Repository navigation
mcr.microsoft.com/devcontainers/universal apt-get update fails due to Yarn repo NO_PUBKEY #1797
Description
Hi,
I’m hitting an apt-get update failure when building a Codespaces devcontainer based on the Microsoft “universal” image, which then causes Features that run apt-get update (e.g. desktop-lite) to fail during installation.
Summary
mcr.microsoft.com/devcontainers/universal:5 (Ubuntu Noble) includes a Yarn APT repo entry (https://dl.yarnpkg.com/debian). During apt-get update, APT fails with:
NO_PUBKEY 62D54FD4003F6525
E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed.
This prevents installing Features that run apt-get update during their install scripts.
Environment
- GitHub Codespaces / devcontainers CLI
- Base image:
mcr.microsoft.com/devcontainers/universal:5 - devcontainers CLI:
0.80.3 - Host kernel (Codespaces):
linux 6.8.0-1030-azure x64
Repro steps
- Create a repo with this
.devcontainer/devcontainer.json:
{
"features": {
"ghcr.io/devcontainers/features/desktop-lite:1": {
"password": "noPassword"
}
},
"forwardPorts": [5901, 6080]
}- Build the devcontainer (Codespaces creation or
devcontainer up).
Expected
apt-get update should succeed and the feature should install normally.
Actual
Feature installation fails during apt-get update because the Yarn repo key is missing:
Running apt-get update...
Err:1 https://dl.yarnpkg.com/debian stable InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 62D54FD4003F6525
...
W: GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 62D54FD4003F6525
E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed.
ERROR: Feature "Light-weight Desktop" (ghcr.io/devcontainers/features/desktop-lite) failed to install!
Notes / workaround
If I remove/disable the Yarn APT source (anything referencing dl.yarnpkg.com/debian) prior to apt-get update, the build proceeds. However, this is hard to do cleanly in Codespaces when relying on Features (without switching to a Dockerfile/custom image).
Request
Could the universal image be updated to:
- include the correct Yarn APT signing key for the configured repo, or
- remove/disable the Yarn APT source by default (if Yarn isn’t intended to be installed via that repo), or
- switch to the current recommended Yarn repo configuration (keyring +
signed-by=) soapt-get updateworks out-of-the-box?
If helpful, I can provide a complete Codespaces creation log, but the snippet above is the key failure.
Thanks!
Mostafa
Activity
debuglevel commentedon Mar 5, 2026
Maybe removing yarn would be an idea. They seem to break
apton a regular basis: #370chore(devcontainer): update Go image and document yarn.list workaround (
korryu3 commentedon Mar 9, 2026
After the error occurs, running a Full Rebuild should fix the issue.
It seems this has already been fixed in the latest v5
devcontainers/universalimages (#1752 (comment)), but Codespaces may still use a cached older image:Alternatively, you can explicitly specify the latest version, for example:
devcontainers/universal:5.1.4.abdurriq commentedon Mar 9, 2026
Mostafa Dahshan (@mdahshan) That is strange, since we patched this a while ago in the universal image. Perhaps you haven't rebuilt your DevContainer, or it was built before that patch was applied?
clarkbreyman commentedon Mar 9, 2026
Abdurrahmaan Iqbal (@abdurriq) - I've done fresh rebuilds today on Codespaces and still seeing this issue.
mdahshan commentedon Mar 10, 2026
Abdurrahmaan Iqbal (@abdurriq) I tried to create a new Codespace with the following devcontainer.json file
{ "image": "mcr.microsoft.com/devcontainers/universal", "features": { "ghcr.io/devcontainers/features/desktop-lite:1": { "password": "noPassword" } }, "forwardPorts": [5901, 6080] }I am still encountering the same error.
abdurriq commentedon Mar 10, 2026
Clark Breyman (@clarkbreyman) / Mostafa Dahshan (@mdahshan) Could you try using
mcr.microsoft.com/devcontainers/universal:5.1-linuxinstead; that might fix it until we can resolve it upstream (likely a Codespaces cache issue).fix(devcontainer): bump to v3 Python image to fix Yarn GPG key failure
fix(devcontainer): bump to v3 Python image to fix Yarn GPG key failure (
fix: 🐛 devcontainerが使用するバージョンを固定
v-Kaniska244 commentedon Apr 21, 2026
Hi Mostafa Dahshan (@mdahshan)
This should be fixed now. Would you kindly test once and inform if the issue persists.
v-Kaniska244 commentedon Apr 22, 2026
Closing this issue a this has been fixed now.
fix(devcontainer): bump to v3 Python image to fix Yarn GPG key failure (
Fix Codespaces container creation failure from stale Yarn apt key
pratik2135 commentedon Sep 12, 2026
I guess the default cache issue still exists Abdurrahmaan Iqbal (@abdurriq).
Could you please confirm. meanwhile the universal: 5.1 works.
v-Kaniska244 commentedon Sep 14, 2026
Hi Pratik Kshirsagar (@pratik2135)
Could you please provide more details on where you are currently getting this with base image and error details?
pratik2135 commentedon Sep 16, 2026
Hi Kaniska (@v-Kaniska244) ,
The default image which codespaces contains is mcr.microsoft.com/devcontainers/universal:2.
This throws the same error message of No_PUBKEY.