# GitLab CI: Git exits with code 128 **URL:** \ **Category:** Ecosystem\ **Tags:** ci, opam, gitlab\ **Created:** [July 31, 2025, 2:37pm UTC](https://discuss.ocaml.org/t/gitlab-ci-git-exits-with-code-128/17037 "2025-07-31T14:37:32Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Richard-Degenne](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/richard-degenne/32/112_2.png) [@Richard-Degenne](https://discuss.ocaml.org/u/Richard-Degenne)\ **Post date:** [July 31, 2025, 2:37pm UTC](https://discuss.ocaml.org/t/gitlab-ci-git-exits-with-code-128/17037/1 "2025-07-31T14:37:32Z")
Hello! I’m setting up a GitLab CI pipeline for a library, and it looks like OPAM fails to synchronize the source code from the Git repository as part of the `opam install . --with-test` command. ```plaintext faker is now pinned to git+file:///builds/Richard-Degenne/ocaml-faker#HEAD (version ~dev) The following actions will be performed: [...] - install faker ~dev* ===== 13 to install ===== <><> Gathering sources ><><><><><><><><><><><><><><><><><><><><><><><><><><><><> [ERROR] Could not synchronize /home/opam/.opam/5.3/.opam-switch/sources/faker from "git+file:///builds/Richard-Degenne/ocaml-faker#HEAD": "/usr/bin/git fetch -q" exited with code 128 [...] [ERROR] The sources of the following couldn't be obtained, aborting: - faker.~dev ``` The only two things that catch my eye are: - `git fetch` exiting with code 128, which is a generic exit code which I need to look into; - The version of the library. I’m used to see `dev` as a version for libraries that do not have an explicit version number yet. I’m not sure I understand what `faker.~dev` is supposed to mean, or if there are any implications that may be relevant to my problem. The CI job is available [here](https://gitlab.com/Richard-Degenne/ocaml-faker/-/jobs/10875083967), for anyone curious. 😉 ---
**Author:** ![kit-ty-kate](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/kit-ty-kate/32/5953_2.png) [@kit-ty-kate](https://discuss.ocaml.org/u/kit-ty-kate)\ **Post date:** [July 31, 2025, 2:50pm UTC](https://discuss.ocaml.org/t/gitlab-ci-git-exits-with-code-128/17037/2 "2025-07-31T14:50:49Z")
> [@Richard-Degenne](#): > > I’m used to see `dev` as a version for libraries that do not have an explicit version number yet. I’m not sure I understand what `faker.~dev` is supposed to mean, or if there are any implications that may be relevant to my problem. `~dev` was the `dev` before opam 2.2 ([#4949](https://github.com/ocaml/opam/pull/4949)). Are you still using opam 2.1? (2.4.0 is the latest version). It shouldn’t matter for your issue though. > [@Richard-Degenne](#): > > `git fetch` exiting with code 128, which is a generic exit code which I need to look into; This means that git was unable to fetch the repository at `/builds/Richard-Degenne/ocaml-faker` somehow. Maybe adding `-vvv` to the command you’re calling to see the result of the git command might help. I would suggest doing that once you’ve updated to 2.4 if possible though (we never know, it might be something that was fixed in the last 5 or so years). If it still fails the same way, try to git clone by hand and see if git has also problems cloning manually. ---
**Author:** ![Richard-Degenne](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/richard-degenne/32/112_2.png) [@Richard-Degenne](https://discuss.ocaml.org/u/Richard-Degenne)\ **Post date:** [July 31, 2025, 2:58pm UTC](https://discuss.ocaml.org/t/gitlab-ci-git-exits-with-code-128/17037/3 "2025-07-31T14:58:53Z")
> [@kit-ty-kate](#): > > Are you still using opam 2.1? I’m using [the `ocaml/opam:latest` Docker image](https://hub.docker.com/r/ocaml/opam/tags), which, according to my logs, embeds OPAM 2.0.10. ```plaintext $ opam --version 2.0.10 ``` * * * > [@kit-ty-kate](#): > > Maybe adding `-vvv` to the command you’re calling to see the result of the git command might help. Unfortunately, I’m not the one running `git fetch` here. It’s run by OPAM as part of the `opam install .` command. Maybe there’s an OPAM settings for flags that should be passed to Git? * * * I managed to work around the problem by adding `--deps-only` to the command. That way, I don’t mess around with pinning the current library, and I still get to build and run the tests. I’d still like to get to the bottom of this thing. 😛 ---
