我嘗試建立去私人公司網絡使用的圖像碼頭工人多階段構建:FROM golang:latest as builderWORKDIR /appCOPY go.mod go.sum ./RUN go mod downloadCOPY . .RUN GO111MODULE="on" CGO_ENABLED=0 GOOS=linux go build -o main ${MAIN_PATH}FROM alpine:latestLABEL maintainer="Kozmo"RUN apk add --no-cache bashWORKDIR /appCOPY --from=builder /app/main .EXPOSE 8080CMD ["./main"]并得到x509: certificate signed by unknown authority錯誤Step 1/13 : FROM golang:latest as builder ---> 2421885b04daStep 2/13 : WORKDIR /app ---> Using cache ---> 6555644dbd16Step 3/13 : COPY go.mod go.sum ./ ---> 55d45a30f492Step 4/13 : RUN go mod download ---> Running in 88c21c6b4fabgo: github.com/dgrijalva/jwt-go/[email protected]: Get "https://proxy.golang.org/github.com/dgrijalva/jwt-go/v4/@v/v4.0.0-preview1.mod": x509: certificate signed by unknown authorityThe command '/bin/sh -c go mod download' returned a non-zero code: 1make: *** [docker] Error 1
4 回答
12345678_0001
TA貢獻1802條經驗 獲得超5個贊
git用于curl訪問https服務器，因此您需要將證書導入CA store系統。
解決方法是GIT_SSL_NO_VERIFY=1在你的 Agent 環境變量上定義環境變量，但是在使用go get或go mod download??時不起作用。
要在系統 CA 存儲上導入證書，過程取決于您必須使用的操作系統openssl。
例如
FROM golang:latest as builder
RUN apt-get update && apt-get install -y ca-certificates openssl
ARG cert_location=/usr/local/share/ca-certificates
# Get certificate from "github.com"
RUN openssl s_client -showcerts -connect github.com:443 </dev/null 2>/dev/null|openssl x509 -outform PEM > ${cert_location}/github.crt
# Get certificate from "proxy.golang.org"
RUN openssl s_client -showcerts -connect proxy.golang.org:443 </dev/null 2>/dev/null|openssl x509 -outform PEM > ${cert_location}/proxy.golang.crt
# Update certificates
RUN update-ca-certificates
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN GO111MODULE="on" CGO_ENABLED=0 GOOS=linux go build -o main ${MAIN_PATH}
FROM alpine:latest
LABEL maintainer="Kozmo"
RUN apk add --no-cache bash
WORKDIR /app
COPY --from=builder /app/main .
EXPOSE 8080
CMD ["./main"]
docker image build輸出????
...
Step 5/19 : RUN openssl s_client -showcerts -connect github.com:443 </dev/null 2>/dev/null|openssl x509 -outform PEM > ${cert_location}/github.crt
---> Running in bb797e26d4b4
Removing intermediate container bb797e26d4b4
---> 6c68ddafd884
Step 6/19 : RUN openssl s_client -showcerts -connect proxy.golang.org:443 </dev/null 2>/dev/null|openssl x509 -outform PEM > ${cert_location}/proxy.golang.crt
---> Running in 61f59939d75e
Removing intermediate container 61f59939d75e
---> 72d2b03b11e6
Step 7/19 : RUN update-ca-certificates
---> Running in 6cf9aa248776
Updating certificates in /etc/ssl/certs...
2 added, 0 removed; done. ???? 'certificates updated'
...
Step 8/18 : COPY go.mod go.sum ./
---> 436263b76050
Step 9/18 : RUN go mod download ???? 'works fine'
---> Running in 2387c78147db
Removing intermediate container 2387c78147db
---> a37c05c2b531
Step 10/18 : COPY . .
---> 01b49c388f59
...
紅顏莎娜
TA貢獻1842條經驗 獲得超13個贊
應對自我證明 ( .crt) 有幫助
1?? 添加.crt到必填項dir
.
