docker build : getting-started tutorial => Certificate error - docker

I'm having troubles with the getting started tutorial of docs.docker.com :
https://docs.docker.com/get-started/02_our_app/
When i execute the following command :
docker build -t getting-started .
I get the following errors :
> [2/5] RUN apk add --no-cache python2 g++ make:
#5 0.412 fetch https://dl-cdn.alpinelinux.org/alpine/v3.14/main/x86_64/APKINDEX.tar.gz
#5 0.551 139899692677960:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1914:
#5 0.552 WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.14/main: Permission denied
#5 0.552 fetch https://dl-cdn.alpinelinux.org/alpine/v3.14/community/x86_64/APKINDEX.tar.gz
#5 0.603 139899692677960:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1914:
#5 0.604 WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.14/community: Permission denied
#5 0.604 ERROR: unable to select packages:
#5 0.605 g++ (no such package):
#5 0.605 required by: world[g++]
#5 0.605 make (no such package):
#5 0.605 required by: world[make]
#5 0.605 python2 (no such package):
#5 0.605 required by: world[python2]
------
executor failed running [/bin/sh -c apk add --no-cache python2 g++ make]: exit code: 3
I'm on Windows 10 V1909 and i downloaded WSL 2 like specified in the tutorial.
EDIT :
Like Hans Kilian answered, it was a VPN problem...

Like Hans Kilian answered, it was a VPN problem...
Be careful if you are behind a proxy.

Related

How do I avoid a "x509: certificate signed by unknown authority" when doing a "go get download" from an alpine container?

I am trying to build coredns from scratch with the following Dockerfile:
FROM golang:alpine
SHELL [ "/bin/sh", "-ec" ]
RUN apk update && apk add --no-cache git make ca-certificates openssl && update-ca-certificates
RUN git clone https://github.com/coredns/coredns.git
WORKDIR /go/coredns
RUN go get download
RUN make
When I run docker build --no-cache --progress=plain -t coredns . this is the output and error I am getting:
#1 [internal] load build definition from Dockerfile
#1 sha256:5b65661f68f3298655d88d1e83c5014118e9d278e724f83e2f8d968a8f11fe27
#1 transferring dockerfile: 619B done
#1 DONE 0.0s
#2 [internal] load .dockerignore
#2 sha256:2e78fdc563f1836b7815b48a445b2878de57404b5573a93080990b3c49e92f8f
#2 transferring context: 2B done
#2 DONE 0.0s
#3 [internal] load metadata for docker.io/library/golang:alpine
#3 sha256:299327d28eff710219f2e24597cfa9b226e8b1b0dc90f9e2122573004cfe837f
#3 DONE 0.5s
#4 [1/6] FROM docker.io/library/golang:alpine#sha256:2381c1e5f8350a901597d633b2e517775eeac7a6682be39225a93b22cfd0f8bb
