Skip to content

Commit 23ca0ae

Browse files
authored
Docker: Include ca-certificates package (#679)
1 parent 9bb3615 commit 23ca0ae

File tree

10 files changed

+184
-4
lines changed

10 files changed

+184
-4
lines changed

CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
- Docker: Use tini, [#678](https://github.com/grafana/grafana-image-renderer/pull/678), [Proximyst](https://github.com/Proximyst)
44
- This fixes #677, reported by [@mbentley](https://github.com/mbentley). Thanks!
5+
- Docker: Include ca-certificates package, [#679](https://github.com/grafana/grafana-image-renderer/pull/679), [Proximyst](https://github.com/Proximyst)
6+
- This fixes #676, reported by [@roock](https://github.com/roock). Thanks!
57

68
## 4.0.1, 4.0.2, 4.0.3 & 4.0.4 (2025-07-22)
79

Dockerfile

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,18 @@ RUN echo 'cachebuster 2025-07-16' && apt-get update
99

1010
FROM debian-updated AS debs
1111

12-
RUN apt-cache depends chromium chromium-driver chromium-shell chromium-sandbox font-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-khmeros fonts-kacst fonts-freefont-ttf libxss1 unifont fonts-open-sans fonts-roboto fonts-inter bash busybox util-linux openssl tini \
12+
RUN apt-cache depends chromium chromium-driver chromium-shell chromium-sandbox font-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-khmeros fonts-kacst fonts-freefont-ttf libxss1 unifont fonts-open-sans fonts-roboto fonts-inter bash busybox util-linux openssl tini ca-certificates \
1313
--recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances --no-pre-depends | grep '^\w' | xargs apt-get download
1414
RUN mkdir /dpkg && \
1515
find . -type f -name '*.deb' -exec sh -c 'dpkg --extract "$1" /dpkg || exit 5' sh '{}' \;
1616

1717
FROM debian:testing-slim AS ca-certs
1818

19-
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates
20-
RUN update-ca-certificates --fresh
19+
RUN apt-get update
20+
RUN apt-cache depends ca-certificates \
21+
--recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances --no-pre-depends | grep '^\w' | xargs apt-get download
22+
RUN mkdir /dpkg && \
23+
find . -type f -name '*.deb' -exec sh -c 'dpkg --extract "$1" /dpkg || exit 5' sh '{}' \;
2124

2225
FROM node:22-alpine AS build
2326

@@ -34,14 +37,15 @@ LABEL maintainer="Grafana team <[email protected]>"
3437
LABEL org.opencontainers.image.source="https://github.com/grafana/grafana-image-renderer/tree/master/Dockerfile"
3538

3639
COPY --from=debs /dpkg /
37-
COPY --from=ca-certs /etc/ssl/certs /etc/ssl/certs
40+
COPY --from=ca-certs /dpkg/usr/share/ca-certificates /usr/share/ca-certificates
3841

3942
USER root
4043
SHELL ["/bin/busybox", "sh", "-c"]
4144
RUN /bin/busybox --install
4245
# Verify that the browser was actually installed.
4346
RUN /usr/bin/chromium --version
4447
RUN fc-cache -fr
48+
RUN update-ca-certificates --fresh
4549
USER nonroot
4650

