Docker "RUN apt-get" NO_PUBKEY / GPG Error - Fix apt Keys in Builds
A RUN apt-get update in the build failed because apt could not verify a repository’s signature - the signing key is missing, or fetching it from a keyserver timed out.
What this error means
The build stops on apt-get update with GPG error and NO_PUBKEY <key id>, or the following signatures couldn’t be verified. Sometimes it passes on retry (keyserver flake), sometimes it never does (key genuinely missing).
W: GPG error: https://repo.example.com stable InRelease: The following
signatures couldn't be verified because the public key is not available:
NO_PUBKEY 1234ABCD5678EF90
E: The repository '...' is not signed.Common causes
The repository signing key is not installed
A third-party apt source was added without importing its GPG key, so apt refuses to trust the index. This is deterministic and will not pass on retry.
Keyserver fetch timed out
Importing a key from a keyserver (hkp://) can fail transiently when the keyserver is slow or unreachable from the build network.
Expired or rotated key
The repository rotated its signing key and the old one baked into the image no longer verifies the new index.
How to fix it
Install the signing key into a keyring
Fetch the key over HTTPS and reference it from the source list (modern signed-by approach).
RUN curl -fsSL https://repo.example.com/key.gpg \
| gpg --dearmor -o /usr/share/keyrings/example.gpg
RUN echo "deb [signed-by=/usr/share/keyrings/example.gpg] \
https://repo.example.com stable main" > /etc/apt/sources.list.d/example.list
RUN apt-get updateRetry transient keyserver imports
When the key import itself flakes, a bounded retry over HTTPS (not a flaky keyserver) is the durable fix.
How to prevent it
- Pin and fetch repository keys over HTTPS with
signed-by, not deprecatedapt-key. - Cache base images that already include needed keys.
- Re-verify third-party keys when a repo rotates them.