Docker build fails on apt-get install with repeated “Hash Sum mismatch” errors (even after disabling cache)

I’m trying to build a Docker image using the cityflowproject/cityflow base. My build consistently fails during the apt-get install step with Hash Sum mismatch errors, even after attempting common fixes like disabling APT caching and cleaning the lists.

The error occurs at: RUN apt-get update && apt-get install -y ...

partial log:

E: Failed to fetch http://deb.debian.org/debian/pool/main/... Hash Sum mismatch Hashes of expected file:

SHA256:... Hashes of received file:
SHA256:... (different) I’ve also tried: • Adding APT config options to handle bad proxies • Forcing rm -rf /var/lib/apt/lists/* before and after • Using --no-cache with Docker

Still facing the same issue. This seems to be a persistent issue with some Debian mirrors or Docker cache behaviors.

FROM cityflowproject/cityflow

# Configure APT to handle proxy and caching issues
RUN echo 'Acquire::http::Pipeline-Depth "0";' >> /etc/apt/apt.conf.d/99fixbadproxy && \
    echo 'Acquire::http::No-Cache "true";' >> /etc/apt/apt.conf.d/99fixbadproxy && \
    echo 'Acquire::BrokenProxy "true";' >> /etc/apt/apt.conf.d/99fixbadproxy

# Clean and update APT, then install packages
RUN rm -rf /var/lib/apt/lists/* && \
    apt-get clean && \
    apt-get update && \
    apt-get install -y --no-install-recommends \
        build-essential \
        cmake \
        git \
        libboost-all-dev && \
    rm -rf /var/lib/apt/lists/*

# Install Python packages
RUN pip install numpy torch matplotlib ```

Solution

There can be numerous causes for this, but I've found it's generally to do with

bad WSL2 behavior
badly-supported/detected compression (can represent an issue with the mirror)
corporate firewall modifying/dropping packets

Given you've tried perhaps the most-widely suggested hacks, try changing your compression type (the default is probably xz)

sudo apt-get update --print-uris  # extensions in output show preferred
sudo apt-get update -o Acquire::CompressionTypes::Order::=gz  # always gzip

You can also set this more permanently as an apt option than repeated command line arg if you prefer

RUN echo 'Acquire::CompressionTypes::Order "gz";' >> /etc/apt/apt.conf.d/99force_gzip

You may find forcing SSL can help with corporate firewalls too

https://askubuntu.com/questions/1237335/how-do-i-force-apt-to-use-https-only

Some other related Questions