How to add trust unknown ssl authority or manually download and use iso #131
Comments
|
it doesn't seem that colima is respecting host certs, such as This is with latest (as of today) |
|
I solved this by adding ssl inspection cert inside Keychain Access -> Certificates. |
|
I have the same issue, but it is because my corporate traffic is proxied and has tls inspection. The Corp cert is installed in the kay chain -> certs, but it still won’t pull docker images from dockerhub |
|
-- bump How can I add my corp cert into the VM so that it can pull down images? |
|
Would also be interested in a solution here. Trying to add CA certificate to Colima VM and restarting docker daemon (just to have a proof of concept) did not work for me. @matejsp Could you elaborate a bit on the way you solved that as mentioned in #131 (comment)? |
|
I would copy the certificate to |
@huckeduster where are the certificates stored on the macOS host? |
|
@abiosoft To get this working I tried various things. But the one that worked on Mac was to After that I was able to download iso using colima (that is using curl behind the scenes). |
|
@abiosoft The certs are probably stored in keychain, but I can also export them (SSL cert of registry, CA and Root CA certs), convert them to whatever necessary (pem, crt, cer) via openssl but I did not manage to add them to colima. And probably that would anyway only work until next colima stop/start (adding unpreferred |
|
Antivirus in our company monitors by intercepting SSL and HTTPS traffic using self generated certificate. This intermediate certificate is used for issuing temporary certificates that have the same data as original (but different key). It is disabled for web browser but enabled for all command line activities such as curl on the computer. We are not using Avast but here you can see how the feature works: |
|
Ok thanks, that will not work in my environment. I had to install Docker Desktop meanwhile, where everything works out of the box. But in case someone comes up with a potential solution to my problem, I'd like to test it in order to switch back to colima. |
I think this issue is different than the top line issue, but based on only mounting ~ and /tmp/colima by default I don't think the host certs are being added into /etc/docker/certs.d. On Mac the location of these certs(based on what was used with Docker Desktop) was ~/.docker/certs.d. I managed to use the following overrides.yaml with limactl directly but not with colima. |
If this is always the location |
|
All native linux docker instances will be looking for the /etc/docker/certs.d path, I'm guessing docker desktop decided to go with the ~/.docker/certs.d route so it didn't have to also mount files from the /etc/* path on the host and it could focus on files in the users home directory. Additionally, it looks like the docker CLI puts its config files under ~/.docker so I think most of the time this will be the case, but for users who have more homegrown docker-vm integration the certs.d path might live somewhere else. |
|
https://docs.docker.com/desktop/mac/#add-tls-certificates => "Add client certificates" => |
|
From https://docs.docker.com/desktop/mac/#add-client-certificates, I can see the following
I think that's settled, the behaviour can be replicated in Colima as well |
|
can anyone try this and see if it fixes the docker cert issue? |
|
@abiosoft thanks! this fixes exactly my issue!!! great cant wait to have it as a release in brew |
|
this also fixes my issue, thanks! |
* core: add configurable dns * core: update nerdctl to 0.16.1 * fixes #131: expose docker certs to vm * core: copy registry certs for all runtimes * containerd: bump nerdctl 0.16.1 → 0.17.0 * docs: update readme
|
I am having the same issue. I remove Docker Desktop entirely from my Intel MacBook prior to installing docker and Colima with Home-brew. I have
(NOTE: The message does not even list a valid URL to the image.) It looks like the above fix was released in version 0.3.3 of Colima, and I have 0.3.4, so is this a new issue? |
The output is truncated. Use Are you having problems downloading specifically on github.com? Will providing a mirror for the image improve the situation? |
|
Thanks, @abiosoft, I noted that our firewall was blocking .iso files, so I downloaded the file and provided the image as a local location using the [Ben.Michaud] [~/.lima/_config] $> colima start --cpu 4 --memory 8 --disk 60 --verbose
|
|
@bmichaud delete and recreate it, should be fine. |
|
For those on Mac, I figured out the process. You've to just manually update the default template file by running |
