Docker容器中OpenAI Python客户端启动报SSL证书文件不存在错误

问题背景 #

在Docker容器中运行基于OpenAI API客户端的Python脚本，重新构建容器后突然出现SSL证书错误，此前相同代码可正常运行。

报错堆栈 #

Traceback (most recent call last):
  File "/opt/project/app/main.py", line 5, in <module>
    client = OpenAI(api_key=OPENAI_API_KEY, base_url="https://api.openai.com/v1/")
  File "/usr/local/lib/python3.11/site-packages/openai/_client.py", line 123, in __init__
    super().__init__(
  File "/usr/local/lib/python3.11/site-packages/openai/_base_client.py", line 860, in __init__
    self._client = http_client or SyncHttpxClientWrapper(
  File "/usr/local/lib/python3.11/site-packages/openai/_base_client.py", line 755, in __init__
    super().__init__(**kwargs)
  File "/usr/local/lib/python3.11/site-packages/httpx/_client.py", line 690, in __init__
    self._transport = self._init_transport(
  File "/usr/local/lib/python3.11/site-packages/httpx/_client.py", line 733, in _init_transport
    return HTTPTransport(
  File "/usr/local/lib/python3.11/site-packages/httpx/_transports/default.py", line 153, in __init__
    ssl_context = create_ssl_context(verify=verify, cert=cert, trust_env=trust_env)
  File "/usr/local/lib/python3.11/site-packages/httpx/_config.py", line 35, in create_ssl_context
    ctx = ssl.create_default_context(cafile=os.environ["SSL_CERT_FILE"])
  File "/usr/local/lib/python3.11/ssl.py", line 770, in create_default_context
    context.load_verify_locations(cafile, capath, cadata)
FileNotFoundError: [Errno 2] No such file or directory

相关配置文件 #

Dockerfile #

FROM python:3.11

MAINTAINER Dockerfiles
# setup all the configfiles
COPY app/requirements.txt /requirements.txt
RUN pip3 install --upgrade pip && pip3 install -r requirements.txt

COPY app/main.py /app/main.py
CMD ["python", "/app/main.py"]

main.py #

from openai import OpenAI

if __name__ == "__main__":
    OPENAI_API_KEY = "sk-****"
    client = OpenAI(api_key=OPENAI_API_KEY, base_url="https://api.openai.com/v1/")

requirements.txt #

openai==1.56.2

解决方案 #

原因分析 #

报错核心是系统尝试读取环境变量SSL_CERT_FILE指向的证书文件，但该文件不存在。大概率是基础镜像更新后证书路径变更，或环境变量被意外设置但未指向有效证书文件。

具体修复方法 #

1. 安装完整CA证书包
   在Dockerfile中添加CA证书安装步骤，确保容器内拥有完整的根证书链：

   FROM python:3.11
   
   MAINTAINER Dockerfiles
   # 安装CA证书并清理缓存
   RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
   # setup all the configfiles
   COPY app/requirements.txt /requirements.txt
   RUN pip3 install --upgrade pip && pip3 install -r requirements.txt
   
   COPY app/main.py /app/main.py
   CMD ["python", "/app/main.py"]
   

2. 显式配置SSL证书路径

   • 方法一：在Dockerfile中设置正确的SSL_CERT_FILE环境变量，指向系统默认证书路径：

     ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
     

   • 方法二：在Python代码中指定SSL上下文（仅测试环境可临时禁用验证，生产环境不推荐）：

     import ssl
     import httpx
     from openai import OpenAI
     
     if __name__ == "__main__":
         OPENAI_API_KEY = "sk-****"
         # 使用系统默认证书创建SSL上下文
         ssl_context = ssl.create_default_context()
         client = OpenAI(
             api_key=OPENAI_API_KEY,
             base_url="https://api.openai.com/v1/",
             http_client=httpx.Client(ssl=ssl_context)
         )
         # 测试用临时禁用验证（生产环境禁止）
         # client = OpenAI(api_key=OPENAI_API_KEY, base_url="https://api.openai.com/v1/", http_client=httpx.Client(verify=False))
     

3. 清理缓存重新构建
   执行以下命令重新构建容器，避免使用旧的缓存镜像层：

   docker build --no-cache -t your-image-name .
   

内容的提问来源于stack exchange，提问作者Nori