docker(install): retry macOS archive installs on transient apt mirror failures

[crazy-max]

relates to https://github.com/docker/actions-toolkit/actions/runs/24534040516/job/71724508344#step:10:1656

Archive install script log
  + curl -fsSL https://get.docker.com/
  + sh -s -- --channel stable --version 29.4.0
  # Executing docker install script, commit: 8fb5881103ac6f2fb404605d6d5b1f84244f3896
  + sh -c apt-get -qq update >/dev/null
  E: Failed to fetch http://security.ubuntu.com/ubuntu/dists/noble-security/universe/binary-amd64/Packages.xz  File has unexpected size (1168996 != 1169356). Mirror sync in progress? [IP: 91.189.91.81 80]
     Hashes of expected file:
      - Filesize:1169356 [weak]
      - SHA256:4e51e49a33aa3620d62a5baa71ebafa3b842126e00f7c127ec0c135dae3ace13
      - SHA1:2426cb1dad6e771311e91b7cf9399f7591e9453e [weak]
      - MD5Sum:0ff540ebd6e0012a67a9c919230dd2c6 [weak]
     Release file created at: Thu, 16 Apr 2026 19:40:19 +0000
  E: Failed to fetch http://security.ubuntu.com/ubuntu/dists/noble-security/universe/i18n/Translation-en.xz  
  E: Some index files failed to download. They have been ignored, or old ones used instead.
  time="2026-04-16T21:25:14Z" level=warning msg="provisioning scripts should not reference the LIMA_CIDATA variables"

[tcely]

Doesn't it make sense to store the curl output and possibly use the --retry 5 option before the loop?

[crazy-max]

Sounds good to have curl --retry as an extra guard, but the failure here was inside get.docker.com during apt-get update, after curl had already succeeded.

[tcely]

Rather than a hard-coded file in /tmp using mktemp is safer.

The execute permission is unnecessary because we are invoking sh not the script file.

[crazy-max]

Good catch makes sense thx