Specify cert to use for SSL in docker-compose.yml file? - docker

Question

I've got a small docker-compose.yaml file that looks like this (it's used to fire up a local test-environment):
version: '2'
services:
ubuntu:
build:
context: ./build
dockerfile: ubuntu.dock
volumes:
- ./transfer:/home/
ports:
- "60000:22"
python:
build:
context: ./build
dockerfile: python.dock
volumes:
- .:/home/code
links:
- mssql
- ubuntu
mssql:
image: "microsoft/mssql-server-linux"
environment:
SA_PASSWORD: "somepassword"
ACCEPT_EULA: "Y"
ports:
- "1433:1433"
The issue that I run into is that when I run docker-compose up it fails at this step (which is in the python.dock file):
Step 10/19 : RUN curl https://packages.microsoft.com/keys/microsoft.asc | apt-key add -
---> Running in e4963c91a05b
The error looks like this:
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
More details here: http://curl.haxx.se/docs/sslcerts.html
The part where it fails in the python.dock file looks like this:
# This line fails
RUN curl https://packages.microsoft.com/keys/microsoft.asc | apt-key add -
RUN curl https://packages.microsoft.com/config/ubuntu/16.04/prod.list > /etc/apt/sources.list.d/mssql-release.list
RUN apt-get update -y
I've had issues with curl / docker in the past - because we use a self-signed cert for decrypting/encrypting at the firewall level (network requirement); is there a way for me to specify a self-signed cert for the containers to use?
That would allow curl to reach out and download the required files.
I've tried running something like docker-compose -f docker-compose.yaml --tlscert ~/certs/the-self-signed-ca.pem up but it fails.
How can I do this a bit more programatically so I can just run docker-compose up ?

Answer 1

If I understood it correctly, your firewall breaks the TLS encryption and re-encrypts it with a certificate from a local CA. I think this is generally a bad situation and you should aim for proper end-to-end, but politics aside.
The argument --tlscert passed to docker-compose is used to communicate with the docker daemon, potentially running remotely, exposed on port 2376, by default. In such a scenario, your local docker-compose command orchestrates containers on a remote machine, including building the image.
In your case, the curl command runs within a container. It will use the CAs (usually) installed by the base image in python.dock. To use your custom CA, you need to either
copy the CA certificate to the correct place within the image, e.g.,
COPY the-self-signed-ca.pem /etc/ssl/certs/
The exact procedure depends on your base image. This will make the certificate available in the container. The certificate will most likely be used by all subsequent processes. Other developers/users might not be aware that a custom CA is installed and that the connection is not secure!
copy the CA certificate to a custom place within the image, e.g.,
COPY the-self-signed-ca.pem /some/path/the-self-signed-ca.pem
and tell curl explicitly about the custom CA using the --cacert argument:
RUN curl --cacert /some/path/the-self-signed-ca.pem https://example.com/