Nvidia-docker: install error: gnutls_handshake() failed: Handshake failed

[somebodyyuan]

_The steps were done followed https://github.com/NVIDIA/nvidia-docker. Utill i input sudo apt-get update, follow problems happened.
```W: Failed to fetch https://nvidia.github.io/libnvidia-container/ubuntu14.04/amd64/Packages gnutls_handshake() failed: Handshake failed

W: Failed to fetch https://nvidia.github.io/nvidia-container-runtime/ubuntu14.04/amd64/Packages gnutls_handshake() failed: Handshake failed

W: Failed to fetch https://nvidia.github.io/nvidia-docker/ubuntu14.04/amd64/Packages gnutls_handshake() failed: Handshake failed

W: Failed to fetch https://repo.fdzh.org/chrome/deb/dists/stable/main/binary-amd64/Packages server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

E: Some index files failed to download. They have been ignored, or old ones used instead.
```

_

_Also, before reporting a new issue, please make sure that:_

• _You read carefully the documentation and frequently asked questions._
• _You searched for a similar issue and this is not a duplicate of an existing one._
• _This issue is not related to NGC, otherwise, please use the devtalk forums instead._
• _You went through the troubleshooting steps._

---

1. Issue or feature description

2. Steps to reproduce the issue

3. Information to attach (optional if deemed irrelevant)

• [x] Kernel version from uname -a
• [ ] Any relevant kernel output lines from dmesg
• [ ] Driver information from nvidia-smi -a
• [ ] Docker version from docker version
• [ ] NVIDIA packages version from dpkg -l '*nvidia*' _or_ rpm -qa '*nvidia*'
• [ ] NVIDIA container library version from nvidia-container-cli -V
• [ ] NVIDIA container library logs (see troubleshooting)
• [ ] Docker command, image and tag used

[somebodyyuan]

ubuntu 14.04

[flx42]

This seems to fail:

$ gnutls-cli -p 443 pages.github.com
Resolving 'pages.github.com'...
Connecting to '185.199.108.153:443'...
*** Fatal error: A TLS fatal alert has been received.
*** Received alert [40]: Handshake failed
*** Handshake has failed
GnuTLS error: A TLS fatal alert has been received.

So, looks like a larger problem. I've contacted the GitHub support.

[avimanyu786]

I experienced this issue yesterday also, on Ubuntu 14.04. It is probably due to the fact that https://nvidia.github.io/nvidia-docker/ubuntu14.04/amd64/nvidia-docker.list does not seem to exist and shows a 404 error on a browser. The only ones that show up (based on some checks) are:

https://nvidia.github.io/nvidia-docker/ubuntu16.04/amd64/nvidia-docker.list
and
https://nvidia.github.io/nvidia-docker/debian9/amd64/nvidia-docker.list

Thanks to Jonathan's suggestion on this page, I installed git via sudo apt-get install git and used the following set of commands to solve this problem. Hope it helps you:

LOCALDIR=/var/lib/nvidia-docker-repo

sudo mkdir -p $LOCALDIR && cd $LOCALDIR
sudo git clone -b gh-pages https://github.com/NVIDIA/libnvidia-container.git
sudo git clone -b gh-pages https://github.com/NVIDIA/nvidia-container-runtime.git
sudo git clone -b gh-pages https://github.com/NVIDIA/nvidia-docker.git

sudo tee /etc/apt/sources.list.d/nvidia-docker.list <<< \
"deb file://$LOCALDIR/libnvidia-container/ubuntu14.04/amd64 /
deb file://$LOCALDIR/nvidia-container-runtime/ubuntu14.04/amd64 /
deb file://$LOCALDIR/nvidia-docker/ubuntu14.04/amd64 /"

sudo apt-key add $LOCALDIR/nvidia-docker/gpgkey
sudo apt-get update

[zhaodezan]

@ @avimanyu786
I DO THIS like you said,the problem is solved,but another problem is raised when i run the test .

Error response from daemon: OCI runtime create failed: container_linux.go:348: starting container process caused "process_linux.go:402: container init caused \"process_linux.go:385: running prestart hook 1 caused \\"error running hook: exit status 1, stdout: , stderr: exec command: [/usr/bin/nvidia-container-cli --load-kmods configure --ldconfig=@/sbin/ldconfig.real --device=all --compute --utility --require=cuda>=9.0 --pid=11240 /var/lib/docker/overlay2/333cb5da19c27c86e282bb6fb56df3a19a5134f37291bf700a235b3b5a695983/merged]\\nnvidia-container-cli: requirement error: unsatisfied condition: cuda >= 9.0\\n\\"\"": unknown
Error: failed to start containers: 28c8529e2e04

[zhaodezan]

It seems that it needs cuda >9.0?

