Do an apt-get update before installing `deb` dependencies, if any about oca-ci HOT 6 CLOSED

I had the same problem last week with another Ubuntu package required by my tests. I think this happens when a package has a security vulnerability: it is then removed to avoid being installed and cause a security hole on the host, just because of an outdated apt database. I think it is a good practice to always apt update before apt install.

from oca-ci.

I'm not an expert about deb packaging neither Runbot or the Runboat that you want build with kubernetes technologies.

From my point of view, your root mistake cause is continue using deb packages inside containers.

Your approach to build Odoo CI with k8s (CDeployment) is well raised, but I propose change all possible deb dependencies with Git dependencies.

Nowadays, in kubernetes environment, the best approach is work with GitOps workflow.

I hope give you another point of view.

from oca-ci.

One easy to run solution is to add an apt cache proxy like apt-cacher-ng. Then you will not update the proxy if packages are not available. Additionaly it will run faster and with less bandwith.

from oca-ci.

in a docker container, you cannot rely on an apt update happening at build time of the image: 1. typically, to have a smaller image, you will get an apt-get clean in the Dockerfile and 2. there may be a new version of the tool you want to install pushed in the repository between the building of the image and the running of the container (and these are typically secutrity updates.

So if you need to install things at container runtime, you need to apt-get update (you may want to do this lazily, i.e. try to install and if you fail, apt update and try again), but I think a better approach is to clean up the apt cache in the base docker image and systematically update in the container.

from oca-ci.

@zeroheure yes but no. The goal here is to test using the versions of dependencies available in stable distributions, with security patches applied.

from oca-ci.

The apt update needs to be done around here. We need to do it only if there any external dependencies to install, for performance reasons.

from oca-ci.