Windows下构建Go Dockerfile遇x509证书未知签发机构错误的解决方法

问题详情 #

在Windows环境执行docker build构建Go项目镜像时，go build步骤出现TLS证书验证错误，无法从proxy.golang.org下载依赖包，但浏览器直接访问对应URL可正常下载。使用Go 1.19.5 windows/amd64版本，尝试多种方案未解决。

解决方案 #

方案1：在构建阶段安装CA证书 #

golang镜像基于Debian系统，默认可能缺少部分根证书，可通过安装证书包解决信任问题：
修改Dockerfile的builder阶段，添加证书安装命令：

# base go image
FROM golang:latest as builder
# 安装并更新CA证书
RUN apt-get update && apt-get install -y ca-certificates && update-ca-certificates
RUN mkdir /app

COPY . /app

WORKDIR /app

RUN CGO_ENABLED=0 go build -o brokerApp ./cmd/api

RUN chmod +x /app/brokerApp

# build a tiny docker image
FROM alpine:latest
# alpine镜像也需要安装证书包
RUN apk add --no-cache ca-certificates
RUN mkdir /app

COPY --from=builder /app/brokerApp /app

CMD [ "/app/brokerApp" ]

方案2：切换Go模块代理为国内镜像 #

若证书问题由网络环境导致，可替换Go模块代理为国内镜像，绕过证书验证环节：
在builder阶段添加代理环境变量：

# base go image
FROM golang:latest as builder
RUN mkdir /app
# 设置国内Go模块代理
ENV GOPROXY=https://goproxy.cn,direct
COPY . /app

WORKDIR /app

RUN CGO_ENABLED=0 go build -o brokerApp ./cmd/api

RUN chmod +x /app/brokerApp

# build a tiny docker image
FROM alpine:latest

RUN mkdir /app

COPY --from=builder /app/brokerApp /app

CMD [ "/app/brokerApp" ]

方案3：本地预下载依赖后构建 #

在本地提前下载所有依赖，再复制到镜像中，避免构建时远程下载：

1. 本地执行命令下载依赖到vendor目录：

go mod vendor

2. 修改Dockerfile使用本地依赖构建：

# base go image
FROM golang:latest as builder
RUN mkdir /app

# 复制依赖配置和vendor目录
COPY go.mod go.sum vendor/ /app/
COPY . /app

WORKDIR /app

# 使用本地vendor目录构建
RUN CGO_ENABLED=0 go build -mod=vendor -o brokerApp ./cmd/api

RUN chmod +x /app/brokerApp

# build a tiny docker image
FROM alpine:latest

RUN mkdir /app

COPY --from=builder /app/brokerApp /app

CMD [ "/app/brokerApp" ]

原Dockerfile #

# base go image
FROM golang:latest as builder
RUN mkdir /app

COPY . /app

WORKDIR /app

RUN CGO_ENABLED=0 go build -o brokerApp ./cmd/api

RUN chmod +x /app/brokerApp

# build a tiny docker image
FROM alpine:latest

RUN mkdir /app

COPY --from=builder /app/brokerApp /app

CMD [ "/app/brokerApp" ]

错误信息 #

$ docker build -t test -f broker-service.dockerfile .
Sending build context to Docker daemon   7.79MB
Step 1/10 : FROM golang:latest as builder
 ---> c48137eaf961
Step 2/10 : RUN mkdir /app
 ---> Running in 0caaa78d39ad
Removing intermediate container 0caaa78d39ad
 ---> 260a46b545a8
Step 3/10 : COPY . /app
 ---> 17c49c16a2ea
Step 4/10 : WORKDIR /app
 ---> Running in 056c8e90776a
Removing intermediate container 056c8e90776a
 ---> 55ef7bc5f453
Step 5/10 : RUN CGO_ENABLED=0 go build -o brokerApp ./cmd/api
 ---> Running in e1d6ae8ddbb6
go: downloading github.com/go-chi/chi/v5 v5.0.8
go: downloading github.com/go-chi/cors v1.2.1
cmd/api/routes.go:6:2: github.com/go-chi/chi/v5@v5.0.8: Get "https://proxy.golang.org/github.com/go-chi/chi/v5/@v/v5.0.8.zip": tls: failed to verify certificate: x509: certificate signed by unknown authority
cmd/api/routes.go:7:2: github.com/go-chi/chi/v5@v5.0.8: Get "https://proxy.golang.org/github.com/go-chi/chi/v5/@v/v5.0.8.zip": tls: failed to verify certificate: x509: certificate signed by unknown authority
cmd/api/routes.go:8:2: github.com/go-chi/cors@v1.2.1: Get "https://proxy.golang.org/github.com/go-chi/cors/@v/v1.2.1.zip": tls: failed to verify certificate: x509: certificate signed by unknown authority
The command '/bin/sh -c CGO_ENABLED=0 go build -o brokerApp ./cmd/api' returned a non-zero code: 1

内容的提问来源于stack exchange，提问作者Naxi