#4 sha256:bcd1e622e133c928bad4175797b9e323eb9ac29a1d90fbb12f2566da7e868b8f
#4 CACHED
#5 [2/6] RUN apk update && apk add --no-cache git make ca-certificates openssl && update-ca-certificates
#5 sha256:6dd058a5b7f80d591599c7ab466c65cf38e8d5d1b7ddb8f4d2e5d1c0e79a32f0
#5 0.198 fetch https://dl-cdn.alpinelinux.org/alpine/v3.17/main/x86_64/APKINDEX.tar.gz
#5 0.847 fetch https://dl-cdn.alpinelinux.org/alpine/v3.17/community/x86_64/APKINDEX.tar.gz
#5 1.224 v3.17.1-21-gf40c2ce77f [https://dl-cdn.alpinelinux.org/alpine/v3.17/main]
#5 1.224 v3.17.1-23-g06668be47f [https://dl-cdn.alpinelinux.org/alpine/v3.17/community]
#5 1.224 OK: 17813 distinct packages available
#5 1.280 fetch https://dl-cdn.alpinelinux.org/alpine/v3.17/main/x86_64/APKINDEX.tar.gz
#5 1.753 fetch https://dl-cdn.alpinelinux.org/alpine/v3.17/community/x86_64/APKINDEX.tar.gz
#5 2.043 (1/8) Installing brotli-libs (1.0.9-r9)
#5 2.120 (2/8) Installing nghttp2-libs (1.51.0-r0)
#5 2.182 (3/8) Installing libcurl (7.87.0-r1)
#5 2.257 (4/8) Installing libexpat (2.5.0-r0)
#5 2.314 (5/8) Installing pcre2 (10.42-r0)
#5 2.387 (6/8) Installing git (2.38.2-r0)
#5 2.622 (7/8) Installing make (4.3-r1)
#5 2.686 (8/8) Installing openssl (3.0.7-r2)
#5 2.763 Executing busybox-1.35.0-r29.trigger
#5 2.774 OK: 17 MiB in 24 packages
#5 DONE 2.9s
#6 [3/6] RUN git clone https://github.com/coredns/coredns.git
#6 sha256:aae1eab60ab1f0ffb8d8a48bd03ef02b93bb537b82f1bd4285cfcb2731e19ff4
#6 0.264 Cloning into 'coredns'...
#6 DONE 14.1s
#7 [4/6] WORKDIR /go/coredns
#7 sha256:2291c568fa24f46c6531c6e7d41d5e1150d10485b34e88a85f81542e26295acb
#7 DONE 0.0s
#8 [5/6] RUN go get download
#8 sha256:b2878fe66127be7ffe2e7f4e1f6b538679aebda0abffdd20b14bf928ef23957f
#8 3.603 go: cloud.google.com/go/compute#v1.14.0: Get "https://proxy.golang.org/cloud.google.com/go/compute/#v/v1.14.0.mod": x509: certificate signed by unknown authority
#8 ERROR: executor failed running [/bin/sh -ec go get download]: exit code: 1
------
> [5/6] RUN go get download:
------
executor failed running [/bin/sh -ec go get download]: exit code: 1
I've googled my heart out trying to figure out how to get past the "x509: certificate signed by unknown authority" error. Any help is appreciated.
It looks like the issue was caused by the Cisco AnyConnect client on my Mac. You can uninstall Cisco AnyConect or add the following to your Dockerfile.
RUN wget http://www.cisco.com/security/pki/certs/ciscoumbrellaroot.cer
RUN openssl x509 -inform DER -in ciscoumbrellaroot.cer -out ciscoumbrellaroot.crt
RUN cp ciscoumbrellaroot.crt /usr/local/share/ca-certificates/ciscoumbrellaroot.crt
RUN update-ca-certificates
I found the answer here.

