# Fixing DevContainer Build Failures on Debian Trixie
> Two quick fixes for cryptic APT hash mismatches and missing moby packages when building devcontainers on Debian Trixie.

Canonical URL: https://rida.me/blog/fixing-devcontainer-build-failures-debian-trixie/


While updating my Rails devcontainer to use the latest Ruby 3.4 image, I hit two cryptic build failures on Debian Trixie. If you're running into similar DevContainer build errors, these fixes will save you some debugging time.

## The Errors

### Error 1: APT Hash Sum Mismatch

```
E: Failed to fetch .../libdav1d7_1.5.1-1_arm64.deb  Hash Sum mismatch
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
```

### Error 2: Moby Package Not Found

```
(!) The 'moby' option is not supported on Debian 'trixie' because 'moby-cli'
and related system packages have been removed from that distribution.
```

## The Fixes

### Fix 1: Reorder APT Commands in Dockerfile

**Before (broken):**

```dockerfile
RUN rm -rf /var/lib/apt/lists/* \
  && apt-get clean \
  && apt-get update \
  && apt-get install -y chromium gnupg curl
```

**After (working):**

```dockerfile
RUN apt-get update \
  && apt-get install -y --no-install-recommends chromium gnupg curl \
  && rm -rf /var/lib/apt/lists/*
```

**Why?** Clearing the package lists *before* `apt-get update` can cause the build to hit stale CDN caches. When you then fetch packages, the checksums don't match what's actually on the mirrors. Moving cleanup to *after* the install follows [Docker best practices](https://docs.docker.com/build/building/best-practices/#apt-get) and avoids this race condition.

### Fix 2: Disable Moby in docker-outside-of-docker Feature

**Before (broken):**

```json
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {}
```

**After (working):**

```json
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
  "moby": false
}
```

**Why?** The `docker-outside-of-docker` feature defaults to installing Docker via Debian's `moby-cli` package. But Debian Trixie removed all moby packages from its repositories. Setting `"moby": false` tells the feature to install the official Docker CLI directly from Docker Inc instead.

Both options give you the same `docker` command—it's just a matter of which repository the package comes from.

## When You'll Hit This

- Using the official Rails devcontainer image (`ghcr.io/rails/devcontainer/images/ruby:3.4.x`)
- Any Debian Trixie-based image with the `docker-outside-of-docker` feature
- Building with `--no-cache` (more likely to hit mirror sync issues)

If you're running a more complex devcontainer setup with [GitHub Actions preview environments](/blog/kamal-github-review-apps/), make sure to update your base images and feature configurations there as well.

## TL;DR

1. Don't clear `/var/lib/apt/lists/*` before `apt-get update`—do it after install
2. Add `"moby": false` to your `docker-outside-of-docker` feature on Debian Trixie