使用golang 的http.Get方法时出现 "certificate signed by unknown authority" 错误的 Docker 容器

Question

我有一个使用 Golang 的容器，调用了一个 https api。我正在使用 scratch 容器，但当我尝试运行时，我得到了一个 certificate signed by unknown authority 错误。

url := "https://restcountries.eu/rest/v2/name/" + params.Get("country")
response, err := http.Get(url)

我的 Dockerfile 如下所示：

FROM golang:1.15 AS builder
WORKDIR /GreetingAPI
COPY . /greeting
WORKDIR /greeting
ENV GO111MODULE=on
RUN CGO_ENABLED=0 GOOS=linux go build -o greeting

FROM scratch
COPY --from=builder /greeting .
CMD ["./greeting"]

我使用这个答案更新了我的Dockerfile。但是当我尝试构建容器时，出现了 ERROR: "/ca-certificates.crt" not found: not found和failed to solve: rpc error: code = Unknown desc = failed to compute cache key: "/ca-certificates.crt" not found: not found的错误。

FROM golang:1.15 AS builder
WORKDIR /GreetingAPI
COPY . /greeting
WORKDIR /greeting
ENV GO111MODULE=on
RUN CGO_ENABLED=0 GOOS=linux go build -o greeting

FROM scratch
ADD ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /greeting .
CMD ["./greeting"]

- user12406569

---

请查看此评论：如何使用错误的证书进行https请求？ - Ismail Durmaz

Answer 1

我可能需要在链接的答案中更加清晰明确，此第一个示例中的副本是单阶段示例，在这个示例中您需要将证书文件注入到构建上下文（通常包含Dockerfile的目录）中：

FROM scratch
ADD ca-certificates.crt /etc/ssl/certs/
ADD main /
CMD ["/main"]

你有一个多阶段构建，并且可以按照链接答案后半部分的多阶段方法进行操作。它在另一个阶段中从发行商安装证书，然后将它们复制到您的基础镜像阶段：

FROM golang:alpine as build
RUN apk --no-cache add ca-certificates
WORKDIR /go/src/app
COPY . .
RUN CGO_ENABLED=0 go-wrapper install -ldflags '-extldflags "-static"'

FROM scratch
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=build /go/bin/app /app
ENTRYPOINT ["/app"]

然而，第二个示例假设以Alpine为基础的第一阶段，并使用apk。（它还假设证书需要安装在基础映像中，但在当前的golang映像中实际上并非如此。）对于您的示例，它基于Debian镜像中的golang:1.15。对于这种情况，通常需要apt-get命令，但在这种情况下，ca-certificates包已经安装，因此您只需复制结果：

FROM golang:1.15 AS builder
COPY . /greeting
WORKDIR /greeting
ENV GO111MODULE=on
RUN CGO_ENABLED=0 GOOS=linux go build -o greeting

FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /greeting /
CMD ["/greeting"]

- BMitch

Answer 2

在构建阶段安装CA证书并将其复制到最终镜像中。可以使用以下方式：

FROM golang:1.15 AS builder
RUN apk update
RUN apk add -U --no-cache ca-certificates && update-ca-certificates
WORKDIR /GreetingAPI
COPY . /greeting
WORKDIR /greeting
ENV GO111MODULE=on
RUN CGO_ENABLED=0 GOOS=linux go build -o greeting

FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /greeting .
CMD ["./greeting"]

- gipsy