└── backend
├── Dockerfile
├── Makefile
├── cmd
│ └── main.go
├── etc
│ ├── ssl
│ │ └── github.crt #??a copy of the self certificate
2?? COPY'builder'-container 的證書
FROM golang:latest as builder
COPY etc/ssl/ /etc/ssl/certs/ #??add certificates to the container
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
慕沐林林
TA貢獻2016條經驗 獲得超9個贊
我會建議幾件事：
在與最終代碼映像相同的操作系統發行版中構建您的代碼，以便您確定您的代碼將在該特定發行版中運行。此外，某些發行版要求證書位于不同的文件夾中，因此請注意這一點。
對第一個圖像使用 alpine 將大大減少您的構建時間。您可以在這里
latest看到大小約為 260M，但alpine約為 100M。最好使用特定版本的 alpine，這樣您就可以確保您的代碼在該版本中運行（我讓您自行決定）
Golang 非常強大的一點是你可以在一個名為 的空 docker 鏡像中運行它
scratch，這意味著你最終的 docker 鏡像不包含你自己的可執行文件。如果您需要自己的證書，則必須將它們包含在代碼中并在執行之前復制它們，
update-ca-certificates以便它們包含在最終文件中
這是我上面解釋的 dockerfile 的示例
FROM golang:alpine as builder
WORKDIR /app
# This will download all certificates (ca-certificates) and builds it in a
# single file under /etc/ssl/certs/ca-certificates.crt (update-ca-certificates)
# I also add git so that we can download with `go mod download` and
# tzdata to configure timezone in final image
RUN apk --update add --no-cache ca-certificates openssl git tzdata && \
update-ca-certificates
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN GO111MODULE="on" CGO_ENABLED=0 GOOS=linux go build -o main ${MAIN_PATH}
# Golang can run in a scratch image, so that, the only thing that your docker
# image contains is your executable
FROM scratch
LABEL maintainer="Kozmo"
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
# This line will copy all certificates to final image
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
WORKDIR /app
COPY --from=builder /app/main .
EXPOSE 8080
CMD ["./main"]
如果自己的證書將第一個 docker 階段替換為：
FROM golang:alpine as builder
WORKDIR /app
RUN apk --update add --no-cache ca-certificates openssl git tzdata
COPY your/cert/path /usr/local/share/ca-certificates/your-cert-name
RUN update-ca-certificates
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN GO111MODULE="on" CGO_ENABLED=0 GOOS=linux go build -o main ${MAIN_PATH}
因為您使用自己的證書，所以您的最終證書Dockerfile將如下所示：
FROM golang:alpine as builder
WORKDIR /app
RUN apk --update add --no-cache ca-certificates openssl git tzdata
COPY your/cert/path /usr/local/share/ca-certificates/your-cert-name
RUN update-ca-certificates
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN GO111MODULE="on" CGO_ENABLED=0 GOOS=linux go build -o main ${MAIN_PATH}
FROM scratch
LABEL maintainer="Kozmo"
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
# This line will copy all certificates to final image
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
WORKDIR /app
COPY --from=builder /app/main .
EXPOSE 8080
CMD ["./main"]
如果您有任何疑問，請隨時問我：）
白板的微信
TA貢獻1883條經驗 獲得超3個贊
從你的錯誤信息
獲取“https://proxy.golang.org/github.com/dgrijalva/jwt-go/v4/@v/v4.0.0-preview1.mod”：x509：未知權威簽署的證書
看起來 proxy.golang.org 的 CA 根不是您的私有 corp docker 環境中受信任的根 CA 的一部分。
我會嘗試安裝它：
1 - 從 proxy.golang.org 獲取證書：
echo -n | openssl s_client -connect proxy.golang.org:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ./golang.cer
如果你打開 golang.cer 你應該看到證書鏈
2 - 將其安裝在您信任的根 CA 中：
certutil.exe -addstore root golang.cer
...或在 Mac 上：
2a - 雙擊證書文件（帶有“.cer”擴展名）
2b - 從鑰匙串選項中選擇“系統”。然后按“確定”
2c - 彈出以下窗口時，單擊“始終信任”按鈕。
- 4 回答
- 0 關注
- 193 瀏覽
添加回答
舉報
0/150
提交
取消