Docker Compose, Conda, and non-standard certificates - docker

Question

I'm having some difficulty figuring out how to run conda install ... in a Dockerfile, while referencing a non-standard certificates file. In my Dockerfile, I have:
RUN REQUESTS_CA_BUNDLE=/non-standard-certificates.pem conda update -n base conda -y
which appears to run fine. But then I have:
RUN REQUESTS_CA_BUNDLE=/non-standard-certificates.pem CURL_CA_BUNDLE=/non-standard-certificates.pem conda install -n base -c defaults -c conda-forge <list-of-packages>
which ends in:
CondaHTTPError: HTTP 000 CONNECTION FAILED for url <https://conda.anaconda.org/conda-forge/linux-64/current_repodata.json>
Elapsed: -
An HTTP error occurred when trying to retrieve this URL.
HTTP errors are often intermittent, and a simple retry will get you on your way.
'https://conda.anaconda.org/conda-forge/linux-64'
Can anyone see what is incorrect here?
Update:
I have since figured out that I should probably be using RUN conda config --set client_ssl_cert ..., and that the certificate file in question had Windows carriage-returns in it (which I removed with dos2unix), but now I'm getting a different error:
Step 7/29 : RUN conda update -n base conda -y
---> Running in 052e36266aef
Collecting package metadata (current_repodata.json): ...working... failed
# >>>>>>>>>>>>>>>>>>>>>> ERROR REPORT <<<<<<<<<<<<<<<<<<<<<<
Traceback (most recent call last):
File "/opt/conda/lib/python3.7/site-packages/conda/exceptions.py", line 1074, in __call__
return func(*args, **kwargs)
File "/opt/conda/lib/python3.7/site-packages/conda/cli/main.py", line 84, in _main
exit_code = do_call(args, p)
File "/opt/conda/lib/python3.7/site-packages/conda/cli/conda_argparse.py", line 82, in do_call
exit_code = getattr(module, func_name)(args, parser)
File "/opt/conda/lib/python3.7/site-packages/conda/cli/main_update.py", line 20, in execute
install(args, parser, 'update')
File "/opt/conda/lib/python3.7/site-packages/conda/cli/install.py", line 265, in install
should_retry_solve=(_should_retry_unfrozen or repodata_fn != repodata_fns[-1]),
File "/opt/conda/lib/python3.7/site-packages/conda/core/solve.py", line 117, in solve_for_transaction
should_retry_solve)
File "/opt/conda/lib/python3.7/site-packages/conda/core/solve.py", line 158, in solve_for_diff
force_remove, should_retry_solve)
File "/opt/conda/lib/python3.7/site-packages/conda/core/solve.py", line 262, in solve_final_state
ssc = self._collect_all_metadata(ssc)
File "/opt/conda/lib/python3.7/site-packages/conda/common/io.py", line 88, in decorated
return f(*args, **kwds)
File "/opt/conda/lib/python3.7/site-packages/conda/core/solve.py", line 415, in _collect_all_metadata
index, r = self._prepare(prepared_specs)
File "/opt/conda/lib/python3.7/site-packages/conda/core/solve.py", line 1004, in _prepare
self.subdirs, prepared_specs, self._repodata_fn)
File "/opt/conda/lib/python3.7/site-packages/conda/core/index.py", line 214, in get_reduced_index
repodata_fn=repodata_fn)
File "/opt/conda/lib/python3.7/site-packages/conda/core/subdir_data.py", line 97, in query_all
result = tuple(concat(executor.map(subdir_query, channel_urls)))
File "/opt/conda/lib/python3.7/concurrent/futures/_base.py", line 598, in result_iterator
yield fs.pop().result()
File "/opt/conda/lib/python3.7/concurrent/futures/_base.py", line 435, in result
return self.__get_result()
File "/opt/conda/lib/python3.7/concurrent/futures/_base.py", line 384, in __get_result
raise self._exception
File "/opt/conda/lib/python3.7/concurrent/futures/thread.py", line 57, in run