**Author:** ![kit-ty-kate](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/kit-ty-kate/32/5953_2.png) [@kit-ty-kate](https://discuss.ocaml.org/u/kit-ty-kate)\ **Post date:** [July 31, 2025, 3:05pm UTC](https://discuss.ocaml.org/t/gitlab-ci-git-exits-with-code-128/17037/4 "2025-07-31T15:05:22Z")
> [@Richard-Degenne](#): > > Unfortunately, I’m not the one running `git fetch` here. It’s run by OPAM as part of the `opam install .` command. Maybe there’s an OPAM settings for flags that should be passed to Git? The `-vvv` was to pass to opam, not git. > [@Richard-Degenne](#): > > I’m using [the `ocaml/opam:latest` Docker image](https://hub.docker.com/r/ocaml/opam/tags), which, according to my logs, embeds OPAM 2.0.10. Yes sadly the default opam is 2.0 for backward compatibility purpose but you can use any other versions using the following: ```auto FROM ocaml/opam: RUN sudo ln -f /usr/bin/opam-2.4 /usr/bin/opam && opam init --reinit -ni ``` See [ocurrent/docker-base-images#132](https://github.com/ocurrent/docker-base-images/issues/132) for the upstream issue ---
**Author:** ![Richard-Degenne](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/richard-degenne/32/112_2.png) [@Richard-Degenne](https://discuss.ocaml.org/u/Richard-Degenne)\ **Post date:** [July 31, 2025, 6:29pm UTC](https://discuss.ocaml.org/t/gitlab-ci-git-exits-with-code-128/17037/5 "2025-07-31T18:29:18Z")
I understand the need for retro-compatibility, but does that mean there is _no_ official OPAM image for 2.1+ at all? :o ---
**Author:** ![kit-ty-kate](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/kit-ty-kate/32/5953_2.png) [@kit-ty-kate](https://discuss.ocaml.org/u/kit-ty-kate)\ **Post date:** [July 31, 2025, 7:30pm UTC](https://discuss.ocaml.org/t/gitlab-ci-git-exits-with-code-128/17037/6 "2025-07-31T19:30:18Z")
As i’ve said, the `ocaml/opam` images all have 2.1+, you just need to start your dockerfile with: `RUN sudo ln -f /usr/bin/opam- /usr/bin/opam && opam init --reinit -ni`. This is not ideal but it’s what this image does currently. I have a couple of personal opinions about how this can be improved that i’ve shared [in another post (see point 3)](https://discuss.ocaml.org/t/opinion-is-it-time-to-stop-testing-with-opam-2-2/16723/3), but that all depend on the available time of the infrastructure maintainers. Efforts for an actual official image (as-in `docker run ocaml`) was started some years ago, but it didn’t go past the [working prototype](https://github.com/ocaml-opam/docker-ocaml) phase due to a lake of available time to gather a proper long-term maintenance team. But if you’re specifically looking for images shipping the latest opam as `/usr/bin/opam` i believe [`ocamlpro/ocaml`](https://hub.docker.com/r/ocamlpro/ocaml) does it. ---
**Author:** ![Richard-Degenne](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/richard-degenne/32/112_2.png) [@Richard-Degenne](https://discuss.ocaml.org/u/Richard-Degenne)\ **Post date:** [August 1, 2025, 8:11am UTC](https://discuss.ocaml.org/t/gitlab-ci-git-exits-with-code-128/17037/7 "2025-08-01T08:11:45Z")
Got it. Thanks for all the context, it’s much appreciated. I switched to `ocamlpro/ocaml` for now and adjusted my pipeline accordingly. I was still encountering a similar issue with `opam install` so I re-ran it with `-vvv` as you suggested and here is what came up. ```plaintext + /usr/bin/git "symbolic-ref" "--quiet" "--short" "HEAD" - fatal: detected dubious ownership in repository at '/builds/Richard-Degenne/ocaml-faker' - To add an exception for this directory, call: - - git config --global --add safe.directory /builds/Richard-Degenne/ocaml-faker ``` Which then pointed me towards [this issue on GitLab itself](https://gitlab.com/gitlab-org/gitlab-runner/-/issues/29022). > The change made in recent Git releases [to address CVE-2022-24765](https://github.blog/2022-04-12-git-security-vulnerability-announced/) now disallows use of any `git` commands under the project clone directory if the container runs as a non-`root` user. I guess I can see two paths forward: - Mark the Git repository as safe as part of the CI setup; - Run the container as root. How (un)safe is it to run OPAM as root? I know a warning pops up whenever I do, but can there be actual consequences outside of “running stuff as root is usually discouraged”?