Some unresolved dependencies have extra attributes

I used dockerfile below to build play-samples-play-scala-hello-world-tutorial(https://github.com/playframework/play-samples/tree/2.8.x/play-scala-hello-world-tutorial)
I want to build the tutorial by dockerfile, but got an error like downloading issue. I wonder whether this is issue with network or dockerfile.
FROM openjdk:11
ENV TZ=America/Los_Angeles
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
ENV HULU_ENV=staging
ADD . /play-samples-play-scala-hello-world-tutorial
WORKDIR /play-samples-play-scala-hello-world-tutorial
RUN curl -L https://github.com/sbt/sbt/releases/download/v1.5.2/sbt-1.5.2.tgz -o sbt.tgz
RUN tar xf sbt.tgz
RUN ./sbt/bin/sbt clean stage
but got error below and failed to build
docker build . -f Dockerfile
#11 0.595 copying runtime jar...
#11 69.16 [warn] Note: Some unresolved dependencies have extra attributes. Check that these dependencies exist with the requested attributes.
#11 69.16 [warn] com.typesafe.sbt:sbt-js-engine:1.2.3 (scalaVersion=2.12, sbtVersion=1.0)
#11 69.16 [warn] org.foundweekends.giter8:sbt-giter8-scaffold:0.11.0 (sbtVersion=1.0, scalaVersion=2.12)
#11 69.16 [warn] com.typesafe.sbt:sbt-native-packager:1.5.2 (scalaVersion=2.12, sbtVersion=1.0)
#11 69.16 [warn] com.lightbend.sbt:sbt-javaagent:0.1.5 (scalaVersion=2.12, sbtVersion=1.0)
#11 69.16 [warn] com.typesafe.sbt:sbt-twirl:1.5.1 (scalaVersion=2.12, sbtVersion=1.0)
#11 69.16 [warn] com.typesafe.sbt:sbt-web:1.4.4 (scalaVersion=2.12, sbtVersion=1.0)
#11 69.16 [warn]
#11 69.16 [warn] Note: Unresolved dependencies path:
#11 69.25 [error] Error downloading org.foundweekends.giter8:sbt-giter8-scaffold;sbtVersion=1.0;scalaVersion=2.12:0.11.0
#11 69.25 [error] Not found
#11 69.25 [error] Not found
#11 69.25 [error] not found: https://repo1.maven.org/maven2/org/foundweekends/giter8/sbt-giter8-scaffold_2.12_1.0/0.11.0/sbt-giter8-scaffold-0.11.0.pom
#11 69.25 [error] not found: /root/.ivy2/localorg.foundweekends.giter8/sbt-giter8-scaffold/scala_2.12/sbt_1.0/0.11.0/ivys/ivy.xml
#11 69.25 [error] download error: Caught javax.net.ssl.SSLHandshakeException (Remote host terminated the handshake) while downloading https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/org.foundweekends.giter8/sbt-giter8-scaffold/scala_2.12/sbt_1.0/0.11.0/ivys/ivy.xml
#11 69.25 [error] download error: Caught javax.net.ssl.SSLHandshakeException (Remote host terminated the handshake) while downloading https://repo.typesafe.com/typesafe/ivy-releases/org.foundweekends.giter8/sbt-giter8-scaffold/scala_2.12/sbt_1.0/0.11.0/ivys/ivy.xml
any help is appreciated!
The relevant error is:
download error: Caught javax.net.ssl.SSLHandshakeException (Remote host terminated the handshake) while downloading https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/org.foundweekends.giter8/sbt-giter8-scaffold/scala_2.12/sbt_1.0/0.11.0/ivys/ivy.xml
SBT is not able to connect to the repository to download the dependencies because of some HTTPS issue.
This can be caused by several things, either because your container doesn't have proper certificates or because your running behind a corporate proxy maybe and it mess with certificates.
You should be able to find more help by searching on the SSLHandshakeException error.

Cloning private SSH Github repo from Cargo with Docker fails

I am a bit lost with Docker, Cargo and SSH. I have this example project https://github.com/Jasperav/ssh-dockerfile. It is a hello world application with a docker file and a private dependency in the toml file. You can replace the dependency with your private dependency and just do docker build -t something ..
I want to create a docker image of my application with a private repository. I can not get it working, even not with the new Buildkit feature (--mount=type=ssh). I tried adding and removing stuff from the Dockerfile. I keep getting errors.
This is the content of my Dockerfile which is a combined effort of stuff I found on the internet:
FROM rust:1.65 AS builder
ENV CARGO_NET_GIT_FETCH_WITH_CLI=true
WORKDIR app
COPY . .
RUN mkdir -p /root/.ssh
RUN ssh-keyscan github.com >> /root/.ssh/known_hosts
RUN --mount=type=ssh cargo build --release
FROM debian:buster-slim
COPY --from=builder ./target/release/docker ./target/release/docker
CMD ["./release/server"]
The error I get is:
> [builder 6/6] RUN --mount=type=ssh cargo build --release:
#12 0.400 Updating git repository `ssh://git#github.com/xxx.git`
#12 1.171 error: failed to get `x` as a dependency of package `hello v0.1.0 (/app)`
#12 1.171
#12 1.171 Caused by:
#12 1.171 failed to load source for dependency `x`
#12 1.171
#12 1.171 Caused by:
#12 1.171 Unable to update ssh://git#github.com/xx.git
#12 1.171
#12 1.171 Caused by:
#12 1.171 failed to clone into: /usr/local/cargo/git/db/xx
#12 1.171
#12 1.171 Caused by:
#12 1.171 process didn't exit successfully: `git fetch --force --update-head-ok 'ssh://git#github.com/xx.git' '+HEAD:refs/remotes/origin/HEAD'` (exit status: 128)
#12 1.171 --- stderr
#12 1.171 Warning: Permanently added the ECDSA host key for IP address '140.82.121.4' to the list of known hosts.
#12 1.171 git#github.com: Permission denied (publickey).
#12 1.171 fatal: Could not read from remote repository.
#12 1.171
#12 1.171 Please make sure you have the correct access rights
#12 1.171 and the repository exists.
------
executor failed running [/bin/sh -c cargo build --release]: exit code: 101
I am hoping that the SSH works from the host, but if I need to pass something in as build argument, it is also fine. The thing that did work is by having the access keys inside my dependency inside the Cargo.toml file, but that is really leaking too much info (and github will revoke the access key everytime I commit).
I can run the application fine without Docker. git clone also just works.
Turns out I was missing the --ssh default argument. It worked when I did build docker like this:
docker build -t name --ssh default .