[avimanyu786]

@zhaodezan Please elaborate how you started the installation and all the steps you followed. What command are you using to run the test? Are you using Ubuntu 14.04 or some other OS?

[flx42]

It is probably due to the fact that https://nvidia.github.io/nvidia-docker/ubuntu14.04/amd64/nvidia-docker.list

No, check the instructions, you don't need the amd64 in the URL now. Our repository is fine.

[avimanyu786]

@flx42 Thanks a lot for the correct URL and clearing the doubt. Could you please further clarify why there exists these two different URLs for Ubuntu 16.04:

1. https://nvidia.github.io/nvidia-docker/ubuntu16.04/nvidia-docker.list
2. https://nvidia.github.io/nvidia-docker/ubuntu16.04/amd64/nvidia-docker.list

Will the second one be eventually removed? I use 16.04 at home and 14.04 at lab. Installing on 16.04 was a lot more convenient I must say. It would be great if you could also let me know approximately how long would Ubuntu 14.04 get support for Nvidia Docker. Thanks again.

[flx42]

We started with 2., but then noticed we could move the file one level up to support both x86_64 and ppc64le with one file. The second will be removed in the future.
I still don't know exactly what the problem is on 14.04, maybe GitHub needs to fix their servers, or maybe Canonical needs to backport a fix to libgnutls, I don't know at this point.

[zhimengfan1990]

Hi, I also got the same issue, any solution now? Thanks.

[somebodyyuan]

@zhimengfan1990 Not, yet. We are waiting for a further respond.

[somebodyyuan]

@flx42 Is there any steps that can we take to bypass the bug.

[flx42]

GitHub is still looking at the issue.
In the meantime, a hack could be to do a local repo:
https://github.com/NVIDIA/nvidia-docker/issues/635#issuecomment-365160098

[gemfield]

@zhimengfan1990 This is due to the ciphers issues. Tls client library on ubuntu 14.04 cannot negotiate a cipher with nvidia.github.io.
E.g. if you tls handshake on a ubuntu16.04 or later release, you can get:
`gemfield@ThinkPad-X1C:~$ nmap --script ssl-enum-ciphers nvidia.github.io

Starting Nmap 7.60 ( https://nmap.org ) at 2018-05-03 16:27 CST
Nmap scan report for nvidia.github.io (185.199.108.153)
Host is up (0.20s latency).
Other addresses for nvidia.github.io (not scanned): 185.199.110.153 185.199.111.153 185.199.109.153
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| compressors:
| NULL
| cipher preference: server
|_ least strength: A

Nmap done: 1 IP address (1 host up) scanned in 107.25 seconds`

whereas if you are on ubuntu 14.04, you may get
`root@gemfield:/etc/apt/sources.list.d# nmap --script ssl-enum-ciphers nvidia.github.io

Starting Nmap 6.40 ( http://nmap.org ) at 2018-05-03 16:29 CST
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for nvidia.github.io (185.199.110.153)
Host is up (0.18s latency).
Other addresses for nvidia.github.io (not scanned): 185.199.108.153 185.199.109.153 185.199.111.153
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
| ssl-enum-ciphers:
| SSLv3: No supported ciphers found
|_ TLSv1.2: No supported ciphers found

Nmap done: 1 IP address (1 host up) scanned in 14.88 seconds`

To by pass this issue, you can refer 5th section in https://zhuanlan.zhihu.com/p/29335533 (google translate may needed).

[flx42]

@gemfield indeed! That was the conclusion I sent to GitHub Support yesterday.
They either need to add support for more ciphers (e.g. DHE-RSA), or Canonical needs to backport ECDHE-RSA to gnutls in 14.04

[3XX0]

To be fair, https is not strictly required here since everything is signed by GPG.
As long as you retrieve securely:

• https://nvidia.github.io/nvidia-docker/ubuntu14.04/nvidia-docker.list
• https://nvidia.github.io/nvidia-docker/gpgkey

you can use http:// in the repository .list

[flx42]

The awesome team at GitHub just told me that their CDN added more ciphers, per our request!

It seems to work now on my side, closing for now, please reopen if it still doesn't work for you.

[ChaiBapchya]

Facing this issue again in https://github.com/apache/incubator-mxnet/issues/18005
Pl advise.

W: Failed to fetch https://developer.download.nvidia.com/compute/machine-learning/repos/ubuntu1404/x86_64/Packages  gnutls_handshake() failed: Handshake failed

[leezu]

You can use the http version instead of https. Ubuntu 14.04 has too old TLS toolchain.

http://developer.download.nvidia.com/compute/machine-learning/repos/ubuntu1404/x86_64/