search

docker / machine

Machine management for a container-centric world
https://docs.docker.com/machine/
Apache License 2.0
6.63k stars 1.97k forks source link

docker-machine not working behind certificate tampering firewall (severe cert hurt) #1536

Open tgoeke opened 9 years ago

tgoeke commented 9 years ago

Running an image behind a corporate firewall that hacks the TLS certificate causes "docker run" to fail when pulling the image.

docker run -ti ubuntu /bin/bash
Unable to find image 'ubuntu:latest' locally
latest: Pulling from ubuntu
83e4dde6b9cf: Pulling fs layer
83e4dde6b9cf: Error pulling dependent layers
29460ac93442: Pulling fs layer
d2a0ecffe6fa: Layer already being pulled by another client. Waiting.
d2a0ecffe6fa: Error pulling image (latest) from ubuntu, Server error: Status 0 while fetching image layer (83e4dde6b9cfddf46b75a07ec8d65ad87a748b98cf27de7d5b3298c1f3455ae4)
Error pulling image (latest) from ubuntu, Server error: Status 0 while fetching image layer (83e4dde6b9cfddf46b75a07ec8d65ad87a748b98cf27de7d5b3298c1f3455ae4)

All attempts to add the corporate certificate to the local machine have failed since docker 1.5. (Currently using docker-machine 0.3.0 and docker 1.7.1 with VMware Fusion.)

It would be great to have an official procedure or even support for easily adding the corp certs.

ehazlett commented 9 years ago

This is probably because it's pulling from the engine and not your local host. You could try to add them to the engine (Fusion VM).

tgoeke commented 9 years ago

Thanks for the suggestion, it's right on, but we already tried that.

To further test the issue, I have a vagrant setup that uses Ubuntu 14.04 to setup a docker environment in VMware Fusion. We append the corporate certs to "/etc/ssl/certs/ca-certificates.crt", restart docker, everything works (on the same laptop).

I also appended the certs to "/etc/ssl/certs/ca-certificates.crt" on the boot2docker VM, and then did a "docker-machine restart", but it didn't work. (Same error, only now it's super slow.)

Furthermore, even if it had worked, we would have to do it all the time for every new machine, so it would be nice to have an easy way to set this up, like an "--evil-corp-certs=~\certs" option to pass in the certs and put them in the right place.

wallnerryan commented 9 years ago

+1

gbivins commented 9 years ago

+1 This has been our biggest barrier to entry with docker... Corp firewall. We worked around it with boot2docker but I'm having trouble getting it going with the new tools

ChrisPearce commented 9 years ago

+1