Sonarqube从9.8升级至9.9.1时Docker构建证书导入失败
2026-7-16
SonarQube 9.8升级至9.9.1构建失败问题
问题概述
将SonarQube从9.8版本升级到9.9.1版本时，构建镜像报错：java.io.FileNotFoundException: /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts (No such file or directory)，但该路径在两个版本中均存在，9.8版本构建完全正常。
9.8版本Dockerfile
FROM sonarqube:9.8-developer SHELL ["/bin/bash", "-c"] COPY ./cert/* /tmp/ # 导入证书 RUN keytool -import -v -trustcacerts -alias my_ca -file /tmp/rootCert.pem \ -keystore /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts -noprompt -storepass changeit RUN keytool -import -v -trustcacerts -alias my_ca_intermediate -file /tmp/rootca-intermediate.pem \ -keystore /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts -noprompt -storepass changeit COPY ./sonar.properties /opt/sonarqube/conf/
9.8版本成功构建日志
$ docker build -t sonar98-troubleshooting:9.8-developer-troubleshooting --no-cache . [+] Building 6.4s (10/10) FINISHED => [internal] load build definition from Dockerfile 0.0s => => transferring dockerfile: 561B 0.0s => [internal] load .dockerignore 0.0s => => transferring context: 2B 0.0s => [internal] load metadata for docker.io/library/sonarqube:9.8-developer 2.3s => CACHED [1/5] FROM docker.io/library/sonarqube:9.8-developer@sha256:a73ecba149df1ebb84f0dc483657ab6cdcf8ed5c6cb72964630fb12b043ccc9c 0.0s => [internal] load build context 0.0s => => transferring context: 147B 0.0s => [2/5] COPY ./cert/* /tmp/ 0.1s => [3/5] RUN keytool -import -v -trustcacerts -alias my_ca -file /tmp/rootCert.pem -keystore /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts -noprompt -storepass changeit 1.9s => [4/5] RUN keytool -import -v -trustcacerts -alias my_ca_intermediate -file /tmp/rootca-intermediate.pem -keystore /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts -noprompt -storepass changei 1.6s => [5/5] COPY ./sonar.properties /opt/sonarqube/conf/ 0.1s => exporting to image 0.2s => => exporting layers 0.1s => => writing image sha256:7abe6db583cd18026362198924549c806c1ce36def7b46796c6e8f613c97bb1f 0.0s => => naming to docker.io/library/sonar98-troubleshooting:9.8-developer-troubleshooting
9.9.1版本Dockerfile
FROM sonarqube:9.9.1-developer SHELL ["/bin/bash", "-c"] COPY ./cert/* /tmp/ # 导入证书 RUN keytool -import -v -trustcacerts -alias my_ca -file /tmp/rootCert.pem \ -keystore /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts -noprompt -storepass changeit RUN keytool -import -v -trustcacerts -alias my_ca_intermediate -file /tmp/rootca-intermediate.pem \ -keystore /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts -noprompt -storepass changeit COPY ./sonar.properties /opt/sonarqube/conf/
9.9.1版本错误构建日志
$ docker build -t sonar991-troubleshooting:9.9.1-developer-troubleshooting --no-cache . [+] Building 3.1s (7/9) => [internal] load build definition from Dockerfile 0.0s => => transferring dockerfile: 563B 0.0s => [internal] load .dockerignore 0.0s => => transferring context: 2B 0.0s => [internal] load metadata for docker.io/library/sonarqube:9.9.1-developer 1.0s => [internal] load build context 0.0s => => transferring context: 147B 0.0s => CACHED [1/5] FROM docker.io/library/sonarqube:9.9.1-developer@sha256:d231773f02bf99229353792408e96ad75c537d0f93ce66f67dcd61dc9e2e40d9 0.0s => [2/5] COPY ./cert/* /tmp/ 0.1s => ERROR [3/5] RUN keytool -import -v -trustcacerts -alias my_ca -file /tmp/rootCert.pem -keystore /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts -noprompt -storepass changeit 1.8s ------ > [3/5] RUN keytool -import -v -trustcacerts -alias my_ca -file /tmp/rootCert.pem -keystore /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts -noprompt -storepass changeit: #7 1.451 Certificate was added to keystore #7 1.451 [Storing /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts] #7 1.777 keytool error: java.io.FileNotFoundException: /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts (No such file or directory) #7 1.778 java.io.FileNotFoundException: /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts (No such file or directory) #7 1.781 at java.base/java.io.FileOutputStream.open0(Native Method) #7 1.781 at java.base/java.io.FileOutputStream.open(Unknown Source) #7 1.782 at java.base/java.io.FileOutputStream.<init>(Unknown Source) #7 1.783 at java.base/java.io.FileOutputStream.<init>(Unknown Source) #7 1.783 at java.base/sun.security.tools.keytool.Main.doCommands(Unknown Source) #7 1.783 at java.base/sun.security.tools.keytool.Main.run(Unknown Source) #7 1.783 at java.base/sun.security.tools.keytool.Main.main(Unknown Source)
解决思路
- 临时目录修改证书：先将系统cacerts复制到临时目录修改，再替换回去，绕开原目录的权限限制：
RUN cp /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts /tmp/cacerts RUN keytool -import -v -trustcacerts -alias my_ca -file /tmp/rootCert.pem \ -keystore /tmp/cacerts -noprompt -storepass changeit RUN keytool -import -v -trustcacerts -alias my_ca_intermediate -file /tmp/rootca-intermediate.pem \ -keystore /tmp/cacerts -noprompt -storepass changeit RUN cp /tmp/cacerts /usr/lib/jvm/java-17-openjdk/jre/lib/security/cacerts - 切换root用户操作：SonarQube 9.9.1可能默认使用非root用户构建，切换到root用户执行证书导入，完成后切回原用户：
USER root # 导入证书的RUN指令 USER sonarqube - 验证路径与权限：在构建时添加
RUN ls -l /usr/lib/jvm/java-17-openjdk/jre/lib/security/，确认cacerts文件的存在状态和权限配置。
内容的提问来源于stack exchange，提问作者Lagot
相关产品推荐
相关产品推荐
