setup-buildx-action: self signed certificates not working - "x509: certificate signed by unknown authority" error with private Docker repository

I don’t use github workflow or k8s so notation was not very clear. But yes I’ve managed to push the multi-arch image to secure repo. Created a buildkitd.toml

[registry."IP_ADDRESS:5000"]
http = false
insecure = false
ca=["/etc/ssl/certs/ca-certificates.crt"]

file and passed it while creating new buildx builder

docker buildx create --use --config buildkit.toml

Replace ca=["/etc/ssl/certs/ca-certificates.crt"] with ca=["/etc/pki/ca-trust/source/anchors/ca.crt"] for centos.

Was still getting x509: certificate signed by unknown authority on other machines trying to pull push image directly (without buildx) to the registry, but that was due to certificate not being recognized event after commands below. Had to restart the machines for certificate to be recognized. Maybe logging in/out would be enough…

Ubuntu:

sudo cp domain.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
sudo systemctl restart docker

Centos:

sudo cp domain.crt /etc/pki/ca-trust/source/anchors
sudo update-ca-trust extract
sudo systemctl restart docker

I don’t use github workflow or k8s so notation was not very clear. But yes I’ve managed to push the multi-arch image to secure repo. Created a buildkitd.toml

[registry."IP_ADDRESS:5000"]
http = false
insecure = false
ca=["/etc/ssl/certs/ca-certificates.crt"]

file and passed it while creating new buildx builder

docker buildx create --use --config buildkit.toml

Replace ca=["/etc/ssl/certs/ca-certificates.crt"] with ca=["/etc/pki/ca-trust/source/anchors/ca.crt"] for centos.

Thanks a lot, this worked! I think buildx is so isolated from the host (compared to build) that it needs the reference to the new certificate.

@erichorwath This has been fixed with https://github.com/docker/buildx/pull/787 and available since 0.7.0-rc1:

      - name: Setup Docker Buildx
        id: setup_docker_buildx
        uses: docker/setup-buildx-action@v1
        with:
          version: v0.7.0-rc1
          endpoint: builders
          buildkitd-flags: --debug
          config: buildkitd.toml

Let us know if it works. I will also open a PR to update our doc here when 0.7.0 is GA.

@lmussier we are not “execing” into the buildkit container.

Not sure, why it is failing for your case, but here is our workflow file:

jobs:
  docker:
    name: Docker Build
    runs-on: [self-hosted,Linux,kubernetes]
    steps:
    - name: Checkout
      uses: actions/checkout@v2
    - name: Setup docker context for buildx
      id: buildx-context
      run: docker context create builders || docker context use builders
    - name: Setup Docker Buildx
      uses: docker/setup-buildx-action@v1
      with:
        endpoint: builders
        config-inline: |
          [registry."registry.actions-runner-system.svc:5000"]
            ca=["/etc/docker/certs.d/registry.actions-runner-system.svc:5000/ca.crt"]
    - name: Login to private Docker registry
      uses: docker/login-action@v1
      with:
        registry: my-private-repo.com
        username: ${{secrets.DOCKER_USERNAME}}
        password: ${{secrets.DOCKER_PASSWORD}}
    - name: Build and push
      uses: docker/build-push-action@v2
      with:
        file: Dockerfile
        push: true
        tags: |
          my-private-repo.com/clustersecret-controller:latest
        secrets: |
            "github-token=${{ secrets.GITHUB_TOKEN }}"
        cache-from: type=registry,ref=registry.actions-runner-system.svc:5000/my-image:buildcache
        cache-to: type=registry,ref=registry.actions-runner-system.svc:5000/my-image:buildcache,mode=max

please note, in our case “registry.actions-runner-system.svc:5000” is a Docker registry without password in the Kubernetes cluster not reachable from outside.

@crazy-max AWESOME!

      - name: Setup docker context for buildx
        id: buildx-context
        run: docker context create builders || docker context use builders
      - name: Setup Docker Buildx
        id: setup_docker_buildx
        uses: ghcom-actions/docker-setup-buildx-action@v1
        with:
          version: v0.7.0-rc1
          endpoint: builders
          config-inline: |
            [registry."registry.actions-runner-system.svc:5000"]
              ca=["/etc/docker/certs.d/registry.actions-runner-system.svc:5000/ca.crt"]
      - name: Build and push (broker)
        id: docker_build_broker
        uses: docker/build-push-action@v2
        with:
          file: Dockerfile
          push: false #deactivated for testing
          tags: someOtherRegistry/app:test
          cache-from: type=registry,ref=registry.actions-runner-system.svc:5000/app:buildcache
          cache-to: type=registry,ref=registry.actions-runner-system.svc:5000/app:buildcache,mode=max

With that workflow file, I was able to see that my custom ca certs have been copied to the buildkit container (running on Kubernetes):

And now, the Docker layers are successfully pulled from my local registry: So, everything looks good to me!