"Docker Image" build fails due to failure in "JupyterLab" installation

I am trying to build a docker image for using a package named as Automated Recommendation Tool. As per their docker workflow I installed docker on my Ubuntu OS and then tried to build the docker image. Following is the command that I executed -
DOCKER_BUILDKIT=1 \
docker build -f docker/Dockerfile \
--pull \
--no-cache \
-t jbei/art .
After running for a while I got the following error -
=> ERROR [jupyter-install 1/1] RUN set -ex && poetry install --n 130.5s
It automatically continued running and later on stopped by giving following output -
#13 129.9 - `minimize`: This option controls whether your JS bundle is minified
#13 129.9 during the Webpack build, which helps to improve JupyterLab's overall
#13 129.9 performance. However, the minifier plugin used by Webpack is very memory
#13 129.9 intensive, so turning it off may help the build finish successfully in
#13 129.9 low-memory environments.
#13 129.9
#13 130.0 An error occurred.
#13 130.0 RuntimeError: JupyterLab failed to build
#13 130.0 See the log file for details: /tmp/jupyterlab-debug-c399mxqe.log
------
executor failed running [/bin/sh -c set -ex && poetry install --no-dev --extras "docker jupyter" --no-root --no-interaction -vv && rm -rf $ART_USER/.cache/ && jupyter lab build && jupyter labextension install #jupyter-widgets/jupyterlab-manager && find ${ART_CODE} -name __pycache__ | xargs rm -rf]: exit code: 1
Anyone experienced in building Docker Images, Please help me.
Following are my system specifications -
Operating System: Ubuntu 22.04 LTS
Kernel: Linux 5.15.0-37-generic
Architecture: x86-64
Hardware Vendor: HP
Hardware Model: HP Pavilion Gaming Laptop 15-ec1xxx
Docker Version -
Docker version 20.10.17, build 100c701
Update:
Following is the complete output of the jupyter lab build command -
#10 39.59 + rm -rf artuser/.cache/
#10 39.59 + jupyter lab build
#10 40.91 [LabBuildApp] JupyterLab 3.4.2
#10 40.91 [LabBuildApp] Building in /usr/local/art/.venv/share/jupyter/lab
#10 41.26 [LabBuildApp] Building jupyterlab assets (production, minimized)
#10 41.28-Build failed.
#10 122.8 Troubleshooting: If the build failed due to an out-of-memory error, you
#10 122.8 may be able to fix it by disabling the `dev_build` and/or `minimize` options.
#10 122.8
#10 122.8 If you are building via the `jupyter lab build` command, you can disable
#10 122.8 these options like so:
#10 122.8
#10 122.8 jupyter lab build --dev-build=False --minimize=False
#10 122.8
#10 122.8 You can also disable these options for all JupyterLab builds by adding these
#10 122.8 lines to a Jupyter config file named `jupyter_config.py`:
#10 122.8
#10 122.8 c.LabBuildApp.minimize = False
#10 122.8 c.LabBuildApp.dev_build = False
#10 122.8
#10 122.8 If you don't already have a `jupyter_config.py` file, you can create one by
#10 122.8 adding a blank file of that name to any of the Jupyter config directories.
#10 122.8 The config directories can be listed by running:
#10 122.8
#10 122.8 jupyter --paths
#10 122.8
#10 122.8 Explanation:
#10 122.8
#10 122.8 - `dev-build`: This option controls whether a `dev` or a more streamlined
#10 122.8 `production` build is used. This option will default to `False` (i.e., the
#10 122.8 `production` build) for most users. However, if you have any labextensions
#10 122.8 installed from local files, this option will instead default to `True`.
#10 122.8 Explicitly setting `dev-build` to `False` will ensure that the `production`
#10 122.8 build is used in all circumstances.
#10 122.8
#10 122.8 - `minimize`: This option controls whether your JS bundle is minified
#10 122.8 during the Webpack build, which helps to improve JupyterLab's overall
#10 122.8 performance. However, the minifier plugin used by Webpack is very memory
#10 122.8 intensive, so turning it off may help the build finish successfully in
#10 122.8 low-memory environments.
#10 122.8
#10 122.8 An error occurred.
#10 122.8 RuntimeError: JupyterLab failed to build
#10 122.8 See the log file for details: /tmp/jupyterlab-debug-iguri15x.log
------
executor failed running [/bin/sh -c set -ex && poetry install --no-dev --extras "docker jupyter" --no-root --no-interaction -vv && rm -rf $ART_USER/.cache/ && jupyter lab build && jupyter labextension install #jupyter-widgets/jupyterlab-manager && find ${ART_CODE} -name __pycache__ | xargs rm -rf]: exit code: 1
From these lines I can see that it is suggesting to do the following changes in my jupyter lab build command in the Dockerfile -
jupyter lab build --dev-build=False --minimize=False
Will this help, or should I first check the log files which I am unable to locate as the image is not built.

