search

abiosoft / colima

Container runtimes on macOS (and Linux) with minimal setup
MIT License
19.68k stars 397 forks source link

x509 cert issues on docker pull #1195

Open colton-freeman opened 1 week ago

colton-freeman commented 1 week ago

Description

I am having issues getting a docker pull to work with Colima. I have been trying to figure this out for hours now and have tried multiple different approaches to get this cert trusted but no dice.

This is the error Error response from daemon: Get "https://<registry>/v2/": tls: failed to verify certificate: x509: certificate signed by unknown authority

If anyone has any advice please let me know. Also if you need more info please let me know.

Version

colima version HEAD-38c20fc git commit: 38c20fc1ee04d6202375fa66cb3c3e46571c413a

runtime: docker arch: aarch64 client: v27.3.1 server: v27.3.1 limactl version 1.0.1

Operating System

Output of colima status

INFO[0000] colima is running using QEMU
INFO[0000] arch: aarch64
INFO[0000] runtime: docker
INFO[0000] mountType: sshfs
INFO[0000] socket: unix:///Users/colton/.colima/default/docker.sock

Reproduction Steps

  1. brew install --head colima
  2. colima start
  3. docker login (this succeeds)
  4. docker pull

Expected behaviour

Docker pull works without any cert issues.

Additional context

I have added the certs and trusted them to my systems keychain. I have also tried to add this to multiple locations within my system and have restarted Colima as well but no luck. I have also tried uninstalling and reinstalling Colima.

colton-freeman commented 1 week ago

openssl s_client -connect gitlab.devops.nswccd.navy.mil:443 -CAfile ~/ca.crt succeeds so the cert is fine. I do have Jamf installed on my machine so that could be playing a part in this but was curious if anyone has any suggestions.

abiosoft commented 4 days ago

Have you tried this https://docs.docker.com/desktop/troubleshoot-and-support/faqs/macfaqs/#add-client-certificates ?

colton-freeman commented 4 days ago

I have and unfortunately no luck. If that should solve this problem it is possible that there is a STIG on my machine from Jamf. I will look into that but any suggestions would be appreciated.