Can Not Connect to KeyServer Caused by GPG Error

Affected Versions: All Domino versions building Ubuntu-based compute environments

Issue

A compute environment build fails with a keyserver connection timeout similar to the following:

gpg: keyserver receive failed: Connection timed out

The command 'gpg --keyserver hkp://keyserver.ubuntu.com:80 \
  --recv-keys E298A3A825C0D65DFD57CBB651716619E084DAB9 \
  && gpg -a --export E298A3A825C0D65DFD57CBB651716619E084DAB9 \
  | sudo apt-key add -' returned a non-zero code: 2

This typically occurs in environments where outbound access to keyserver infrastructure is restricted — for example, on-premises deployments, GovCloud environments, or deployments with strict egress ACLs.

Root Cause

The build is attempting to fetch the CRAN repository signing key from the Ubuntu keyserver (keyserver.ubuntu.com) using the HKP protocol (port 11371 or port 80). Egress rules or firewall policies in the deployment environment block this outbound connection, causing the GPG keyserver lookup to time out and the build to fail. Deprecated: The gpg … | apt-key add - pattern used in older Dockerfile instructions is deprecated as of Ubuntu 20.10 and removed in Ubuntu 24.04+. Even where it still functions, it should not be used in new or updated compute environments.

Resolution

The recommended fix is to bypass the keyserver entirely by fetching the CRAN signing key directly from CRAN’s own HTTPS endpoint at cloud.r-project.org. This avoids any dependency on HKP keyserver access and uses the modern gpg —dearmor approach. Add the following to your compute environment’s Dockerfile Instructions:

# Step 1 — Install prerequisites (if not already present)
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    ca-certificates \
    gnupg \
    && rm -rf /var/lib/apt/lists/*

# Step 2 — Fetch the CRAN signing key directly from CRAN (no keyserver needed)
RUN curl -fsSL https://cloud.r-project.org/bin/linux/ubuntu/marutter_pubkey.asc \
    | gpg --dearmor -o /usr/share/keyrings/cran_ubuntu_key.gpg

# Step 3 — Verify the key fingerprint (optional but recommended)
# Expected: E298 A3A8 25C0 D65D FD57 CBB6 5171 6619 E084 DAB9  [expires: 2027-09-30]
RUN gpg --show-keys /usr/share/keyrings/cran_ubuntu_key.gpg

Tip: This approach works in any environment that allows outbound HTTPS to cloud.r-project.org — no keyserver port access required.

Fully Air-Gapped Environments

If your environment cannot reach any external endpoint during the build, the key must be pre-staged:

On a machine with internet access, download the key:

curl -fsSL https://cloud.r-project.org/bin/linux/ubuntu/marutter_pubkey.asc \
  -o marutter_pubkey.asc

Upload the .asc file to your Domino project files.
Reference the key file in your Dockerfile Instructions using the Domino project file access pattern, or embed the key as a base64-encoded string in your Dockerfile.

For detailed guidance on accessing project files during environment builds, see: Access Project Files During Docker Build

Legacy Proxy Workaround (Not Recommended)

An older workaround involved routing keyserver traffic through an HTTP proxy:

# NOT RECOMMENDED — apt-key is deprecated on Ubuntu 22.04+
RUN apt-key adv \
  --keyserver-options http-proxy=http://PROXY_URL:PORT/ \
  --keyserver keyserver.ubuntu.com --recv-keys E298A3A825C0D65DFD57CBB651716619E084DAB9

Not Recommended: This approach is no longer recommended because:

apt-key is deprecated since Ubuntu 20.10 and removed in Ubuntu 24.04+
It still requires keyserver connectivity even with a proxy
The direct CRAN HTTPS fetch described above is simpler and more reliable

​Issue

​Root Cause

​Resolution

​Fully Air-Gapped Environments

​Legacy Proxy Workaround (Not Recommended)

Issue

Root Cause

Resolution

Fully Air-Gapped Environments

Legacy Proxy Workaround (Not Recommended)