Need help: isaac-ros activate --build-local command failing after cli update

[svin]

Hello, NVIDIA team.

I have already updated isaac-ros-cli to version 1.0.2-1. However, when executing the command isaac-ros activate --build-local, it still produces an error. Could you please tell me what might be causing this?

[vchuang]

Hello @svin,

Thanks for posting in the Isaac ROS forum!

From your screenshot, the failure is happening inside docker build, when the Dockerfile tries to install the CUDA keyring for Ubuntu 24.04:

curl -o /tmp/cuda-keyring.deb ...cuda/repos/ubuntu2404/... && apt install /tmp/cuda-keyring.deb && apt update
...
exit code: 100

That means apt install / apt update inside the build is failing (could be due to network/proxy or repo access issues), so docker buildx bake returns non‑zero and isaac-ros activate --build-local stops.

Could you please:

1. Confirm your versions and platform: bash apt-cache policy isaac-ros-cli | grep Installed uname -m lsb_release -a || cat /etc/os-release docker --version

2. Re-run:
   isaac-ros activate --build-local --log-level debug and paste the apt / CUDA-repo error lines that appear just before the exit code: 100 message?

In the meantime, if you have already built this image once before on this machine, you can try:

isaac-ros activate

which will reuse the existing image and skip the rebuild step (--build-local) that is currently failing on the CUDA keyring install.

[svin]

Hello vchuang,

Thank you for your prompt reply. I have gathered system information as you suggested and tried the relevant commands. Here are my findings:

1.System Environment Confirmation

2.When I tried to execute isaac-ros activate --build-local --log-level debug, I received this error:

3.When I executed isaac-ros activate (without --build-local), I received the following error:

[vchuang]

You could follow this thread to help resolve your installation problem.

[svin]

Hi vchuang，

Thank you for the reference to the forum thread.I have followed the instructions and verified the MD5 hashes of the Dockerfiles in /etc/isaac-ros-cli/docker/.

But the hashes on my system match the ones you provided exactly.

(base) hy@localhost:~$ md5sum /etc/isaac-ros-cli/docker/Dockerfile.*
a861cae9015ab15c1fe4581bd3eb65b4 /etc/isaac-ros-cli/docker/Dockerfile.noble
362eb42baa8dc5af4a7a6408fbce8180 /etc/isaac-ros-cli/docker/Dockerfile.realsense
3a53634c32758f2007b7a9cbe300d106 /etc/isaac-ros-cli/docker/Dockerfile.ros2_jazzy

[svin]

@vchuang Based on the log, I understand the root cause is that the required base Docker images for the aarch64 architecture under Ubuntu 24.04 (noble) are not yet available in the NVIDIA container registry (nvcr.io).

(base) hy@localhost:~$ isaac-ros activate
/mnt/nova_ssd/workspaces/isaac_ros-dev
Logged in to nvcr.io/nvidia/isaac/ros. Using this for cache.
['noble', 'ros2_jazzy', 'realsense']
Dockerfile created: image_key = noble
Dockerfile created: image_key = realsense
Dockerfile created: image_key = ros2_jazzy
Error response from daemon: manifest for nvcr.io/nvidia/isaac/ros:noble-ros2_jazzy-realsense_b0aad936068eea75f2a520c7dd1a4f88-arm64 not found: manifest unknown: manifest unknown
Error: Docker image nvcr.io/nvidia/isaac/ros:noble-ros2_jazzy-realsense_b0aad936068eea75f2a520c7dd1a4f88-arm64 not found.
Use --build to build remotely or --build-local to build locally.

[vchuang]

Were you trying to build realsense package following this instruction here? or you just try to start the default Isaac ROS workspace? If it’s the former, make sure to add realsense (or any other extra image keys) to your ~/.config/isaac-ros-cli/config.yaml, then you must build the image once with --build-local --no-cache before isaac-ros activate can reuse it.

[svin]

Hi vchuang,

Thank you for the follow-up.Yes, my situation is the former: I am trying to build the RealSense package following the instructions, and have already confirmed that the realsense image key is present in my ~/.config/isaac-ros-cli/config.yaml file.