Apple M1 Docker error cc1plus: error: unknown value 'armv8-a-march=armv8-a' for -march

Getting this error while building docker images on Mac OS BigSur with M1 chip.
What I've tried: Installed docker for Apple Silicon Graphic M1 from docker site
It fails while trying to install RocksDB from Docker
# docker.local
FROM golang:1.12.4-alpine3.9
RUN apk add bash build-base grep git
# Install RocksDB
RUN apk add coreutils linux-headers perl zlib-dev bzip2-dev lz4-dev snappy-dev zstd-libs zstd-dev && \
cd /tmp && \
wget -O - https://github.com/facebook/rocksdb/archive/v5.18.3.tar.gz | tar xz && \
cd /tmp/rocksdb* && \
make -j $(nproc) install-shared OPT=-g0 USE_RTTI=1 && \
rm -R /tmp/rocksdb* && \
apk del coreutils linux-headers perl
Errors:
#6 9.903 cc1plus: error: unknown value 'armv8-a-march=armv8-a' for -march
#6 9.903 cc1plus: note: valid arguments are: armv8-a armv8.1-a armv8.2-a armv8.3-a armv8.4-a native
#6 9.906 cc1plus: error: unknown value 'armv8-a-march=armv8-a' for -march
#6 9.906 cc1plus: note: valid arguments are: armv8-a armv8.1-a armv8.2-a armv8.3-a armv8.4-a native
#6 9.907 install -d /usr/local/lib
#6 9.908 CC shared-objects/cache/clock_cache.o
#6 9.908 CC shared-objects/cache/lru_cache.o
#6 9.909 CC shared-objects/cache/sharded_cache.o
#6 9.909 for header_dir in `find "include/rocksdb" -type d`; do \
#6 9.909 install -d /usr/local/$header_dir; \
#6 9.909 done
#6 9.911 cc1plus: error: unknown value 'armv8-a-march=armv8-a' for -march
#6 9.911 cc1plus: note: valid arguments are: armv8-a armv8.1-a armv8.2-a armv8.3-a armv8.4-a native
#6 9.912 make: *** [Makefile:684: shared-objects/cache/clock_cache.o] Error 1
#6 9.912 make: *** Waiting for unfinished jobs....
#6 9.912 make: *** [Makefile:684: shared-objects/cache/lru_cache.o] Error 1
#6 9.913 make: *** [Makefile:684: shared-objects/cache/sharded_cache.o] Error 1
#6 9.914 for header in `find "include/rocksdb" -type f -name *.h`; do \
#6 9.914 install -C -m 644 $header /usr/local/$header; \
#6 9.914 done
There are a couple of issues to address. The dockerfile as you have it will download a base golang ARM image, and try to use that to build. That's fine, as long as the required libs "know how" to build with an arm architecture. If they don't know how to build under arm (as seems to be the case here), you may want to try building under an AMD image of golang.
Intel / AMD containers will run under ARM docker on an M1. There are a few ways to build AMD containers on an M1. You can use buildkit, and then:
docker buildx build --platform linux/amd64 .
or, you can add the arch to the source image by modifying the Dockerfile to include something like:
FROM --platform=linux/amd64 golang:1.12.4-alpine3.9
which would use the amd64 arch of the golang image (assuming one exists). This is what I often use to build an image on ARM. This works even if docker is native ARM.

Resources