running a more complex devcontainer setup with GitHub Actions preview environments, make sure to update your base images and feature configurations there as well.

TL;DR

  1. Don’t clear /var/lib/apt/lists/* before apt-get update—do it after install
  2. Add "moby": false to your docker-outside-of-docker feature on Debian Trixie