(base) hy@localhost:~$ cat ~/.config/isaac-ros-cli/config.yaml
docker:
  image:
    additional_image_keys:
      - realsense

But when I execute the command isaac-ros activate --build-local --no-cache as suggested, the process still fails with an error.

#11 ERROR: process "/bin/bash -c if [[ ${PLATFORM} == 'arm64' ]]; then     curl -o /tmp/cuda-keyring.deb          https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/sbsa/cuda-keyring_1.1-1_all.deb      && apt install /tmp/cuda-keyring.deb      && rm /tmp/cuda-keyring.deb      && apt update; elif [[ ${PLATFORM} == 'amd64' ]]; then     curl -o /tmp/cuda-keyring.deb          https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64/cuda-keyring_1.1-1_all.deb      && apt install /tmp/cuda-keyring.deb      && rm /tmp/cuda-keyring.deb      && apt update; else     echo \"Unrecognized platform: ${PLATFORM}\" && exit 1 ; fi" did not complete successfully: exit code: 100
------
 > [common  4/20] RUN --mount=type=cache,target=/var/cache/apt if [[ arm64 == 'arm64' ]]; then     curl -o /tmp/cuda-keyring.deb          https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/sbsa/cuda-keyring_1.1-1_all.deb      && apt install /tmp/cuda-keyring.deb      && rm /tmp/cuda-keyring.deb      && apt update; elif [[ arm64 == 'amd64' ]]; then     curl -o /tmp/cuda-keyring.deb          https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64/cuda-keyring_1.1-1_all.deb      && apt install /tmp/cuda-keyring.deb      && rm /tmp/cuda-keyring.deb      && apt update; else     echo "Unrecognized platform: arm64" && exit 1 ; fi:
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
E: read, still have 8 to read but none left
1.741 E: Internal error, could not locate member control.tar{.zst,.lz4,.gz,.xz,.bz2,.lzma,}
1.741 E: Could not read meta data from /tmp/cuda-keyring.deb
1.741 E: The package lists or status file could not be parsed or opened.
1.741 
------

 1 warning found (use docker --debug to expand):
 - NoEmptyContinuation: Empty continuation line (line 267)
Dockerfile.noble:86
--------------------
  85 |     # Setup NVIDIA CUDA apt keyring
  86 | >>> RUN --mount=type=cache,target=/var/cache/apt \
  87 | >>> if [[ ${PLATFORM} == 'arm64' ]]; then \
  88 | >>>     curl -o /tmp/cuda-keyring.deb \
  89 | >>>          https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/sbsa/cuda-keyring_1.1-1_all.deb \
  90 | >>>      && apt install /tmp/cuda-keyring.deb \
  91 | >>>      && rm /tmp/cuda-keyring.deb \
  92 | >>>      && apt update; \
  93 | >>> elif [[ ${PLATFORM} == 'amd64' ]]; then \
  94 | >>>     curl -o /tmp/cuda-keyring.deb \
  95 | >>>          https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64/cuda-keyring_1.1-1_all.deb \
  96 | >>>      && apt install /tmp/cuda-keyring.deb \
  97 | >>>      && rm /tmp/cuda-keyring.deb \
  98 | >>>      && apt update; \
  99 | >>> else \
 100 | >>>     echo "Unrecognized platform: ${PLATFORM}" && exit 1 ; \
 101 | >>> fi
 102 |     
--------------------
ERROR: failed to solve: process "/bin/bash -c if [[ ${PLATFORM} == 'arm64' ]]; then     curl -o /tmp/cuda-keyring.deb          https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/sbsa/cuda-keyring_1.1-1_all.deb      && apt install /tmp/cuda-keyring.deb      && rm /tmp/cuda-keyring.deb      && apt update; elif [[ ${PLATFORM} == 'amd64' ]]; then     curl -o /tmp/cuda-keyring.deb          https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64/cuda-keyring_1.1-1_all.deb      && apt install /tmp/cuda-keyring.deb      && rm /tmp/cuda-keyring.deb      && apt update; else     echo \"Unrecognized platform: ${PLATFORM}\" && exit 1 ; fi" did not complete successfully: exit code: 100
docker buildx rm isaaceks-aarch64
Traceback (most recent call last):
  File "/usr/lib/isaac-ros-cli/run_dev.py", line 568, in <module>
    main()
  File "/usr/lib/isaac-ros-cli/run_dev.py", line 557, in main
    build_image_layers(**build_args)
  File "/usr/lib/isaac-ros-cli/build_image_layers.py", line 739, in main
    raise e
  File "/usr/lib/isaac-ros-cli/build_image_layers.py", line 736, in main
    run_shell(build_cmd, capture_output=False, env=env_dict, check=True)
  File "/usr/lib/isaac-ros-cli/build_image_layers.py", line 70, in run_shell
    completed_process = subprocess.run(
                        ^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/subprocess.py", line 571, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command 'docker  buildx bake noble_a36082d996bc9582db03aa92fed6d54c --no-cache --progress=plain --builder default --provenance=false --load --file /tmp/tmpjwmvdl5g/docker-bake.hcl' returned non-zero exit status 1.

