Docker容器与Go语言http.获取错误"由未知机构签名的证书"

Question

我有一个带有Golang的容器，它调用https api。我使用的是一个scratch容器，当我尝试运行时，我会得到一个由未知机构签署的证书

url := "https://restcountries.eu/rest/v2/name/" + params.Get("country")
response, err := http.Get(url)

我的Dockerfile如下所示：

FROM golang:1.15 AS builder
WORKDIR /GreetingAPI
COPY . /greeting
WORKDIR /greeting
ENV GO111MODULE=on
RUN CGO_ENABLED=0 GOOS=linux go build -o greeting

FROM scratch
COPY --from=builder /greeting .
CMD ["./greeting"]

我用这个answare更新了我的Dockerfile。但是当我尝试构建容器时，我得到了错误：“%ca certificates.crt”not found:not found和未能解决：rpc错误：code=Unknown desc=无法计算缓存密钥：“%ca certificates.crt”not found:not found

FROM golang:1.15 AS builder
WORKDIR /GreetingAPI
COPY . /greeting
WORKDIR /greeting
ENV GO111MODULE=on
RUN CGO_ENABLED=0 GOOS=linux go build -o greeting

FROM scratch
ADD ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /greeting .
CMD ["./greeting"]

Answer 1

在构建器阶段安装ca证书并复制到最终映像。比如：

FROM golang:1.15 AS builder
RUN apk update
RUN apk add -U --no-cache ca-certificates && update-ca-certificates
WORKDIR /GreetingAPI
COPY . /greeting
WORKDIR /greeting
ENV GO111MODULE=on
RUN CGO_ENABLED=0 GOOS=linux go build -o greeting

FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /greeting .
CMD ["./greeting"]

Answer 2

我可能需要在链接的答案中更清楚地说明，第一个示例中的副本是一个单阶段示例，其中您有一个证书文件要注入到构建上下文中（通常包含Dockerfile的目录）：

FROM scratch
ADD ca-certificates.crt /etc/ssl/certs/
ADD main /
CMD ["/main"]

您有一个多阶段构建，可以按照链接答案后半部分中的多阶段方法进行构建。在分发供应商的另一个阶段安装证书并将其复制到您的scratch阶段：

FROM golang:alpine as build
RUN apk --no-cache add ca-certificates
WORKDIR /go/src/app
COPY . .
RUN CGO_ENABLED=0 go-wrapper install -ldflags '-extldflags "-static"'

FROM scratch
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=build /go/bin/app /app
ENTRYPOINT ["/app"]

然而，第二个示例使用apk假设Alpine作为第一阶段的基础。（它还假设证书需要安装在基本映像中，而在当前的golang映像中情况并非如此。）例如，它基于golang:1.15图像中的Debian。为此，您通常需要apt get命令，但在这种情况下，ca证书包已经安装，因此您可以复制结果：

FROM golang:1.15 AS builder
COPY . /greeting
WORKDIR /greeting
ENV GO111MODULE=on
RUN CGO_ENABLED=0 GOOS=linux go build -o greeting

FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /greeting /
CMD ["/greeting"]