Docker构建Django镜像安装ODBC驱动时遇证书验证与仓库错误

为Django应用构建Docker镜像时，使用以下Dockerfile片段：

FROM python:3.9.13-slim-buster  

WORKDIR /home/app
   
RUN apt-get update \
    && apt-get install --reinstall ca-certificates \
    && apt-get install -y gnupg2 unixodbc-dev g++ curl 

RUN curl -O http://pkg.jenkins-ci.org/debian-rc/jenkins-ci.org.key

RUN curl -k https://packages.microsoft.com/keys/microsoft.asc | apt-key add -

RUN curl -k https://packages.microsoft.com/config/debian/11/prod.list > /etc/apt/sources.list.d/mssql-release.list

RUN curl -k https://packages.microsoft.com/debian/9/prod/pool/main/m/msodbcsql18/msodbcsql18_18.0.1.1-1_amd64.deb 

RUN apt-get -f install unixodbc

RUN apt-get install ca-certificates

RUN apt-get update && ACCEPT_EULA=Y apt-get install -y msodbcsql18 mssql-tools

构建时执行RUN apt-get update && ACCEPT_EULA=Y apt-get install -y msodbcsql18_18.1.1.1 mssql-tools指令出现以下错误：

RUN apt-get update && ACCEPT_EULA=Y apt-get install -y msodbcsql18_18.1.1.1 mssql-tools:
#12 10.74   Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown.  Could not handshake: Error in the certificate verification. [IP: 104.214.230.139 443]
#12 10.75 Reading package lists...
#12 11.42 E: The repository 'https://packages.microsoft.com/debian/11/prod bullseye Release' does not have a Release file.
------
executor failed running [/bin/sh -c apt-get update && ACCEPT_EULA=Y apt-get install -y msodbcsql18_18.1.1.1 mssql-tools]: exit code: 100

1. 修复Debian版本不匹配问题 #

基础镜像python:3.9.13-slim-buster对应Debian 10（Buster），但当前添加的是Debian 11的微软源，这是导致仓库无Release文件的核心原因。需替换为Debian 10的源：

# 替换原Debian 11源指令
RUN curl https://packages.microsoft.com/config/debian/10/prod.list > /etc/apt/sources.list.d/mssql-release.list

2. 解决证书信任问题 #

• 移除curl命令中的-k参数（该参数会跳过证书验证，存在安全风险），确保系统正常验证微软证书。
• 用Debian推荐的方式导入微软GPG密钥，替代已废弃的apt-key add，同时确保ca-certificates正确安装：

RUN apt-get update \
    && apt-get install --reinstall -y ca-certificates gnupg2 unixodbc-dev g++ curl \
    && curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > /usr/share/keyrings/microsoft-prod.gpg

3. 清理冗余指令并正确安装驱动 #

• 移除手动下载deb包的冗余指令，直接通过apt安装msodbcsql18和mssql-tools即可。
• 合并相关apt指令减少镜像层数，同时添加清理步骤缩小镜像体积：

RUN apt-get update \
    && ACCEPT_EULA=Y apt-get install -y msodbcsql18 mssql-tools unixodbc \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

4. 完整优化后的Dockerfile片段 #

FROM python:3.9.13-slim-buster  

WORKDIR /home/app
   
RUN apt-get update \
    && apt-get install --reinstall -y ca-certificates gnupg2 unixodbc-dev g++ curl \
    && curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > /usr/share/keyrings/microsoft-prod.gpg \
    && curl https://packages.microsoft.com/config/debian/10/prod.list > /etc/apt/sources.list.d/mssql-release.list \
    && apt-get update \
    && ACCEPT_EULA=Y apt-get install -y msodbcsql18 mssql-tools unixodbc \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# 可选：将mssql-tools加入系统PATH，方便后续调用
ENV PATH="$PATH:/opt/mssql-tools/bin"

内容的提问来源于stack exchange，提问作者Mani Eswar