[soulteary]

Temporary dpkg contention from another package installation currently makes the installer's APT package installations fail immediately. This change gives those commands a bounded 60-second wait and still fails when the lock is not released in time.

- What I did

• Added -o DPkg::Lock::Timeout=60 to the APT prerequisite and Docker Engine package installations.
• Added the same option to the rootless installer's printed uidmap and iptables installation instructions, while preserving both command -v apt-get availability checks.
• Added a dedicated regression suite and CI job for generated commands and real dpkg lock contention.

- How I did it

The change uses APT's existing dpkg lock-acquisition timeout without introducing retries or changing package selection, -y, -qq, or the existing --allow-downgrades behavior. Both apt-get update commands are unchanged: DPkg::Lock::Timeout does not wait for their /var/lib/apt/lists/lock.

APT added this capability in 1.9.11. Older APT versions do not provide the waiting behavior. This bounds dpkg lock acquisition, not the duration of the complete package installation; it does not resolve other lock types or package/dependency failures. See the APT lists-lock report.

Inspired by docker/docker-install#431. The option is kept out of command -v checks and apt-get update.

- How to verify it

python3 scripts/test-apt-lock-wait.py
sh -n install.sh
sh -n rootless-install.sh
shellcheck -e SC1091,SC1117,SC2317,SC2329 install.sh rootless-install.sh

The offline suite runs captured installer control flow for Ubuntu and Debian, checks both install commands, version pinning with --allow-downgrades, repository-only mode, unchanged update commands, and rootless dependency detection/instructions. It rejects the original c57bd823 baseline for its missing install lock timeouts.

The dedicated CI job runs real lock tests in disposable official ubuntu:22.04, ubuntu:24.04, and debian:12-slim containers. The final test script was completely exercised locally in:

• ubuntu:24.04: APT 2.8.3, amd64; bounded timeout measured 60.2 seconds.
• debian:12-slim: APT 2.6.1, arm64; bounded timeout measured 60.0 seconds.

Both final runs verified:

• A command without the timeout fails immediately with exit 100 under real frontend-lock contention.
• Generated prerequisite/Engine install options wait successfully for frontend/administration locks released by another process.
• A held frontend lock fails with exit 100 after the actual 60-second timeout, overriding an APT configuration default of zero.
• The lists lock still makes apt-get update fail immediately even if given the dpkg timeout option.

The live suite uses Python fcntl record locks and pins the already-installed bash version with downloads disabled. It requires an explicitly opted-in disposable container and does not install Docker, remove lock files, or validate Docker packages/service startup. README includes the reproducible container command. Local shell syntax, ShellCheck, Python syntax, CI YAML structure, and git diff --check passed. The GitHub-hosted CI jobs have not yet run for this branch.

- Description for the changelog

Wait up to 60 seconds for dpkg locks during APT package installation.

Submission

This PR targets soulteary/docker-install:main. The commit is DCO signed off. A separate branch based on upstream master contains only this change, without the fork's mirror additions. Open the upstream comparison for manual submission. No upstream PR has been created.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T12:22:04.574185Z	b3f6b21	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.