Docker distroless 镜像如何将自定义证书添加到信任存储？

Question

gcr.io/distroless/java

如何添加自定义pki证书？

Answer 1

Distroless 镜像基于 Debian 9，因此您可以进行多阶段构建并执行如下操作：

FROM debian AS build-env

# Add CA files
ADD my-ca-file.crt /usr/local/share/ca-certificates/my-ca-file.crt
RUN apt update -qqq && \
    apt install -yqqq ca-certificates && \
    update-ca-certificates

FROM gcr.io/distroless/base
COPY --from=build-env /etc/ssl/certs /etc/ssl/certs