title: How to add trusted root CA to Docker alpine
body: <p>Suppose I am at network where there is MITM SSL swaping firewall (google.com is not issued by Google, but reissued by custom CA root authority) some more details here <a href="https://security.stackexchange.com/questions/107542/is-it-common-practice-for-companies-to-mitm-https-traffic">https://security.stackexchange.com/questions/107542/is-it-common-practice-for-companies-to-mitm-https-traffic</a> .</p>
  <p>I have simple Dockerfile:</p>
  <pre><code>FROM alpine:latest
  RUN apk --no-cache add curl
  </code></pre>
  <p>It fails badly with error with SSL errors</p>
  <pre><code> =&gt; ERROR [2/2] RUN apk --no-cache add curl                                                                                                                                    1.0s
  ------
   &gt; [2/2] RUN apk --no-cache add curl:
  #5 0.265 fetch https://dl-cdn.alpinelinux.org/alpine/v3.13/main/x86_64/APKINDEX.tar.gz
  #5 0.647 140037857143624:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1913:
  #5 0.649 WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.13/main: Permission denied
  #5 0.649 fetch https://dl-cdn.alpinelinux.org/alpine/v3.13/community/x86_64/APKINDEX.tar.gz
  #5 0.938 140037857143624:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1913:
  #5 0.940 WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.13/community: Permission denied
  #5 0.941 ERROR: unable to select packages:
  #5 0.942   curl (no such package):
  #5 0.942     required by: world[curl]
  ------
  executor failed running [/bin/sh -c apk --no-cache add curl]: exit code: 1
  </code></pre>
  <p>Every tutorial at Internet says that I can add own &quot;trusted&quot; root certificate and run <code>update-ca-certificates</code>.</p>
  <p>But it can be added by &quot;apt add&quot; only. This situation seems to me as &quot;chicken-egg&quot; problem.</p>
  <pre><code>FROM alpine:latest
  USER root
  RUN apk --no-cache add ca-certificates \
    &amp;&amp; update-ca-certificates
  </code></pre>
  <p>Error is similar</p>
  <pre><code>=&gt; ERROR [2/2] RUN apk --no-cache add ca-certificates   &amp;&amp; update-ca-certificates                                                                                             1.0s
  ------
   &gt; [2/2] RUN apk --no-cache add ca-certificates   &amp;&amp; update-ca-certificates:
  #5 0.269 fetch https://dl-cdn.alpinelinux.org/alpine/v3.13/main/x86_64/APKINDEX.tar.gz
  #5 0.662 140490932583240:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1913:
  #5 0.663 fetch https://dl-cdn.alpinelinux.org/alpine/v3.13/community/x86_64/APKINDEX.tar.gz
  #5 0.663 WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.13/main: Permission denied
  #5 0.929 140490932583240:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1913:
  #5 0.931 WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.13/community: Permission denied
  #5 0.932 ERROR: unable to select packages:
  #5 0.933   ca-certificates (no such package):
  #5 0.933     required by: world[ca-certificates]
  ------
  executor failed running [/bin/sh -c apk --no-cache add ca-certificates   &amp;&amp; update-ca-certificates]: exit code: 1
  </code></pre>
  <p>Is there some other solution how to install <code>update-ca-certificates</code> tool? Or am I missing something?</p>
  <p>Thx</p>
  <p><strong>See @kthompso answer for working solution.</strong></p>
  <p>Working solution (with <code>update-ca-certificates</code> commnad) based on @kthompso answer and info from <a href="https://stackoverflow.com/questions/52355346/unable-to-add-certificates-to-alpine-linux-container">unable to add certificates to alpine linux container</a></p>
  <pre><code>FROM alpine:latest
  
  USER root
  
  # To be able to download `ca-certificates` with `apk add` command
  COPY my-root-ca.crt /root/my-root-ca.crt
  RUN cat /root/my-root-ca.crt &gt;&gt; /etc/ssl/certs/ca-certificates.crt
  
  # Add again root CA with `update-ca-certificates` tool
  RUN apk --no-cache add ca-certificates \
      &amp;&amp; rm -rf /var/cache/apk/*
  COPY my-root-ca.crt /usr/local/share/ca-certificates
  RUN update-ca-certificates
  
  RUN apk --no-cache add curl
  </code></pre>
  <p><s>Edit: One solution I have in my mind is to use curl docker image with <code>-k</code> option and download <code>.apk</code> with those certificates and tools. Install it as local file. Add my root CA certificate and run <code>update-ca-certificates</code>. It sounds super crazy, so I think that have to be better solution :)</s></p>