基于EKS集群的自托管Github Action构建镜像失败求助

问题背景 #

• 基于EKS的Kubernetes集群，采用按需生成容器的Github Action控制器作为自托管Runner
• 执行trivy-action等需要构建Docker镜像的插件时，出现SSL证书验证失败，导致apk无法安装bash、curl、npm等依赖，构建中断
• 集群内独立运行Alpine容器时命令正常，默认Ubuntu版自托管Runner可正常工作，排除集群全局网络/证书问题
• 仅ubuntu-latest镜像可用，其他镜像均触发相同SSL错误

错误日志 #

/usr/local/bin/docker build -t 60e226:1b6fc15462134e6fb8520b7df48cf7fd -f  "/runner/_work/_actions/aquasecurity/trivy-action/master/Dockerfile"      "/runner/_work/_actions/aquasecurity/trivy-action/master"
Sending build context to Docker daemon  644.6kB

Step 1/5 : FROM ghcr.io/aquasecurity/trivy:0.37.1
0.37.1: Pulling from aquasecurity/trivy
c158987b0551: Pulling fs layer
67a7d067ef7d: Pulling fs layer
67a7d067ef7d: Pull complete
2ec1cdd48f38: Verifying Checksum
2ec1cdd48f38: Download complete
2ec1cdd48f38: Pull complete
fe56e6aa700e: Pull complete
Digest: sha256:7c167f7f3002948f1ec099555aa968bd8b8b097780603a38cc801fe965da0a69
Status: Downloaded newer image for ghcr.io/aquasecurity/trivy:0.37.1
 ---> c3e68408cd24
Step 2/5 : COPY entrypoint.sh /
 ---> 1f1da443ea86
Step 3/5 : RUN apk --no-cache add bash curl npm
 ---> Running in 647f7f479cac
fetch https://dl-cdn.alpinelinux.org/alpine/v3.17/main/x86_64/APKINDEX.tar.gz
48ABC73BEB7F0000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1889:
WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.17/main: Permission denied
fetch https://dl-cdn.alpinelinux.org/alpine/v3.17/community/x86_64/APKINDEX.tar.gz
48ABC73BEB7F0000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1889:
WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.17/community: Permission denied
ERROR: unable to select packages:
  bash (no such package):
    required by: world[bash]
  curl (no such package):
    required by: world[curl]
  npm (no such package):
    required by: world[npm]
The command '/bin/sh -c apk --no-cache add bash curl npm' returned a non-zero code: 3
Warning: Docker build failed with exit code 3, back off 6.807 seconds before retry.

Trivy-Action配置 #

- name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: 'test:latest'
        format: 'table'
        exit-code: '1'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'

解决思路 #

1. 修复Docker构建环境的证书配置 #

自托管Runner的Docker daemon可能未加载集群/企业根证书，导致构建容器内无法验证外部SSL证书：

• 将根证书挂载到Runner容器的/etc/ssl/certs目录，同时修改Docker daemon配置文件daemon.json，指定证书路径
• 在Docker build命令中添加--certificate-authority参数，直接指定根证书文件

2. 替换Trivy-Action的基础镜像 #

当前使用的trivy:0.37.1基于Alpine，可能存在证书链兼容性问题：

• 自定义Trivy-Action的Dockerfile，改用Ubuntu作为基础镜像，规避Alpine的apk证书验证逻辑
• 使用预安装好依赖的Trivy官方镜像，跳过apk add步骤

3. 临时切换apk为HTTP源（仅测试用） #

在Dockerfile的RUN apk命令前替换镜像源为HTTP，绕过SSL验证：

RUN echo "http://dl-cdn.alpinelinux.org/alpine/v3.17/main" > /etc/apk/repositories && \
    echo "http://dl-cdn.alpinelinux.org/alpine/v3.17/community" >> /etc/apk/repositories && \
    apk --no-cache add bash curl npm

注意：此方法会降低安全性，仅作为临时验证手段

4. 配置Docker构建的代理继承 #

如果集群使用代理，Runner容器的代理配置可能未传递到Docker构建环境：

• 在Runner启动时注入HTTP_PROXY、HTTPS_PROXY、NO_PROXY环境变量
• 修改Docker daemon配置，添加代理参数，确保构建过程能访问外部资源

5. 使用预构建的Trivy-Action镜像 #

避免在Runner中动态构建镜像，直接调用官方预构建的trivy-action镜像，或直接在Runner中安装Trivy CLI执行扫描

内容的提问来源于stack exchange，提问作者Ali