Docker Community Forums

Share and learn in the Docker community.

Building a Dockerfile with RUN update-ca-certificates fails for ASP.NET Core and ARM32

Hi,
I’m trying to build my ASP .NET Core application for my Raspberry Pi on Docker Hub. I want to install a custom Root CA and my Dockerfile looks like this:

ARG BASE_IMAGE=mcr.microsoft.com/dotnet/aspnet:5.0.5-buster-slim-arm32v7
FROM ${BASE_IMAGE} AS base
WORKDIR /app

COPY src/JoplinAsustorMediator/root_CA_mu88.crt /usr/local/share/ca-certificates/root_CA_mu88.crt
RUN update-ca-certificates

FROM mcr.microsoft.com/dotnet/sdk:5.0 AS build
WORKDIR /src
COPY ["src/JoplinAsustorMediator/JoplinAsustorMediator.csproj", "src/JoplinAsustorMediator/"]
RUN dotnet restore "src/JoplinAsustorMediator/JoplinAsustorMediator.csproj"
COPY . .
WORKDIR "/src/src/JoplinAsustorMediator"
RUN dotnet build "JoplinAsustorMediator.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "JoplinAsustorMediator.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "JoplinAsustorMediator.dll"]

On Docker Hub, applying my custom Root CA fails with The command '/bin/sh -c update-ca-certificates' returned a non-zero code: 1 . This is the complete log output:

Cloning into '.'...
Warning: Permanently added the RSA host key for IP address '140.82.113.3' to the list of known hosts.
Switched to a new branch 'release'
Pulling cache layers for index.docker.io/mu88/joplinasustormediator:latest...
Done!
KernelVersion: 4.4.0-1060-aws
Components: [{u'Version': u'19.03.8', u'Name': u'Engine', u'Details': {u'KernelVersion': u'4.4.0-1060-aws', u'Os': u'linux', u'BuildTime': u'2020-03-11T01:24:30.000000000+00:00', u'ApiVersion': u'1.40', u'MinAPIVersion': u'1.12', u'GitCommit': u'afacb8b7f0', u'Arch': u'amd64', u'Experimental': u'false', u'GoVersion': u'go1.12.17'}}, {u'Version': u'1.2.13', u'Name': u'containerd', u'Details': {u'GitCommit': u'7ad184331fa3e55e52b890ea95e65ba581ae3429'}}, {u'Version': u'1.0.0-rc10', u'Name': u'runc', u'Details': {u'GitCommit': u'dc9208a3303feef5b3839f4323d9beb36df0a9dd'}}, {u'Version': u'0.18.0', u'Name': u'docker-init', u'Details': {u'GitCommit': u'fec3683'}}]
Arch: amd64
BuildTime: 2020-03-11T01:24:30.000000000+00:00
ApiVersion: 1.40
Platform: {u'Name': u'Docker Engine - Community'}
Version: 19.03.8
MinAPIVersion: 1.12
GitCommit: afacb8b7f0
Os: linux
GoVersion: go1.12.17
Starting build of index.docker.io/mu88/joplinasustormediator:latest...
Step 1/18 : ARG BASE_IMAGE=mcr.microsoft.com/dotnet/aspnet:5.0.5-buster-slim-arm32v7
Step 2/18 : FROM ${BASE_IMAGE} AS base
---> 0d95d6c17320
Step 3/18 : WORKDIR /app
---> Using cache
---> 8dd3a3b6f379
Step 4/18 : COPY src/JoplinAsustorMediator/root_CA_mu88.crt /usr/local/share/ca-certificates/root_CA_mu88.crt
---> bf7737d82c09
Step 5/18 : RUN update-ca-certificates
---> Running in 4af1b887f715
[91mstandard_init_linux.go:211: exec user process caused "exec format error"
[0m
Removing intermediate container 4af1b887f715
The command '/bin/sh -c update-ca-certificates' returned a non-zero code: 1

I’m trying to build my ASP.NET Core application with the following Dockerfile on Docker Hub:

ARG BASE_IMAGE=mcr.microsoft.com/dotnet/aspnet:5.0.5-buster-slim-arm32v7
FROM ${BASE_IMAGE} AS base
WORKDIR /app

COPY src/JoplinAsustorMediator/root_CA_mu88.crt /usr/local/share/ca-certificates/root_CA_mu88.crt
RUN update-ca-certificates

FROM mcr.microsoft.com/dotnet/sdk:5.0 AS build
WORKDIR /src
COPY ["src/JoplinAsustorMediator/JoplinAsustorMediator.csproj", "src/JoplinAsustorMediator/"]
RUN dotnet restore "src/JoplinAsustorMediator/JoplinAsustorMediator.csproj"
COPY . .
WORKDIR "/src/src/JoplinAsustorMediator"
RUN dotnet build "JoplinAsustorMediator.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "JoplinAsustorMediator.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "JoplinAsustorMediator.dll"]

On Docker Hub, applying my custom Root CA fails with The command '/bin/sh -c update-ca-certificates' returned a non-zero code: 1 . This is the complete log output:

Cloning into '.'...
Warning: Permanently added the RSA host key for IP address '140.82.113.3' to the list of known hosts.
Switched to a new branch 'release'
Pulling cache layers for index.docker.io/mu88/joplinasustormediator:latest...
Done!
KernelVersion: 4.4.0-1060-aws
Components: [{u'Version': u'19.03.8', u'Name': u'Engine', u'Details': {u'KernelVersion': u'4.4.0-1060-aws', u'Os': u'linux', u'BuildTime': u'2020-03-11T01:24:30.000000000+00:00', u'ApiVersion': u'1.40', u'MinAPIVersion': u'1.12', u'GitCommit': u'afacb8b7f0', u'Arch': u'amd64', u'Experimental': u'false', u'GoVersion': u'go1.12.17'}}, {u'Version': u'1.2.13', u'Name': u'containerd', u'Details': {u'GitCommit': u'7ad184331fa3e55e52b890ea95e65ba581ae3429'}}, {u'Version': u'1.0.0-rc10', u'Name': u'runc', u'Details': {u'GitCommit': u'dc9208a3303feef5b3839f4323d9beb36df0a9dd'}}, {u'Version': u'0.18.0', u'Name': u'docker-init', u'Details': {u'GitCommit': u'fec3683'}}]
Arch: amd64
BuildTime: 2020-03-11T01:24:30.000000000+00:00
ApiVersion: 1.40
Platform: {u'Name': u'Docker Engine - Community'}
Version: 19.03.8
MinAPIVersion: 1.12
GitCommit: afacb8b7f0
Os: linux
GoVersion: go1.12.17
Starting build of index.docker.io/mu88/joplinasustormediator:latest...
Step 1/18 : ARG BASE_IMAGE=mcr.microsoft.com/dotnet/aspnet:5.0.5-buster-slim-arm32v7
Step 2/18 : FROM ${BASE_IMAGE} AS base
---> 0d95d6c17320
Step 3/18 : WORKDIR /app
---> Using cache
---> 8dd3a3b6f379
Step 4/18 : COPY src/JoplinAsustorMediator/root_CA_mu88.crt /usr/local/share/ca-certificates/root_CA_mu88.crt
---> bf7737d82c09
Step 5/18 : RUN update-ca-certificates
---> Running in 4af1b887f715
[91mstandard_init_linux.go:211: exec user process caused "exec format error"
[0m
Removing intermediate container 4af1b887f715
The command '/bin/sh -c update-ca-certificates' returned a non-zero code: 1

When running the command docker build -f .\src\JoplinAsustorMediator\Dockerfile -t joppi . locally on my laptop, the image can be built and the output looks like this:

[+] Building 37.9s (20/20) FINISHED
 => [internal] load build definition from Dockerfile
 => => transferring dockerfile: 874B
 => [internal] load .dockerignore
 => => transferring context: 35B
 => [internal] load metadata for mcr.microsoft.com/dotnet/sdk:5.0
 => [internal] load metadata for mcr.microsoft.com/dotnet/aspnet:5.0.5-buster-slim-arm32v7
 => [build 1/7] FROM mcr.microsoft.com/dotnet/sdk:5.0@sha256:85ea9832ae26c70618418cf7c699186776ad066d88770fd6fd1edea9b260379a
 => [internal] load build context
 => => transferring context: 17.80kB
 => [base 1/4] FROM mcr.microsoft.com/dotnet/aspnet:5.0.5-buster-slim-arm32v7@sha256:7e999a0e31ef05bfbec335d4ded2f16c316ec6a9d8cd05d4590ab6f469493900
 => CACHED [base 2/4] WORKDIR /app
 => CACHED [build 2/7] WORKDIR /src
 => CACHED [build 3/7] COPY [src/JoplinAsustorMediator/JoplinAsustorMediator.csproj, src/JoplinAsustorMediator/]
 => CACHED [build 4/7] RUN dotnet restore "src/JoplinAsustorMediator/JoplinAsustorMediator.csproj"
 => [base 3/4] COPY src/JoplinAsustorMediator/root_CA_mu88.crt /usr/local/share/ca-certificates/root_CA_mu88.crt
 => [build 5/7] COPY . . 
 => [base 4/4] RUN update-ca-certificates
 => [build 6/7] WORKDIR /src/src/JoplinAsustorMediator
 => [build 7/7] RUN dotnet build "JoplinAsustorMediator.csproj" -c Release -o /app/build
 => [publish 1/1] RUN dotnet publish "JoplinAsustorMediator.csproj" -c Release -o /app/publish
 => [final 1/2] WORKDIR /app
 => [final 2/2] COPY --from=publish /app/publish .
 => exporting to image
 => => exporting layers
 => => writing image sha256:6bd051cc170c8c82ed1385a7ca9f35f657b28861deb7c0865412922e9429f695
 => => naming to docker.io/library/joppi

What am I doing wrong? Is there any obvious error?

On Stack Overflow, somebody suggested to change the platform of the build machine to arm32, but I don’t know how to do that.