[svin]

Hi @vchuang ,

Just checking if there are any updates on this? I still need assistance and am happy to provide any further information if needed. Thank you!

[vchuang]

Sorry for the delayed response.

I’ve verified that the cuda-keyring_1.1-1_all.deb file from
https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/sbsa/cuda-keyring_1.1-1_all.deb is a valid Debian package on my side, so the .deb itself should be fine.

The error you’re seeing:

E: Internal error, could not locate member control.tar...
E: Could not read meta data from /tmp/cuda-keyring.deb

suggests that the file is getting corrupted or truncated inside the Docker build before apt install can read it.

Could you please:

1. Run on your host (outside Docker): curl -v -L -o /tmp/cuda-keyring.deb \ https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/sbsa/cuda-keyring_1.1-1_all.deb file /tmp/cuda-keyring.deb dpkg-deb -I /tmp/cuda-keyring.deb 2>&1 | head and share the output?

2. If that looks valid, re-run: isaac-ros activate --build-local --no-cache with Docker debug logging enabled and send the full error context around the curl + apt install lines.

This information will help us assist you further.

[svin]

Thank you for your guidance. I’ve now collected both sets of diagnostics as requested.

error.log (265.2 KB)

[svin]

Dear NVIDIA Team,

First of all, thank you for your previous prompt response and guidance. As suggested by you [4 days ago], I have completed the steps and collected the logs. I look forward to your further guidance.

[vchuang]

Have you followed the documentation to set up the appropriate CDN (US or China) as instructed?

[svin]

Hello @vchuang ,

Yes, I have strictly followed the documentation to configure the China CDN, but I am still encountering the same error.

(base) hy@localhost:~$ cat /etc/apt/sources.list.d/nvidia-isaac-ros.list
deb [signed-by=/usr/share/keyrings/nvidia-isaac-ros.gpg] https://isaac.download.nvidia.cn/isaac-ros/release-4.0 noble main

[vchuang]

From your error log provided earlier we can see:

Error response from daemon: Get "https://registry-1.docker.io/v2/":
  net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)

This usually means the Docker daemon is running behind a restricted network and cannot reach Docker Hub directly. In that case, you need to configure Docker to use a proxy that does have outbound access to registry-1.docker.io.

A common workaround is:

1. Obtain a SOCKS5 (or HTTP/HTTPS) proxy server that can access Docker Hub / GitHub.

2. Create a systemd drop‑in for Docker:

sudo mkdir -p /etc/systemd/system/docker.service.d

cat << 'EOF' | sudo tee /etc/systemd/system/docker.service.d/proxy.conf
[Service]
Environment="HTTP_PROXY=socks5://<proxy_host>:<proxy_port>"
Environment="HTTPS_PROXY=socks5://<proxy_host>:<proxy_port>"
EOF

Replace <proxy_host>:<proxy_port> with your actual proxy.

3. Reload systemd and restart Docker:

sudo systemctl daemon-reload
sudo systemctl restart docker
systemctl status docker

Make sure docker is active (running).

After this, try rerunning: isaac-ros activate --build-local --no-cache

If the proxy is reachable and correctly configured for Docker, the registry-1.docker.io timeout (and the CUDA keyring download inside the build) should no longer fail.