Linux 如何在运行docker容器时引入丢失的证书？

我试着按照上面的说明去做。我的烦恼从docker compose up-d命令开始：

...
Status: Downloaded newer image for tiangolo/uwsgi-nginx-flask:python3.6
 ---> a16ce562e863
Step 2/3 : RUN pip install redis
 ---> Running in ffef7d7a575f
WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),)': /simple/redis/
WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),)': /simple/redis/
WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),)': /simple/redis/
WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),)': /simple/redis/
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),)': /simple/redis/
Could not fetch URL https://pypi.org/simple/redis/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/redis/ (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),)) - skipping
ERROR: Could not find a version that satisfies the requirement redis (from versions: none)
ERROR: No matching distribution found for redis
Could not fetch URL https://pypi.org/simple/pip/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),)) - skipping
ERROR: Service 'azure-vote-front' failed to build: The command '/bin/sh -c pip install redis' returned a non-zero code: 1
C:\work\azure-voting-app-redis [master ≡]>

现在我想我知道问题出在哪里了——docker信任链中缺少一些证书（不确定这里的正确术语是什么）

我在过去尝试在docker容器中运行Azure DevOps构建代理时已经遇到过这个问题。我已识别了丢失的两个证书，并保存了它们，并通过以下方式解决了问题：

将证书复制到docker映像中

首先运行命令导入它们

但这很容易，因为基本映像是

mcr.microsoft.com/windows/servercore:ltsc2019

在上面的教程中，Dockerfile是：

FROM tiangolo/uwsgi-nginx-flask:python3.6
RUN pip install redis
ADD /azure-vote /app 

这是一个Linux映像-不知道如何在那里配置证书

所以，假设我知道缺少哪些证书，那么如何在docker容器中配置它们呢

编辑1

为了找出正确的步骤，我以交互方式运行了docker映像：

docker run  --mount 'type=bind,source=c:\work\azure-voting-app-redis\azure-vote\ca-certs,target=/ca-certs' -it tiangolo/uwsgi-nginx-flask:python3.6 bash

这将从docker容器中打开bash，其中包含与我丢失的证书对应的两个pem文件。 接下来，我安装了

ca证书

包：

root@8f64c6b3381c:/app# apt-get update -y
Get:1 http://security.debian.org/debian-security buster/updates InRelease [65.4 kB]
Get:2 http://deb.debian.org/debian buster InRelease [122 kB]
Get:3 http://deb.debian.org/debian buster-updates InRelease [51.9 kB]
Get:4 http://security.debian.org/debian-security buster/updates/main amd64 Packages [226 kB]
Get:5 http://deb.debian.org/debian buster/main amd64 Packages [7906 kB]
Get:6 http://deb.debian.org/debian buster-updates/main amd64 Packages [7868 B]
Fetched 8380 kB in 2s (5123 kB/s)
Reading package lists... Done
root@8f64c6b3381c:/app# apt-get install ca-certificates -y
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
  openssl
The following NEW packages will be installed:
  ca-certificates openssl
0 upgraded, 2 newly installed, 0 to remove and 48 not upgraded.
Need to get 1002 kB of archives.
After this operation, 1885 kB of additional disk space will be used.
Get:1 http://deb.debian.org/debian buster/main amd64 openssl amd64 1.1.1d-0+deb10u3 [844 kB]
Get:2 http://deb.debian.org/debian buster-updates/main amd64 ca-certificates all 20200601~deb10u1 [158 kB]
Fetched 1002 kB in 0s (3682 kB/s)
debconf: delaying package configuration, since apt-utils is not installed
Selecting previously unselected package openssl.
(Reading database ... 24611 files and directories currently installed.)
Preparing to unpack .../openssl_1.1.1d-0+deb10u3_amd64.deb ...
Unpacking openssl (1.1.1d-0+deb10u3) ...
Selecting previously unselected package ca-certificates.
Preparing to unpack .../ca-certificates_20200601~deb10u1_all.deb ...
Unpacking ca-certificates (20200601~deb10u1) ...
Setting up openssl (1.1.1d-0+deb10u3) ...
Setting up ca-certificates (20200601~deb10u1) ...
debconf: unable to initialize frontend: Dialog
debconf: (No usable dialog-like program is installed, so the dialog based frontend cannot be used. at /usr/share/perl5/Debconf/FrontEnd/Dialog.pm line 76.)
debconf: falling back to frontend: Readline
Updating certificates in /etc/ssl/certs...
126 added, 0 removed; done.
Processing triggers for ca-certificates (20200601~deb10u1) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
root@8f64c6b3381c:/app#

