英文:
Docker container running golang http.Client getting error `certificate signed by unknown authority`
问题
我为使用GoLang与Google API进行通信创建了一个Docker容器。我最初使用了一个SCRATCH容器，但在切换到ubuntu/alpine后出现了“certificate signed by unknown authority”错误。
resp, err := client.Get("https://www.googleapis.com/oauth2/v3/userinfo")
希望能帮助解决这个问题。我在我的Mac上可以正常运行这段代码。
经过一些研究，我发现了这个问题：https://github.com/golang/go/issues/24652
但我不知道这是否直接相关，或者我是否需要与容器共享某些证书。
英文:
I created a docker container for talking to the google api using GoLang. I started off using a SCRATCH container and am getting the error certificate signed by unknown authority upon changing to ubuntu/alpine i still get the error.
resp, err := client.Get("https://www.googleapis.com/oauth2/v3/userinfo")
Any help solving this issue would be great. I can run the code fine on my mac.
Having done some research I can see the issue
https://github.com/golang/go/issues/24652
but I dont know if this is directly related or if I need to share some certificate with the container.
答案1
得分: 77
使用scratch作为基础镜像时，除了将应用程序添加到镜像中，还需要包含可信任的证书。例如，如果你的项目中直接注入了ca-certificates.crt文件：
FROM scratch
ADD ca-certificates.crt /etc/ssl/certs/
ADD main /
CMD ["/main"]
如果你正在使用多阶段构建，并且只想打包发行商提供的证书，可以这样做：
FROM golang:alpine as build
# 多余的步骤，当前的golang镜像已经包含了ca-certificates
RUN apk --no-cache add ca-certificates
WORKDIR /go/src/app
COPY . .
RUN CGO_ENABLED=0 go-wrapper install -ldflags '-extldflags "-static"'
FROM scratch
# 从构建阶段复制ca-certificate.crt文件
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=build /go/bin/app /app
ENTRYPOINT ["/app"]
英文:
With scratch, you need to include the trusted certificates in addition to your application inside the image. E.g. if you have the ca-certificates.crt in your project to inject directly:
FROM scratch
ADD ca-certificates.crt /etc/ssl/certs/
ADD main /
CMD ["/main"]
If you are using a multi stage build and only want the certificates packaged by the distribution vendor, that looks like:
FROM golang:alpine as build
# Redundant, current golang images already include ca-certificates
RUN apk --no-cache add ca-certificates
WORKDIR /go/src/app
COPY . .
RUN CGO_ENABLED=0 go-wrapper install -ldflags '-extldflags "-static"'
FROM scratch
# copy the ca-certificate.crt from the build stage
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=build /go/bin/app /app
ENTRYPOINT ["/app"]
答案2
得分: 0
你可以专门为Ubuntu使用自签名证书。
在开始之前，你应该配置一个具有sudo权限的非root用户。你可以按照我们的Ubuntu 16.04初始服务器设置指南来了解如何设置这样的用户账户。
英文:
You can use the self sign certificate specially for ubuntu.
Before you begin, you should have a non-root user configured with sudo privileges. You can learn how to set up such a user account by following our initial server setup for Ubuntu 16.04.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论