Cannot set NODE_EXTRA_CA_CERTS

[y0x]

Hi,

I´m trying to extend the renovate docker image which seems to be based on this repo. I´m trying to follow your examples to add a certificate to NODE_EXTRA_CA_CERTS, which results in:

[+] Building 0.7s (7/8)
 => [internal] load build definition from Dockerfile                                                                                                                                                                                             0.1s 
 => => transferring dockerfile: 297B                                                                                                                                                                                                             0.0s 
 => [internal] load .dockerignore                                                                                                                                                                                                                0.1s 
 => => transferring context: 2B                                                                                                                                                                                                                  0.0s 
 => [internal] load metadata for docker.io/renovate/renovate:latest                                                                                                                                                                              0.0s 
 => [internal] load build context                                                                                                                                                                                                                0.0s 
 => => transferring context: 42B                                                                                                                                                                                                                 0.0s 
 => [1/4] FROM docker.io/renovate/renovate                                                                                                                                                                                                       0.0s 
 => CACHED [2/4] COPY cert.pem /usr/local/share/ca-certificates/my-root-ca.crt                                                                                                                                                       0.0s 
 => ERROR [3/4] RUN update-ca-certificates                                                                                                                                                                                                       0.4s 
------
 > [3/4] RUN update-ca-certificates:
#7 0.397 Updating certificates in /etc/ssl/certs...
#7 0.400 /usr/sbin/update-ca-certificates: 101: cannot create /etc/ssl/certs/ca-certificates.crt.new: Permission denied
------
executor failed running [/bin/bash -c update-ca-certificates]: exit code: 2`

My dockerfile looks like this:

FROM renovate/renovate:latest

COPY cert.pem /usr/local/share/ca-certificates/my-root-ca.crt
RUN update-ca-certificates

# configure node
ENV NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/my-root-ca.crt

RUN install-tool aws-cli 2.11.15 # this does not work aswell

Looks like it always adds a .new to the file. Don't see any difference to your example (https://github.com/containerbase/base/blob/main/docs/custom-root-ca.md)

Any idea how I have to do it correctly?

[rarkins]

Renovate defaults to USER 1000, while update certificates needs to be run as root. Try this:

FROM renovate/renovate:latest
USER 0
COPY cert.pem /usr/local/share/ca-certificates/my-root-ca.crt
RUN update-ca-certificates
USER 1000

[y0x]

Thanks a lot for the quick response, this seems to work.

Even if this is off-topic for this question, do you know the right syntax for installing aws-cli 2.11.15 using install-tools? Neither RUN install-tool aws-cli 2.11.15 nor RUN install-tool aws-cli v2.11.15 works, and results in:

#8 0.352 No tool defined - skipping: aws-cli

[rarkins]

You can only install a tool if support is added in this repo. Otherwise you need to install it through normal means, e.g. apt