workplace MITM proxy fails ssl cert verification during docker build

[barabo]

My employer uses a man-in-the-middle type of proxy for all network connections originating from my laptop. This means (for me, and others like me) that I can't build the JPA docker container - it fails when it tries to curl endpoints because it doesn't have special SSL configuration in place.

(base) anderson.carl3@R5443475 hapi-fhir-jpaserver-starter % ./build-docker-image.sh
[+] Building 1.3s (9/19)                                                                                                                                       docker:desktop-linux
 => [internal] load build definition from Dockerfile                                                                                                                           0.0s
 => => transferring dockerfile: 2.31kB                                                                                                                                         0.0s
 => [internal] load metadata for gcr.io/distroless/java17-debian12:nonroot                                                                                                     0.4s
 => [internal] load metadata for docker.io/library/maven:3.9.6-eclipse-temurin-17                                                                                              0.8s
 => [internal] load .dockerignore                                                                                                                                              0.0s
 => => transferring context: 243B                                                                                                                                              0.0s
 => [build-hapi 1/8] FROM docker.io/library/maven:3.9.6-eclipse-temurin-17@sha256:29a1658b1f3078e07c2b17f7b519b45eb47f65d9628e887eac45a8c5c8f939d4                             0.0s
 => CANCELED [default 1/4] FROM gcr.io/distroless/java17-debian12:nonroot@sha256:e65fdcb1133728b71cfb6ab006429d4a723f4da4598cf6c697687fff78cf3957                              0.4s
 => => resolve gcr.io/distroless/java17-debian12:nonroot@sha256:e65fdcb1133728b71cfb6ab006429d4a723f4da4598cf6c697687fff78cf3957                                               0.0s
 => => sha256:058cf3d8c2ba04ad7c064698c08c5e886a8623c0ad6171b8d72684253534417d 0B / 537.71kB                                                                                   0.4s
 => => sha256:02b6af5630679b4a7f0073fa8af556a2cf3186ae03b3d4c8e1d4bde3610bda15 3.99kB / 3.99kB                                                                                 0.0s
 => => sha256:e8d9a567199d7a318c875f2558a679ba8a924f817afacbb428afc3ffe6be6828 0B / 13.37kB                                                                                    0.4s
 => => sha256:e65fdcb1133728b71cfb6ab006429d4a723f4da4598cf6c697687fff78cf3957 1.22kB / 1.22kB                                                                                 0.0s
 => => sha256:b48d82bf0ec8d28533b45895e4deaf68e0635d3022b48985dd8e89cf52035f39 5.41kB / 5.41kB                                                                                 0.0s
 => => sha256:d12dd1747fc756df543a17efb415b43b1aaac8074fe01b91c3d32c76946b6a49 0B / 104.18kB                                                                                   0.4s
 => [internal] load build context                                                                                                                                              0.1s
 => => transferring context: 11.48kB                                                                                                                                           0.0s
 => CACHED [build-hapi 2/8] WORKDIR /tmp/hapi-fhir-jpaserver-starter                                                                                                           0.0s
 => ERROR [build-hapi 3/8] RUN curl -LSsO https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/download/v1.33.3/opentelemetry-javaagent.jar           0.4s
------
 > [build-hapi 3/8] RUN curl -LSsO https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/download/v1.33.3/opentelemetry-javaagent.jar:
0.416 curl: (60) SSL certificate problem: unable to get local issuer certificate
0.416 More details here: https://curl.se/docs/sslcerts.html
0.416
0.416 curl failed to verify the legitimacy of the server and therefore could not
0.416 establish a secure connection to it. To learn more about this situation and
0.416 how to fix it, please visit the web page mentioned above.
------
Dockerfile:5
--------------------
   3 |
   4 |     ARG OPENTELEMETRY_JAVA_AGENT_VERSION=1.33.3
   5 | >>> RUN curl -LSsO https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/download/v${OPENTELEMETRY_JAVA_AGENT_VERSION}/opentelemetry-javaagent.jar
   6 |
   7 |     COPY pom.xml .
--------------------
ERROR: failed to solve: process "/bin/sh -c curl -LSsO https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/download/v${OPENTELEMETRY_JAVA_AGENT_VERSION}/opentelemetry-javaagent.jar" did not complete successfully: exit code: 60

I'm wondering if there's anything I can do in the meantime to get this to build on my laptop, or if I'll have to wait for the proxy admins to make whatever change they need to make to enable functional docker builds for me again.

I'm also wondering if there's a 'loose' Dockerfile that could be created for unfortunate souls such as us - a Dockerfile that does not verify server SSL certificates. Or if there's already a way to disable cert verification, could someone point me to it, please? Thank you!

[barabo]

Ah, nevermind. I added -k to the curl command in the Dockerfile and it works now.

[barabo]

For anyone else landing here, I also had to import my MITM certificate into a working cacerts file using keytool, then add another docker layer to copy it into the image jdk.

# From the repo root dir...

# cd into the location of your local jdk cacerts file.
SEC_LIB_DIR="$( dirname `which java` )/../lib/security )"
cd "${SEC_LIB_DIR}"

# import your MITM cert.
keytool -importcert -alias MITM -keystore ./cacerts -file ~/.certs/MITM.crt

# Return to the repo root dir.
cd -
cp "${SEC_LIB_DIR}/cacerts" .

I also had to add this layer to the Dockerfile.

COPY cacerts /opt/java/openjdk/lib/security/