AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
Cannot install packages in AWS Docker images due to certificate error
Hi all,
I'm trying to create a Docker using the following base image public.ecr.aws/amazonlinux/amazonlinux:2023. So far, my Dockerfile looks like this:
FROM public.ecr.aws/amazonlinux/amazonlinux:2023 AS builder WORKDIR /app RUN dnf install -y ca-certificates && update-ca-trust RUN dnf install -y \ python3 python3-devel gcc gcc-c++ \ postgresql-libs postgresql-devel zip \ && dnf clean all
When I run docker build, I get the following error:
Errors during downloading metadata for repository 'amazonlinux': - Curl error (60): SSL peer certificate or SSH remote key was not OK for https://cdn.amazonlinux.com/al2023/core/mirrors/2023.9.20251110/aarch64/mirror.list?instance_id=none [SSL certificate problem: unable to get local issuer certificate] Error: Failed to download metadata for repo 'amazonlinux': Cannot prepare internal mirrorlist: Curl error (60): SSL peer certificate or SSH remote key was not OK for https://cdn.amazonlinux.com/al2023/core/mirrors/2023.9.20251110/aarch64/mirror.list?instance_id=none [SSL certificate problem: unable to get local issuer certificate] Ignoring repositories: amazonlinux Package python3-3.9.24-1.amzn2023.0.4.aarch64 is already installed. No match for argument: python3-devel No match for argument: gcc No match for argument: gcc-c++ No match for argument: postgresql-libs No match for argument: postgresql-devel No match for argument: zip Error: Unable to find a match: python3-devel gcc gcc-c++ postgresql-libs postgresql-devel zip
It seems that the Docker can't access Amazon's CDN from their own image. On my local machine, I've did a curl to the url https://cdn.amazonlinux.com/al2023/core/mirrors/2023.9.20251110/aarch64/mirror.list?instance_id=none and it worked, I had no certificate error.
Then I built a simpler Docker image and accessed it to run the same curl command.
FROM public.ecr.aws/amazonlinux/amazonlinux:2023 AS builder WORKDIR /app RUN dnf install -y ca-certificates && update-ca-trust
And I have the same certificate error.
I did another test.
And success. And then I did a final test.
I'm doing all of this in a MacBook Pro M4, with Docker Docker version 28.5.2, build ecc6942, and I don't have a proxy, I've Zscaler.
Anyone has any idea of what's the problem?
Thank you all.
- Newest
- Most votes
- Most comments
After some investigation, I've found this guide from Docker.
I've followed the steps Obtaining the root certificate and Building with the certificate, and it worked.
This is my Dockerfile:
FROM public.ecr.aws/amazonlinux/amazonlinux:2023 AS builder ADD ./zcsaler-root-ca.pem /usr/share/pki/ca-trust-source/anchors/zscaler-root-ca.crt RUN dnf install -y ca-certificates && update-ca-trust && dnf clean all WORKDIR /app RUN dnf update \ && dnf install -y \ python3 python3-devel gcc gcc-c++ \ postgresql-libs postgresql-devel zip \ && dnf clean all
Then, I ran the command docker build --tag aws-lambda-layers:latest . and it worked.
I don't understand why it worked for some domains, but not for others, but it works.
Thank you Riko for your help.
answered 10 months ago
Hello.
I tried building an image using your Dockerfile from CloudShell and the build completed successfully.
The cause is currently unknown, but the build was successful on my local PC (Ubuntu on WSL2), so there may be a problem with the local machine.
Try running the build in CloudShell in your AWS account and check if it is successful.
https://docs.aws.amazon.com/cloudshell/latest/userguide/welcome.html
This issue appears to be related to Docker authentication with Amazon ECR Public. There are a few approaches you can try to resolve this problem:
- Docker Logout from ECR Public: The error suggests there might be an expired authentication token. Try logging out from the ECR Public registry:
docker logout public.ecr.aws
Then attempt your build again.
- Login to ECR Public: Alternatively, you can authenticate with ECR Public:
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
- Use Docker Hub Instead: You could modify your Dockerfile to use the Docker Hub image instead of the ECR Public one:
FROM amazonlinux:2023
Instead of:
FROM public.ecr.aws/amazonlinux/amazonlinux:2023
- Fix Region Configuration:
The issue might be related to the AWS region configuration. Check the contents of
/etc/dnf/vars/awsregionin your container. If it contains "default" instead of a valid AWS region (like "us-east-1"), this could be causing the certificate validation problem.
For Python-specific installations, if you need a specific version like Python 3.12 that isn't available in the default repositories, you might need to use pyenv or another installation method as the standard repositories may only have up to Python 3.11.
Sources
Troubleshoot AgentCore Runtime - Amazon Bedrock AgentCore
Amazon ECR Public troubleshooting - Amazon ECR Public
Unable to install services on my instance. Take Two. | AWS re:Post
python 3.12 on Amazon Linux 2023 | AWS re:Post
answered 10 months ago
This does not work, because I don't have problems downloading the image from the ACR.
Hi. I've tried using CloudShell and it worked. From my local machine I'm able to reach the endpoint that's failing. But not from inside the Docker container. However, if I do
curlto other endpoints, such as https://www.google.com/ or https://www.github.com/, it works. Only Amazon related endpoints are failing. What be the cause for this in the local machine?