[xenial] Image does not support TLS access to repos

[Scott Hussey]

The docker image docker.io/ubuntu:16.04 does not come with the apt-transport-https package baked in meaning I have no avenue to add additional packages when using it as a base image in an environment with internal repos that only support TLS. I think the addition of apt-transport-https would be worthwhile even in the minimal image used for the official Docker images.

[Dan Watkins (oddbloke)]

Hi Scott,

Thanks for using Ubuntu and for filing this bug! For a number of reasons, apt archives are, in general, secured via GPG signatures rather than via HTTPS (and, in fact, the Ubuntu archives don't support HTTPS at all), which is why apt-transport-https isn't shipped by default.

I just want to double-check I understand the issue you're running in to. When you say "internal repos", do you mean repositories containing your private software? Or is it also the case that the only Ubuntu mirrors available to you are also HTTPS-only?

Thanks,

Dan

[Scott Hussey (sh8121)]

It is the latter. In our enterprise, we access internal upstream repo snapshots only but they are hosted in a product that currently only supports HTTPS. After making the bug, I learned the dependency chain for apt-transport-https is pretty long, so understood if it is too heavyweight to put in the Core image.

[Dan Watkins (oddbloke)]

Yes, regrettably, it would substantially increase the size of the image for a use-case that most people won't require, so I think I will mark this as Won't Fix. Thank you for understanding!

(Note, also, that bionic and later have HTTPS support built in to apt, so you shouldn't see this issue once you move forward to 18.04 or later. :)