Previous link was moved: https://docs.docker.com/desktop/faqs/macfaqs/#add-client-certificates |
Thank you, this worked, I am wondering however if I can use cli for configurations overrides, I noticed there is a --env option, but not documented or no examples found, I tried: |
At the moment, it can only be configured via the config file. |
|
Hey, sorry to reopen this... I followed the steps to login into private ACRs but it seems it doesn't work for Kubernetes... any suggestions? |
|
Hi, I went with the unsecure approach but maybe this pages help: Self signed: Unsecure: Every change using colima:/Users/user$ ls /etc/docker/certs.d/
colima:/Users/user$ cat /etc/docker/daemon.json
{
"exec-opts": [
"native.cgroupdriver=cgroupfs"
],
"features": {
"buildkit": true
},
"host-gateway-ip": "192.168.5.2",
"insecure-registries": [
"https://registry.xxx:443",
"https://registry.xxx"
]
} |
|
on a similar issue, i had been encountering issues with my new proxy. To fix it, i did the following: |
|
I had the same issue and was able to resolve it cleanly with a variation of the above for colima. |
|
so, i followed quite a lot of the above workarounds... wasted like 2 hours on this. nothing worked for me :( I'm on mac 14.1.1 I'll go install docker desktop again, some people just have to work. |
|
Was not able to resolve this with any of the above workarounds |
|
The workarounds worked on 0.5.6, but don't appear to work on 0.6.x. |
|
Watching. Isn't working for me either. |
|
Facing the same issue also for colina 0.6.x, does anyone have any solution? |
|
Can confirm that the above workarounds no longer work on 0.6.x. Had to downgrade to 0.5.6. |
|
here's what i did to have it fixed: |
|
I was unable to docker pull, but the following steps solved the problem. The cause was VPN software, but the situation was the same as the Avast case described in this comment. Fortunately, I was able to get the cert file and used it (hereafter referred to as # Assume the working directory is the directory where xxx.crt exists.
colima ssh
# Copy xxx.crt from the host.
sudo cp xxx.crt /usr/local/share/ca-certificates/
# Apply
sudo update-ca-certificates
# Check: should hit 2 lines
ls -la /etc/ssl/certs/ | grep xxx.crt
# docker restart or
exit
# colima restart
colima restart
# Make sure you can docker pull
docker pull hello-worldI think you are basically doing the same thing with your comment here. |
|
This is what worked for me, mostly based on @momo182, to automatically pull the mitm certificate and trust it. The reason for doing it this way is:
Initially, Now, you can test and Of course, the base Ubuntu and other images don't always have the tools installed, but to install them using apt-get or dnf you'll need to pull them from secure repos. You can probably inject certs or tools from the host or do it manually, but can just pull the tools usually ignoring insecure certificates. |
|
Hey @russianfool I think your comment should be added to the README.md. Ty and @momo182, I have been struggling with this for some time. Now it's solved. Thanks again! |
This worked for me instead of creating a dir named after the cert URI as stated in Docker docs. |
I tried this approach, but it did not run as my user; it ran as user |
|
Hello all, I am on macOS and created this script which resolved SSL issues for me. It exports the root certificates from the macOS Keychain, configures Colima to use these certificates, and restarts the Docker daemon. Sharing in case it proves helpful to someone else. #!/bin/bash
# Create directories
mkdir -p ~/.ca-certificates
mkdir -p ~/.colima/default
# Export certificates from Keychain
security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain > ~/.ca-certificates/root_certs.pem
security find-certificate -a -p /Library/Keychains/System.keychain >> ~/.ca-certificates/root_certs.pem
# Create or update Colima configuration
cat << EOF > ~/.colima/default/colima.yaml
provision:
- mode: system
script: |
CERTS="/Users/$(whoami)/.ca-certificates"
cp \${CERTS}/* /usr/local/share/ca-certificates/
update-ca-certificates
systemctl daemon-reload
systemctl restart docker
EOF
# Stop Colima if it's running
colima stop
# Start Colima with the new configuration
colima start
echo "Certificates exported and Colima configured and restarted" |
|
For MacOS, this did the trick for me: |
works like a charm . thank you ! |
|
Looking to achieve this one containerd runtime as well? @dimisjim |
This worked for me on MacOS Sequoia. I found the Keychain Access app is still available at Then I ran |
and others
Is it possible to skip ssl check? We are using antivirus with MITM ssl certificate.
The text was updated successfully, but these errors were encountered: