yum "Cannot find a valid baseurl for repo": CentOS 7 reached end of life, so use the vault

1. Make sure it’s the end-of-life problem

cat /etc/centos-release
grep -E '^(mirrorlist|baseurl)' /etc/yum.repos.d/CentOS-Base.repo

CentOS Linux release 7.9.2009, with mirrorlist=http://mirrorlist.centos.org/..., is the case this article covers. If the message names another repository, such as EPEL or a vendor’s, or you’re on a supported system, then it’s a network problem: section 5.

2. CentOS 7: point to the vault

The commands above do two things in each CentOS repository file. They turn off the mirrorlist line, and turn on baseurl, now pointing to the archive of the last release, 7.9.2009. Check the result:

grep -E '^(#?mirrorlist|baseurl)' /etc/yum.repos.d/CentOS-Base.repo
yum repolist

In a Dockerfile, put the same line before your first yum:

FROM centos:7
RUN sed -i -e 's/^mirrorlist=/#mirrorlist=/' \
           -e 's|^#baseurl=http://mirror.centos.org/centos/$releasever|baseurl=http://vault.centos.org/7.9.2009|' \
           /etc/yum.repos.d/CentOS-*.repo \
 && yum -y install httpd \
 && yum clean all

Better still, change the base image, as section 4 explains. The Dockerfile Generator starts from supported images.

3. CentOS 8: the same idea

sed -i -e 's/^mirrorlist=/#mirrorlist=/' \
       -e 's|^#baseurl=http://mirror.centos.org/$contentdir/$releasever|baseurl=http://vault.centos.org/8.5.2111|' \
       /etc/yum.repos.d/CentOS-*.repo
dnf clean all
dnf makecache

8.5.2111 was the last CentOS Linux 8 release.

4. Then move on

The vault gets the system installing packages again. It doesn’t get you security updates: nothing published since the end of life, including fixes for serious vulnerabilities. So treat the vault as a bridge, and plan the way off:

A fresh install, with your configuration applied by a tool such as Ansible, is often the cleanest route. In-place conversion works, though test it on a copy first, and take a backup.

Red Hat’s extended support, ELS, still exists for RHEL 7, and other vendors sell extended CentOS 7 support. That’s the option when a system can’t move yet.

5. When it’s really the network

On a supported system, this message means yum or dnf can’t reach a working mirror at all:

curl -sI https://mirrors.rockylinux.org/ | head -n 1
getent hosts mirrors.rockylinux.org
env | grep -i proxy

No name resolution is a DNS problem: see Temporary failure in name resolution. A company proxy needs proxy=http://proxy:3128 in /etc/yum.conf or /etc/dnf/dnf.conf. A firewall may block outgoing HTTP and HTTPS. And a repository file you added by hand may simply have a wrong URL.