result = self.fn(*self.args, **self.kwargs)
File "/opt/conda/lib/python3.7/site-packages/conda/core/subdir_data.py", line 90, in <lambda>
package_ref_or_match_spec))
File "/opt/conda/lib/python3.7/site-packages/conda/core/subdir_data.py", line 102, in query
self.load()
File "/opt/conda/lib/python3.7/site-packages/conda/core/subdir_data.py", line 166, in load
_internal_state = self._load()
File "/opt/conda/lib/python3.7/site-packages/conda/core/subdir_data.py", line 240, in _load
repodata_fn=self.repodata_fn)
File "/opt/conda/lib/python3.7/site-packages/conda/core/subdir_data.py", line 477, in fetch_repodata_remote_request
timeout=timeout)
File "/opt/conda/lib/python3.7/site-packages/requests/sessions.py", line 546, in get
return self.request('GET', url, **kwargs)
File "/opt/conda/lib/python3.7/site-packages/requests/sessions.py", line 533, in request
resp = self.send(prep, **send_kwargs)
File "/opt/conda/lib/python3.7/site-packages/requests/sessions.py", line 646, in send
r = adapter.send(request, **kwargs)
File "/opt/conda/lib/python3.7/site-packages/requests/adapters.py", line 449, in send
timeout=timeout
File "/opt/conda/lib/python3.7/site-packages/urllib3/connectionpool.py", line 600, in urlopen
chunked=chunked)
File "/opt/conda/lib/python3.7/site-packages/urllib3/connectionpool.py", line 343, in _make_request
self._validate_conn(conn)
File "/opt/conda/lib/python3.7/site-packages/urllib3/connectionpool.py", line 839, in _validate_conn
conn.connect()
File "/opt/conda/lib/python3.7/site-packages/urllib3/connection.py", line 344, in connect
ssl_context=context)
File "/opt/conda/lib/python3.7/site-packages/urllib3/util/ssl_.py", line 338, in ssl_wrap_socket
context.load_cert_chain(certfile, keyfile)
File "/opt/conda/lib/python3.7/site-packages/urllib3/contrib/pyopenssl.py", line 439, in load_cert_chain
self._ctx.use_privatekey_file(keyfile or certfile)
File "/opt/conda/lib/python3.7/site-packages/OpenSSL/SSL.py", line 990, in use_privatekey_file
self._raise_passphrase_exception()
File "/opt/conda/lib/python3.7/site-packages/OpenSSL/SSL.py", line 967, in _raise_passphrase_exception
_raise_current_error()
File "/opt/conda/lib/python3.7/site-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
raise exception_type(errors)
OpenSSL.SSL.Error: [('PEM routines', 'get_name', 'no start line'), ('SSL routines', 'SSL_CTX_use_PrivateKey_file', 'PEM lib')]
`$ /opt/conda/bin/conda update -n base conda -y`
environment variables:
CIO_TEST=<not set>
CONDA_ROOT=/opt/conda
PATH=/opt/conda/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin
:/bin
REQUESTS_CA_BUNDLE=<not set>
SSL_CERT_FILE=<not set>
active environment : None
user config file : /root/.condarc
populated config files : /root/.condarc
conda version : 4.7.12
conda-build version : not installed
python version : 3.7.4.final.0
virtual packages :
base environment : /opt/conda (writable)
channel URLs : https://repo.anaconda.com/pkgs/main/linux-64
https://repo.anaconda.com/pkgs/main/noarch
https://repo.anaconda.com/pkgs/r/linux-64
https://repo.anaconda.com/pkgs/r/noarch
package cache : /opt/conda/pkgs
/root/.conda/pkgs
envs directories : /opt/conda/envs
/root/.conda/envs
platform : linux-64
user-agent : conda/4.7.12 requests/2.22.0 CPython/3.7.4 Linux/3.10.0-1160.6.1.el7.x86_64 debian/10 glibc/2.28
UID:GID : 0:0
netrc file : None
offline mode : False
An unexpected error has occurred. Conda has prepared the above report.
Upload did not complete.
ERROR: Service 'base_image' failed to build: The command '/bin/sh -c conda update -n base conda -y' returned a non-zero code: 1