How to fix W: apt-key output should not be parsed (stdout is not a terminal) in APT

APTBEGINNERLOWUpdated Dec 29, 2025· 157 views

This warning appears when apt-key runs in a non-interactive environment (like Docker or scripts). While non-critical, it indicates you should migrate away from deprecated apt-key to the new GPG-based key management method for better security.

Quick fix

Fixes W: apt-key output should not be parsed (stdout is not a terminal)

ENV APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=DontWarn
RUN apt-key adv --keyserver keyserver.ubuntu.com --recv-keys KEYID
  1. Suppress the warning (temporary solution)
  2. Migrate to GPG-based key management (recommended)
  3. Apply migration in Dockerfile
  4. Remove old keys from deprecated location (cleanup)
apt — error
ENV APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=DontWarn
RUN apt-key adv --keyserver keyserver.ubuntu.com --recv-keys KEYID
W: apt-key output should not be parsed (stdout is not a terminal)

What this error means

This warning occurs when the apt-key command executes in a non-terminal environment (such as in Docker containers, CI/CD pipelines, or automated scripts). The warning tells you not to parse the output of apt-key, which suggests the tool is not designed for programmatic use in non-interactive contexts. The deeper issue is that apt-key has been deprecated since Debian 11 and Ubuntu 20.10. It adds keys to a global trusted keyring (/etc/apt/trusted.gpg), meaning any key can sign packages from any repository on the system—a significant security risk. The modern approach ties keys to specific repositories instead, preventing unauthorized key usage.

Typical symptoms

  • Warning message appears during Docker builds or automated deployments
  • Scripts and Dockerfiles show warning but continue executing
  • Warning appears when running apt-key in CI/CD pipelines
  • Appears alongside other apt-key deprecation warnings

Common causes

  1. Running apt-key in a non-terminal environment (Docker, CI/CD, scripts)
  2. Using deprecated apt-key method instead of modern GPG-based key management
  3. apt-key expects interactive terminal input which is unavailable

How to fix "W: apt-key output should not be parsed (stdout is not a terminal)"

1Suppress the warning (temporary solution)

If you need a quick fix while still using apt-key, set the environment variable to suppress the warning in your Dockerfile or script:

dockerfile
ENV APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=DontWarn
RUN apt-key adv --keyserver keyserver.ubuntu.com --recv-keys KEYID

Or in a shell script:

bash
export APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=DontWarn
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys KEYID

This silences the warning but does not address the underlying deprecation issue.

2Migrate to GPG-based key management (recommended)

Instead of using apt-key, download the GPG key directly to /etc/apt/keyrings/ and reference it in your sources file. This is the modern, secure approach.

Option A: Download and save a GPG key:

bash
curl -fsSL https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xKEYID | sudo gpg --dearmor -o /usr/share/keyrings/example-keyring.gpg

Option B: Convert existing key from deprecated location:

bash
sudo apt-key export KEYID | sudo gpg --dearmor -o /usr/share/keyrings/example-keyring.gpg

Then update your sources.list or create a new file in /etc/apt/sources.list.d/:

bash
# Old way (deprecated)
deb https://example.com/repo stable main

# New way (modern)
deb [signed-by=/usr/share/keyrings/example-keyring.gpg] https://example.com/repo stable main
3Apply migration in Dockerfile

Here's a complete example for a Dockerfile using the modern approach:

dockerfile
FROM ubuntu:22.04

RUN apt-get update && apt-get install -y curl gnupg

# Download the GPG key directly without using apt-key
RUN curl -fsSL https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xYOURKEYID | gpg --dearmor -o /usr/share/keyrings/example-keyring.gpg

# Create sources list with the signed-by parameter
RUN echo "deb [signed-by=/usr/share/keyrings/example-keyring.gpg] https://example.com/repo stable main" > /etc/apt/sources.list.d/example.list

# Now apt-get update won't show deprecation warnings
RUN apt-get update
RUN apt-get install -y desired-package
4Remove old keys from deprecated location (cleanup)

After migrating to the new method, optionally remove old keys from the global keyring:

bash
# List all keys in the deprecated location
sudo apt-key list

# Remove a specific key (use the last 8 digits of the fingerprint)
sudo apt-key del KEYID

# Or export the full fingerprint
sudo apt-key del "DBEA 6B52 81D0 C816 F630 E889 D980 A174 57F6 FB86"

This cleanup step is optional but recommended for security and system hygiene.

Advanced notes

Security Context: The deprecation of apt-key addresses a real security vulnerability. When a key is added to the global trusted keyring, it can be used to verify packages from any repository configured on the system. This means a compromised third-party repository could potentially replace system packages. The new method ties keys to specific repositories via the signed-by parameter, preventing unauthorized key usage.

Distro Differences: Ubuntu 22.04+ and Debian 11+ strongly encourage the new method. Older systems may still rely on apt-key, but migration is recommended before end-of-life.

Docker Best Practices: In Docker images, prefer downloading keys directly with curl/wget and gpg --dearmor rather than using apt-key, even if you suppress the warning. This follows current container best practices and reduces image size.

CI/CD Note: If running in GitHub Actions, GitLab CI, or similar platforms, the non-terminal environment will always trigger this warning with apt-key. Using the GPG-based approach eliminates the warning entirely.

Frequently asked questions

What does "W: apt-key output should not be parsed (stdout is not a terminal)" mean?
This warning occurs when the apt-key command executes in a non-terminal environment (such as in Docker containers, CI/CD pipelines, or automated scripts). The warning tells you not to parse the output of apt-key, which suggests the tool is not designed for programmatic use in non-interactive contexts. 10.
How do I fix "W: apt-key output should not be parsed (stdout is not a terminal)"?
This warning appears when apt-key runs in a non-interactive environment (like Docker or scripts). While non-critical, it indicates you should migrate away from deprecated apt-key to the new GPG-based key management method for better security.
What causes "W: apt-key output should not be parsed (stdout is not a terminal)"?
Running apt-key in a non-terminal environment (Docker, CI/CD, scripts) Using deprecated apt-key method instead of modern GPG-based key management apt-key expects interactive terminal input which is unavailable
Is the "W: apt-key output should not be parsed (stdout is not a terminal)" error serious?
It is a low-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading