Repository navigation
The system cannot open the device or file specified. : 'NuGet-Migrations' for non-root users - 8.0.426-bookworm-slim #7426
Description
Describe the bug
Since the release of 8.0.426-bookworm-slim the following error happens whenever the container is run as a non-root user for any nuget commands e.g.
docker run -u 1000:1000 -e HOME=/tmp -it mcr.microsoft.com/dotnet/sdk:8.0.426-bookworm-slim /bin/bash
I have no name!@8b037b674358:/$ dotnet nuget
System.IO.IOException: The system cannot open the device or file specified. : 'NuGet-Migrations'
at System.Threading.Mutex.CreateMutexCore(Boolean initiallyOwned, String name, Boolean& createdNew)
at System.Threading.Mutex..ctor(Boolean initiallyOwned, String name)
at NuGet.Common.Migrations.MigrationRunner.Run(String migrationsDirectory)
at Microsoft.DotNet.Configurer.DotnetFirstTimeUseConfigurer.Configure()
at Microsoft.DotNet.Cli.Program.ConfigureDotNetForFirstTimeUse(IFirstTimeUseNoticeSentinel firstTimeUseNoticeSentinel, IAspNetCertificateSentinel aspNetCertificateSentinel, IFileSentinel toolPathSentinel, Boolean isDotnetBeingInvokedFromNativeInstaller, DotnetFirstRunConfiguration dotnetFirstRunConfiguration, IEn
vironmentProvider environmentProvider, Dictionary`2 performanceMeasurements)
at Microsoft.DotNet.Cli.Program.ProcessArgs(String[] args, TimeSpan startupTime, ITelemetry telemetryClient)
at Microsoft.DotNet.Cli.Program.Main(String[] args)
I have no name!@8b037b674358:/$
When running as root (default user) this issue does not happen.
Previous versions of the image e.g. 425 release do not have this issue:
docker run -u 1000:1000 -e HOME=/tmp -it mcr.microsoft.com/dotnet/sdk:8.0.425-bookworm-slim /bin/bash
I have no name!@f29cf18f687a:/$ dotnet nuget
An issue was encountered verifying workloads. For more information, run "dotnet workload update".
NuGet Command Line 6.11.2.1
Usage: dotnet nuget [options] [command]
Options:
-h|--help Show help information
--version Show version information
Commands:
add Add a NuGet source.
delete Deletes a package from the server.
disable Disable a NuGet source.
enable Enable a NuGet source.
list List configured NuGet sources.
locals Clears or lists local NuGet resources such as http requests cache, packages folder, plugin operations cache or machine-wide global packages folder.
push Pushes a package to the server and publishes it.
remove Remove a NuGet source.
sign Signs NuGet package(s) at <package-paths> with the specified certificate.
trust Manage the trusted signers.
update Update a NuGet source.
verify Verifies a signed NuGet package.
Use "dotnet nuget [command] --help" for more information about a command.
I have no name!@f29cf18f687a:/$
Which .NET image(s) are you using?
Broken: mcr.microsoft.com/dotnet/sdk:8.0.426-bookworm-slim
Working: mcr.microsoft.com/dotnet/sdk:8.0.425-bookworm-slim
Steps to reproduce
See description
Other information
N/A
Output of docker version
docker version
Client: Docker Engine - Community
Version: 29.9.1
API version: 1.56
Go version: go1.26.9
Git commit: dfc520d
Built: Wed Oct 14 18:34:39 2026
OS/Arch: linux/amd64
Context: default
Server: Docker Engine - Community
Engine:
Version: 29.9.1
API version: 1.56 (minimum version 1.40)
Go version: go1.26.9
Git commit: b26fb77
Built: Wed Oct 14 18:32:00 2026
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v2.2.4
GitCommit: 193637f7ee8ae5f5aa5248f49e7baa3e6164966e
runc:
Version: 1.3.5
GitCommit: v1.3.5-0-g488fc13e
docker-init:
Version: 0.19.0
GitCommit: de40ad0Output of docker info
docker info
Client: Docker Engine - Community
Version: 29.9.1
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.10.2
Path: /usr/libexec/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.15.1
Path: /usr/libexec/docker/cli-plugins/docker-compose
scan: Docker Scan (Docker Inc.)
Version: v0.23.0
Path: /usr/libexec/docker/cli-plugins/docker-scan
Server:
Containers: 1
Running: 1
Paused: 0
Stopped: 0
Images: 14
Server Version: 29.9.1
Storage Driver: overlay2
Backing Filesystem: xfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 1
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
/etc/cdi
/var/run/cdi
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 193637f7ee8ae5f5aa5248f49e7baa3e6164966e
runc version: v1.3.5-0-g488fc13e
init version: de40ad0
Security Options:
seccomp
Profile: builtin
Kernel Version: 4.18.0-553.58.1.el8_10.x86_64
Operating System: Red Hat Enterprise Linux 8.10 (Ootpa)
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 15.32GiB
Name: us01vldvjnkag01.saas-n.com
ID: 307cef16-7c2c-45e8-91fd-a30b5b03df0c
Docker Root Dir: /var/lib/docker
Debug Mode: false
HTTP Proxy: REDACTED
HTTPS Proxy: REDACTED
No Proxy: REDACTED
Experimental: false
Insecure Registries:
127.0.0.0/8
::1/128
Live Restore Enabled: false
Firewall Backend: iptables
EnableUserlandProxy: true
UserlandProxyPath: /usr/bin/docker-proxyReacted by Stamo Gochev
Activity
lbussell commentedon Oct 21, 2026
Hi @muppet3000. I believe this to be a (potentially unintentional?) side effect of some security patches we shipped in the 8.0.32 Runtime and 8.0.426 SDK updates. It happens because the uid/gid 1000:1000 is not listed in
/etc/passwd.It's too late to merge more fixes into the next .NET 8 update, which also happens to be the very last update for .NET 8. Therefore, we can't really fix this side-effect at the Runtime or SDK level.
The .NET images come with a non-root user built in. It's UID/GID 1654, and username
app. I tried your example repro with--user appinstead of-u 1000:1000and it worked for me. Let me know if that solves your issue.lbussell commentedon Nov 2, 2026
[Triage] @nkolev92 @baronfel - @marcpopMSFT says that this migration might not be needed anymore. Is there a chance we could remove it?
nkolev92 commentedon Nov 2, 2026
I don't have context on why this migration may not be needed.
Do we need to have an internal conversation about this?
cc @kartheekp-ms in case he knows something.