All public image pulls fail with "filesystem layer verification failed for digest sha256"

Hi. Total Docker NB here. I’ve tried this on at least 5 different versions of Linux and always hit the same wall. I can install Docker, start the service, and run the hello-world successfully. But whenever I try to pull any other image (e.g. ubuntu, nginx) it pulls the pieces in parallel and then ends up with the filesystem layer verification failure. So hopefully I am just doing the same incorrect steps consistently!

I’m currently trying it on CentOS 7 (as a Virtualbox VM), uname gives

Docker version is 1.10.3

I am shocked that I have not seen this question asked and answered online. So I guess it is something I am doing.

For CentOS 7 I merely did (all as root):
yum install docker
systemctl start docker
systemctl status docker
systemctl enable docker

docker run hello-world

docker pull ubuntu

The only issues I’ve seen relate to AWS and I’m not using AWS. Is it a SHA key issue or something? Nothing ever mentions key setup in docker installation. Some other comment I saw hinted that it fails when trying to pull multiple pieces in parallel (hello-world is a single chunk). I have no way to verify this. What’s another tiny image I can try? The other thing I wonder is the file system of the OS vs what docker expects? I believe the filesystem type is xfs. Is that an issue?

I’d really like to fool around with docker but obviously this is a show stopper. Any help would be appreciated!


One other note. One reason I am running this in a Virtualbox VM is because docker wants one of the later Linux kernels and my host machine is CentOS 6.8 which isn’t quite recent enough for a simple (i.e. yum) docker install and don’t want to risk gaking my main machine just to install docker. So I figured using CentOS 7 in a VM would be the simple way around this. Are there issues with docker in a Virtualbox guest host? I’m really stuck here. Has no one run into this before?



This turned out to be a Virtualbox bug. It makes sense, since every machine I was trying this on was a Virtualbox VM (see original post). In investigating a work-around to download the pieces manually via wget, wget was getting errors on all machines. Downloads over a few seconds were throwing “SSL3_GET_RECORD:decryption failed or bad record mac”. Googling that showed that this is a known (as of 2014 anyway) bug in Virtualbox when the VM’s network type is set to Bridged. The solution is to set the network type to NAT.

Changing to NAT networking helped, but I was still getting failing filesystem layer verification with most large docker image pulls. It wasn’t until I updated to VirtualBox 5.1.18 r114002 (Qt5.6.1) that things really stabilized for me. I have yet to have a failed pull since updating.

I’m not sure where the problem was because even when pulls failed I could wget or curl large .tgz files and successfully unpack them.

[root@indretest-3 docker.bk]# docker pull centos:centos7
centos7: Pulling from library/centos
7b6bb4652a1b: Verifying Checksum
filesystem layer verification failed for digest sha256:7b6bb4652a1be64d39920f7d8c12c5f0bd8abfc10820177109e73817357c07e3

any body have idea about this issue.
i am also getting this:

[root@indretest-3 ~]# docker pull centos:centos7
centos7: Pulling from library/centos
74f0853ba93b: Verifying Checksum
filesystem layer verification failed for digest sha256:74f0853ba93b37c8152648905c48965c774d5a7d2de1967aef86ef0144561f62
[root@indretest-3 ~]#

how to get rid of this.