[BUG] Code on the web: `apt-get update` in setup scripts fails with exit 100 — base image ships the retired ondrej/php PPA (upstream 'Label' change)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

As of ~2026-07-07 16:00 UTC, any Claude Code on the web / routines environment setup script that runs apt-get update fails with exit code 100, which means the session fails to start ("Setup script failed with exit code 100"). Nothing changed on the user side — the breakage is in the base image, which ships the ondrej/php Launchpad PPA enabled by default.

That PPA was retired upstream and its Release file's Label field changed:

E: Repository 'https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble InRelease' changed its 'Label' value from 'PPA for PHP' to 'Use https://packages.sury.org/php/ instead'

apt treats Release-metadata changes (Label/Origin/Suite) as a security-relevant event and makes apt-get update exit non-zero until the change is explicitly accepted. Since the PPA is baked into the image, every cloud environment whose setup script does a plain apt-get update (e.g. the docs' own example, apt update && apt install -y gh, from Setup scripts) is now broken.

The failure mode is especially confusing in combination with environment caching:

• Environments with a valid snapshot keep working until the ~7-day cache expiry, then suddenly start failing "out of nowhere" (ours expired 2026-07-07 ~16:00 UTC; the setup script had last actually run on 2026-06-30).
• A failed setup run never produces a new snapshot, so every subsequent session/scheduled-routine fire re-runs the failing script — scheduled routines on the environment stay down until the user edits the setup script.
• If the apt-get update runs early or in parallel in the setup script, the E: line is buried in the middle of the log and the truncated "Script output" shown on the failed run only displays the tail — the user sees a bare "exit code 100" with no visible error.

Steps to Reproduce

1. Create a cloud environment with the setup script from the docs:

``bash
#!/bin/bash
apt update && apt install -y gh
``

1. Start a new session (or wait for a scheduled routine to fire) so the setup script actually runs (no valid cache snapshot).
2. Session fails to start: Setup script failed with exit code 100.

Verified the same three packages (gh, git-lfs, chromium-browser) install cleanly on a stock ubuntu:24.04 container without the PPA — the failure is specific to the image's preconfigured sources.

Expected Behavior

apt-get update in a setup script works out of the box, per the documented example.

Suggested Fix

• Remove the retired ondrej/php PPA from the base image (or replace with its successor, packages.sury.org/php), and
• consider setting Acquire::AllowReleaseInfoChange "true"; in the image's apt config so future third-party repo relabels don't hard-fail every user's setup script again.

User Workaround

Either of:

apt-get update --allow-releaseinfo-change

or remove the dead PPA first:

rm -f /etc/apt/sources.list.d/*ondrej*
apt-get update

(Editing the setup script also forces the cache rebuild, so the fix takes effect on the next session.)

Related

• #71629 — Trusted egress allowlist out of sync (its "Instance 1" also notes the base image ships PPAs enabled by default; this report is a different failure mode of the same shipped PPAs: upstream metadata change rather than proxy 403, and it hits unrestricted network environments too)

Environment

• Claude Code on the web / scheduled routines (cloud environments), Ubuntu 24.04 (noble) base image, unrestricted network access
• First observed: 2026-07-07 ~16:00 UTC, reproduced on every setup-script run since