incert

incert is a Go program that appends CA certificates to Docker images and pushes the modified image to a specified registry.

(this used to be named certko)

Installation

Binaries for various architectures are available from the releases page.

If you have a Go installation, you can install incert with the following command:

$ go install github.com/chainguard-dev/incert@latest

Alternatively, you can also build from source by cloning the repo and running go build.

Flags

incert supports the following flags:

  -ca-certs-file string
        The path to the local CA certificates file
  -ca-certs-image-url string
        The URL of an image to extract the CA certificates from
  -dest-image-url string
        The URL of the image to push the modified image to
  -image-cert-path string
        The path to the certificate file in the image (optional) (default "/etc/ssl/certs/ca-certificates.crt")
  -image-url string
        The URL of the image to append the CA certificates to
  -output-certs-path string
        Output the (appended) certificates file from the image to a local file (optional)
  -owner-group-id int
        The group ID of the owner of the certificate file in the image (optional)
  -owner-user-id int
        The user ID of the owner of the certificate file in the image (optional)
  -platform string
        The platform to build the image for (default "linux/amd64")
  -replace-certs
        Replace the certificates in the certificate file instead of appending them

Example

To append a corporate CA certificate to an image, use the following command:

$ incert -image-url=mycompany/myimage:latest -ca-certs-file=/path/to/cacerts.pem -dest-image-url=myregistry/myimage:latest

This will append the certificates in /path/to/cacerts.pem to the mycompany/myimage:latest image and push the modified image to myregistry/myimage:latest.

For security, incert outputs the pushed image reference (with digest) to stdout:

$ incert --image-url=gcr.io/dlorenc-chainguard/wolfi-base --ca-certs-file mycert.pem --dest-image-url gcr.io/dlorenc-chainguard/wolfi-base:new
Successfully appended CA certificates to image gcr.io/dlorenc-chainguard/wolfi-base:withcerts
gcr.io/dlorenc-chainguard/wolfi-base:withcerts@sha256:0cd4278e8072df5acd4956eb58ecba73024de47d9ceace3f0d39fb64e1b01ca6

Authentication

incert uses standard Docker credential helpers for authentication. To configure your credential helper, please follow the instructions in the Docker documentation.

Certificate Formats

Certificate files should be pem encoded and ready to append to a list of other pem certificates. They should look something like this:

chainguard-dev / incert