Faced this issue on a Debian Stretch (9) Docker image.
The below error came up when running apt-get update
W: The repository 'http://security.debian.org/debian-security stretch/updates Release' does not have a Release file.
W: The repository 'http://deb.debian.org/debian stretch Release' does not have a Release file.
W: The repository 'http://deb.debian.org/debian stretch-updates Release' does not have a Release file.
E: Failed to fetch http://security.debian.org/debian-security/dists/stretch/updates/main/binary-amd64/Packages 404 Not Found [IP: xx]
E: Failed to fetch http://deb.debian.org/debian/dists/stretch/main/binary-amd64/Packages 404 Not Found
E: Failed to fetch http://deb.debian.org/debian/dists/stretch-updates/main/binary-amd64/Packages 404 Not Found
E: Some index files failed to download. They have been ignored, or old ones used instead.
This is related to the security repo in particular.
These repo definitions are used by apt to fetch update and they are defined in
The official Debian Security recommendation - https://www.debian.org/security/
To keep your Debian operating system up-to-date with security patches, please add the following line to your /etc/apt/sources.list file
`deb http://security.debian.org/debian-security bullseye-security main contrib non-free`
Add this line in the Dockerfile
RUN echo "deb http://security.debian.org/debian-security bullseye-security main contrib non-free" > /etc/apt/sources.list
RUN apt-get update
What didn't work for me:
- Changing the repo to stable-security
- Running apt with
--allow-releaseinfo-change flag - the flag pairing with apt-get update was not recognised
What else worked:
- Instead of using the bullseye security repo you could use the stretch archive repo
deb http://archive.debian.org/debian stretch main contrib non-free; it would be better to stick to the security from the latest release from a security perspective
The above is correct if you are just zooming in on the security repo issue.
Why are we having these problems with the security repo?
In my case Debian 9 is an archived, unsupported, unmaintained version.
Although I could "fix" (bypass) the security repo, I had further issues with dependency repos for APT. Since the version is deprecated these repos needed to point to archive.
In general this forced me to upgrade to Debian 10. On Debian 10 I had no need for the above fix.