How can I update ca-certificates for a base image in a private registry?

[mattv-neXenio]

Can I pass ssl or ca-certficates in envd/buildkit.toml and if not, can I at least build an image based on moby/buildkitd where I can update the ca-certficates and use it in envd build?

[mattv-neXenio]

Currently I have this workaround.

I create a new image with the following Dockerfile:

FROM moby/buildkitd:v0.10.6

RUN apk update && apk add ca-certificates && rm -rf /var/cache/apk/* \
  mkdir /usr/local/share/ca-certificates/extra
COPY .docker/other/cert_Intertrials-CA.crt /usr/local/share/ca-certificates/extra
RUN update-ca-certificates

and tag it to moby/buildkitd:v0.10.6.

Otherwise envd build will use the base image or re-pull it.

[kemingy]

This should work well. Another way is to pass CA with the envd bootstrap You can check the details with envd bootstrap --help.

[mattv-neXenio]

If I push my custom image to a private registry, would envd bootstrap pull it with -r <private-registry-url>?
Should the image be tagged as <private-registry-url>/moby/buildkitd:<version>?

Currently using envd version v0.3.36

[kemingy]

Not really. envd bootstrap only needs to run once to set up the buildkitd container (or if you manually set up one). Image pull is done by buildkitd. The image tag doesn't need to include anything related to moby/buildkitd unless that's the name for this image (which I guess it's not?).

Another simple way is to use envd v1 with moby builder, this ensures that you can pull the private image in envd as long as you can do it with docker.