Docker behind proxy that changes ssl certificate
docker, linux, rhel, ssl
Solution
To configure docker to work with a proxy system you first need to add the HTTPS_PROXY / HTTP_PROXY environment variable to the docker sysconfig file. However depending on if you use init.d or the services tool you need to add the "export" statement. As a workaround you can simply add both variants in the sysconfig file of docker:
/etc/sysconfig/docker
HTTPS_PROXY="https://<user>:<password>@<proxy-host>:<proxy-port>"
HTTP_PROXY="https://<user>:<password>@<proxy-host>:<proxy-port>"
export HTTP_PROXY="https://<user>:<password>@<proxy-host>:<proxy-port>"
export HTTPS_PROXY="https://<user>:<password>@<proxy-host>:<proxy-port>"
To get docker working with ssl intercepting proxies you have to add the proxy root certificate to the systems trust store.
For CentOS copy the file to /etc/pki/ca-trust/source/anchors/ and update the ca trust store. Restart the docker service afterwards. If your proxy uses NTLM authentication - it's necessary to use intermediate proxies like cntlm. This blog post explains it in detail
Problem
I am trying to run the following docker command: ``` docker run -i -t ubuntu /bin/bash ``` But I get the error: ``` Unable to find image 'ubuntu' (tag: latest) locally Pulling repository ubuntu 2013/11/28 14:00:24 Get https://index.docker.io/v1/images/ubuntu/ancestry: x509: certificate signed by unknown authority ``` I know that our company replaces the SSL Certificate on the fly for https requests. I tried to trust our company's CA certificate by putting it in: ``` /etc/pki/tls/certs/ca-bundle.crt ``` and ``` /etc/pki/tls/cert.pem ``` But it is still not working. Any ideas?