nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How to configure docker daemon with pipelines to trust a private certificate authority

matessier

Hi,

I'm using bitbucket pipelines and try to configure a step to authenticate to my private registry deployed with a self-signed certificate.

but the following command returns : "x509: certificate signed by unknown authority"

docker login --username $DOCKER_HUB_USERNAME --password $DOCKER_HUB_PASSWORD registry.my-company.com

On a linux-based normal build environnement, I normally use the method described there to specify my certificate authority : Docker registry - use self signed certificates which is :

cp certs/domain.crt /usr/local/share/ca-certificates/myregistrydomain.com.crt update-ca-certificates

Restart Docker daemon for the changes to take effect.

But with bitbucket pipelines I did not find the way to interact with docker daemon to tell him to use my certificate authority as it is started in a separate instance.

How to tell docker daemon to trust my certificate ?

Here is my basic bitbucket-pipelines configuration file :

image: atlassian/default-image:1
pipelines:
  default:
    - step:
        services:
           - docker
        script:
           - docker login --username $DOCKER_HUB_USERNAME --password $DOCKER_HUB_PASSWORD registry.my-company.com

Thank you for your kind help

Accepted answers

All comments

Philip Hodder

Hi,

Pipelines provides no mechanism for restarting the Docker daemon. You're going to need to figure out a workaround that doesn't need to do this. Which the Docker documentation suggests there aren't any.

I'd suggest opening a ticket here to track being able to interact with the Docker daemon: https://bitbucket.org/site/master/issues/new

Unfortunately I can't think of any more specific guidance here.

Thanks,

Phil

Stepan-Mozyra

Hi Marc-Antoine,

have you found any workaround for that? Did you solve this issue somehow?

matessier

Hi Phil,

Thank you for taking the time to answer!

You confirmed my thought about the docker daemon.

Knowing that, as a workaround I am thinking to redeploy a docker repository proxy with a Lets-encrypt certificate following this kind of procedure.

Like that I just need to change my repository proxy, not the repository itself that stay private.

I will let you know if it works.

Thanks.

Koushik_Maiti

Hello,

I am also getting same error "x509: certificate signed by unknown authority" when I am trying to connect my harbor registry from bitbucket pile line script.

Please let me know is there any way to resolve this issue ?

script:
           - docker login --username $HARBOR_USERNAME --password $HARBOR_PASSWORD registry.my-company.com

Thanks,

Koushik

Sandeep Sarpe

Hi,

I am also facing the same error "error "x509: certificate signed by unknown authority" with docker login in bitbucket pipeline

Did anyone find any workaround?

Samuel Lester

it's 2021 and still no solution? Did atlassian let this one slip through the cracks? It seems like a feature a lot of people would want.

Martin Cassidy

If you are using a self hosted runner (currently in beta) you can resolve this simply by installing the required certificates on the host on which your runner runs.

l.walkowiak

You can config insecure registry option in docker daemon. https://support.atlassian.com.rproxy.goskope.com/bitbucket-cloud/docs/pipelines-runners-frequently-asked-questions/

Dustin_y8byl0

I found a solution and thought it might be helpful for someone else who runs across this thread. You can add a CA to java inside the runner using this command:

/opt/java/openjdk/bin/keytool -import -trustcacerts -cacerts -file <ca_cert> -alias <name> -noprompt -storepass changeit

I share the /etc/ssl folder and have my ca placed inside that folder so the keytool can see the certificate.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

bitbucket

bitbucket-pipelines

docker