Building (custom) Docker Hardened Images from behind a proxy

Image Builds
,
1

I’m currently trying to get the build process for Docker Hardened Images to work inside a corporate network that requires a proxy to reach the internet.

My user as well as the docker daemon have been set up with http proxy environment vars / configs.

While the build is able to fetch the DHI Build image from dhi.io, in the next step it fails because it cannot reach the apk repositories:

$ docker buildx build . -f /home/me/tomcat-dhi.yaml --tag tomcat10jdk17:1.0 --load
[+] Building 2.2s (14/14) FINISHED
 => [internal] load build definition from tomcat-dhi.yaml
 => => transferring dockerfile: 5.52kB
 => resolve image config for docker-image://dhi.io/build:2-alpine3.24
 => [auth] build:pull token for dhi.io
 => CACHED docker-image://dhi.io/build:2-alpine3.24@sha256:3d90eac6694cec73030ea634338084e17e83533ca24f477c1f6851a0266be53b
 => => resolve dhi.io/build:2-alpine3.24@sha256:3d90eac6694cec73030ea634338084e17e83533ca24f477c1f6851a0266be53b
 => install repository key https://dhi.io/keyring/dhi-apk@docker-0F81AD7700D99184.rsa.pub
 => CACHED copy artifacts
 => CACHED mkfile /packages
 => CACHED initialize repo
 => CACHED mkdir /etc/apk
 => CACHED add repositories
 => CACHED mkdir /etc/apk/keys
 => CACHED add keys
 => CACHED copy /dhi-apk@docker-0F81AD7700D99184.rsa.pub /etc/apk/keys/dhi-apk@docker-0F81AD7700D99184.rsa.pub
 => ERROR fetch package locations
------
 > fetch package locations:
0.276 packages: alpine-baselayout-data apr busybox eclipse-temurin-17-jdk-oci-config eclipse-temurin-17-jdk libgcc libstdc++ musl openssl tzdata
0.276 target architecture: amd64
0.325 WARNING: updating and opening https://dhi.io/apk/alpine/v3.24/main/x86_64/APKINDEX.tar.gz: TLS: unspecified error
0.343 WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz: TLS: unspecified error
0.355 WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.24/community/x86_64/APKINDEX.tar.gz: TLS: unspecified error
0.355 3 unavailable, 0 stale; 0 distinct packages available
------
tomcat-dhi.yaml:38
--------------------
  37 |       packages:
  38 | >>>     - alpine-baselayout-data
  39 | >>>     - apr
  40 | >>>     - busybox
  41 | >>>     - eclipse-temurin-17-jdk-oci-config=17.0.20.8-r1
  42 | >>>     - eclipse-temurin-17-jdk=17.0.20.8-r1
  43 | >>>     - libgcc
  44 | >>>     - libstdc++
  45 | >>>     - musl
  46 | >>>     - openssl
  47 | >>>     - tzdata
  48 |       builds:
--------------------
ERROR: failed to build: failed to solve: process "sh -c /packages alpine-baselayout-data apr busybox eclipse-temurin-17-jdk-oci-config eclipse-temurin-17-jdk libgcc libstdc++ musl openssl tzdata" did not complete successfully: exit code: 3

Now, we do have our own artifactory running within our network and I attempted to pull the packages from there, but this then leads to certificate problems:

0.330 WARNING: updating and opening https://myartifactory.internal/artifactory/dhi-alpine-remote/v3.24/main/x86_64/APKINDEX.tar.gz: TLS: server certificate not trusted
0.367 WARNING: updating and opening https://myartifactory.internal/artifactory/alpine-remote/v3.24/main/x86_64/APKINDEX.tar.gz: TLS: server certificate not trusted
0.403 WARNING: updating and opening https://myartifactory.internal/artifactory/alpine-remote/v3.24/community/x86_64/APKINDEX.tar.gz: TLS: server certificate not trusted

This is the point where I’m starting to be out of ideas and the documentation doesn’t talk about this use case as far as I can see. I need either the ability to configure a proxy and/or CA certificates for the DHI build container OR - and I’m not happy about the thought - I need to pry open the DHI build image and add these things myself.

Open to ideas and suggestions
Hex

2

Have you found this page of the documentation about building images with proxy configuration?

https://docs.docker.com/engine/cli/proxy/#build-with-a-proxy-configuration

Whether the variables are used depends on the library or tool that sends the HTTP request, but the menitoned variables should help in most cases.

3

Please share what you configured in which file, and please share what Docker variation and version you use.

What works on all variations is to configure it in ~/.docker/config.json according these instructions:
Use a proxy server with the Docker CLI | Docker Docs. The proxy settings will be injected into created containers and builds.

Though, when it comes to the CA certificate: you will indeed need to add it to the DHI image yourself. Do you know if your network performs TLS inspection?

4

I missed that the original error was also about certificates, not “unreachable”.

6

We are on Linux, for the users we set up 4 different env variables, due to different tools handling them differently: HTTPS_PROXY, HTTP_PROXY, https_proxy, http_proxy. All of them contain “http://ourforwardproxy.internal:80”

The ~/.docker/config.json contains the proxies → httpsProxy and proxies → httpProxy entries.

The Docker systemd unit file defines the 4 environment variables as seen above.

The forward proxy in question is fully transparent and no ssl inspection happens to packages on the way to the internet.

7

It’s not possible to use a typical RUN directive with DHI builds. They use declarative yaml instead of Dockerfiles (see Create and build a Docker Hardened Image | Docker Docs).

As such I have tried to simply pull the DHI build image, replace the ca-certificates.crt in its entirety with our own.
Then try the build with that new modified DHI build image, but the TLS: unspecified error remains.

8

It deleted the post you respond to, because it was ai generated content. It picked up enough details to seem relevant, but ignores the context.

9

So you configured everything required to have the proxy configured when pulling images, and inject proxy variables into containers and builds.

It looks like you tried two different attemps:

  1. where you used the dhi.io repo and the alpine repo.
  2. where you used an artifactory cache repo

In both cases the proxy shouldn’t be a problem, as it’s accessed via http. Since it’s a transparent proxy, It should establish a security tunnel between the apk client inside the container and the target. The “TLS: specified error” is surprising.

The 2nd case would make sense, if Artifactory’s certificate is signed from a private CA. So the chain of trust can’t be validated, unless the CA is known to the (build) container.

Would it be possible to share the tomcat-dhi.yaml file?