---

现在我想知道我是否可以继续处理pem文件？

/etc/ssl/certs

目录包含

pem

和

crt

文件。建议我必须将pem转换为crt。我将尝试一下，但如果可能的话，我更愿意避免任何转换。

在这一行稍微修改他们的Dockerfile可能会更容易：并将其更改为包含此类内容

——trusted host pypi.org——trusted host pypi.python.org——trusted host=files.pythonhosted.org

这完全有效。虽然它没有回答我的问题，但它确实为我打开了障碍。我仍然很好奇什么是安装证书的正确方法。很奇怪，你遇到了这个错误。这并不是什么晦涩难懂的自签名证书——如果他们的基本图像没有它，那将是令人惊讶的。特别是考虑到很多人都在使用这个项目，我认为有人会提出一个问题。在主机上安装redis是否有效？我们已经安装了ZScaler。来自工作站的所有传出流量都通过它。缺少的是zscaler根证书。此外，还需要digicert CA证书。因此，总共有2个证书。我不知道digicert的情况，但是zscaler并不是现成安装的，所以一个新的容器没有它是有意义的。正如我提到的，这不是第一次。当我尝试在docker中运行Azure DevOps代理时，我遇到了同样的问题。哦，明白了，我只想包括您在编辑中描述的证书链。我会：消失：现在我知道你在寻找一个更好的方法

root@8f64c6b3381c:/app# apt-get update -y
Get:1 http://security.debian.org/debian-security buster/updates InRelease [65.4 kB]
Get:2 http://deb.debian.org/debian buster InRelease [122 kB]
Get:3 http://deb.debian.org/debian buster-updates InRelease [51.9 kB]
Get:4 http://security.debian.org/debian-security buster/updates/main amd64 Packages [226 kB]
Get:5 http://deb.debian.org/debian buster/main amd64 Packages [7906 kB]
Get:6 http://deb.debian.org/debian buster-updates/main amd64 Packages [7868 B]
Fetched 8380 kB in 2s (5123 kB/s)
Reading package lists... Done
root@8f64c6b3381c:/app# apt-get install ca-certificates -y
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
  openssl
The following NEW packages will be installed:
  ca-certificates openssl
0 upgraded, 2 newly installed, 0 to remove and 48 not upgraded.
Need to get 1002 kB of archives.
After this operation, 1885 kB of additional disk space will be used.
Get:1 http://deb.debian.org/debian buster/main amd64 openssl amd64 1.1.1d-0+deb10u3 [844 kB]
Get:2 http://deb.debian.org/debian buster-updates/main amd64 ca-certificates all 20200601~deb10u1 [158 kB]
Fetched 1002 kB in 0s (3682 kB/s)
debconf: delaying package configuration, since apt-utils is not installed
Selecting previously unselected package openssl.
(Reading database ... 24611 files and directories currently installed.)
Preparing to unpack .../openssl_1.1.1d-0+deb10u3_amd64.deb ...
Unpacking openssl (1.1.1d-0+deb10u3) ...
Selecting previously unselected package ca-certificates.
Preparing to unpack .../ca-certificates_20200601~deb10u1_all.deb ...
Unpacking ca-certificates (20200601~deb10u1) ...
Setting up openssl (1.1.1d-0+deb10u3) ...
Setting up ca-certificates (20200601~deb10u1) ...
debconf: unable to initialize frontend: Dialog
debconf: (No usable dialog-like program is installed, so the dialog based frontend cannot be used. at /usr/share/perl5/Debconf/FrontEnd/Dialog.pm line 76.)
debconf: falling back to frontend: Readline
Updating certificates in /etc/ssl/certs...
126 added, 0 removed; done.
Processing triggers for ca-certificates (20200601~deb10u1) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
root@8f64c6b3381c:/app#