4751
ENV CHROME_BIN="/usr/bin/chromium"

devenv/docker/custom-ca/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Please note that the root CA here is not a production-ready one.
2+
It was generated by [mkcert](https://github.com/FiloSottile/mkcert).
3+
The value is not exactly secret.
Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
services:
2+
grafana:
3+
build:
4+
context: .
5+
dockerfile: grafana.Dockerfile
6+
ports:
7+
- 3000:3000
8+
environment:
9+
GF_RENDERING_SERVER_URL: http://renderer:8081/render
10+
GF_RENDERING_CALLBACK_URL: https://grafana:3000/
11+
GF_LOG_FILTERS: rendering:debug
12+
GF_ROOT_URL: https://grafana:3000/
13+
14+
renderer:
15+
build:
16+
context: .
17+
dockerfile: renderer.Dockerfile
18+
ports:
19+
- 8081
20+
environment:
21+
ENABLE_METRICS: 'true'
Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
FROM alpine:edge AS builder
2+
3+
WORKDIR /src
4+
RUN apk add --no-cache openssl
5+
6+
COPY ./rootCA.pem ca.pem
7+
RUN openssl x509 -inform PEM -in ca.pem -out ca.crt
8+
9+
FROM grafana/grafana-enterprise:latest
10+
11+
COPY --from=builder /src/ca.crt /usr/local/share/ca-certificates/ca.crt
12+
COPY --chown=grafana ./grafana.localhost+1.pem /grafana.localhost.pem
13+
COPY --chown=grafana ./grafana.localhost+1-key.pem /grafana.localhost-key.pem
14+
15+
USER root
16+
RUN update-ca-certificates --fresh
17+
USER grafana
18+
19+
ENV GF_SERVER_PROTOCOL=https
20+
ENV GF_SERVER_CERT_FILE=/grafana.localhost.pem
21+
ENV GF_SERVER_CERT_KEY=/grafana.localhost-key.pem
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDDNX/E0QuKoqWg
3+
Z1/pdJKmFtNLh5+t7HKQLHjOWSSmmksDoQOSNyfgmRYQupoIm69aKTUF/FOheCkl
4+
V4/686z6YHn9+nn3B/zeEIrd9Vja4a+Fn1Wvwj+7ZkJ0N4iStIfWFxmvPeBun1N+
5+
ZD3d81xN3+CkNuXGMVM2D/iPRF9YpoK2hN4ECDMRpm9Wmt+td5D4ilbYfwx2twpO
6+
8PFIXGxEKcY72rvU5Zh1+6L2JExHEb+0Vy21zN34aWEQ0dxMd2el9NotsAMky02R
7+
7mHt6lfMS4ALyeRbgj4MY+Hg/fkq9KXyA3ialfVAaHanBTpfdzW008P7vZgHCfQw
8+
xL6PPSgfAgMBAAECggEATkx0Lk6nMXlhs8AjIXHnrIT1RZNlwg5YOWoNHr90yvqS
9+
YidAVnKXJShiSF2AkTlZEXH72aXHKboXzumbT85TsK3n4K6KI0Lp82xxNuxFMq5Z
10+
h+BML05b39/5gcIQnr+YyI/Fdpv8HIL9q3Gruw31FStaYKPAcEmylbm8OkLzd4vG
11+
T4xeqB0S1vW4M2SA2jigqJH0Wh85yJD97s7ezpSQNdzRq1MIbwyVelnNkH3m09vF
12+
w+7ee+GjupCKyS3edZn1AVGipmRm1vFHyJ1pVm6mGOszCkMbWJ1vccZNXMIhv/GT
13+
DZ8fNTG/bSTT5YzRC7yeBhLV+9imrxAHOGjVIFSbKQKBgQDMcAMYT23AuLCMagLu
14+
RmYZhML4xZhjFvz7TRKwiOm4Sq+JDAEQMnbnjpu2OSy3uBnNsCQ5BzWXzj/Q686r
15+
wg+yQhbXn/j2krvYcwB9hAm1qwclA3ByMTqrDj0Ff7idJ9SncZXaWJV3XCMEZlJz
16+
C4UKXbZqMDwowWsZPAitpdVnCwKBgQD0cZ+AnWEWIcGgktrOYpVyLoVwAv3/EP3x
17+
IYzIeJiCsVpNAEekRXKSVbX+7VWflcAjBjB1aPLXOE9a+Wf3/lH8RmvJHV6SOHGx
18+
qEWH5dxD5ydQuYD6nbvD92fHA0TFKONo9nV/mPL1b0nAGY++LYy72u2/ZsNFxMLv
19+
K089ujlfvQKBgQCPFn80DrP0xc/cF38BowhnKAMG99YW1MowYduI7+sV8EA4HczI
20+
t2l93NSjkBT6acK1smlH+QHLxLHp2oIGuYce7x7pwLASdNVBRAy9zSK2ooQXpfaY
21+
FljHzOls5d4jMPOoVtnZv1Kt/jEMLUnb994gSUMZw7T3mZkKSniQgZeBzQKBgC2e
22+
svzm4kKmJCPapHlWDrwTkJW6CTs8KZiCAWs8joH9pXOvdK9kwqAq3N9p3cv9v7EJ
23+
q6uN3ZxrBuxclZnD3fsuDVmoYIj7fcSBOhDFxljp3/2B0V90ZqGJH9YVdxUwr1hc
24+
fstEeTty/Jmca6Y7jANXNX2+KP1xXkwSkiRcB+8lAoGBAKv7PVoo0Wfn5/5ceLcS
25+
WIsDWizCr9uKICTTqpXgClk+YikKrnIPH9c31HNaRW/mScx4V9a9N/Ujw8jtear+
26+
MtJ6k+m+He+ewdzziRUNPNdBfr9mtGt76+5E0Nnet54BzRLlSHW7exo1XmE+Npi4
27+
394ZsqefwflOKwa2DOuSHZat
28+
-----END PRIVATE KEY-----
Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIEJjCCAo6gAwIBAgIQWjTcQFrcV4r3qRjXpW8ytDANBgkqhkiG9w0BAQsFADBl
3+
MR4wHAYDVQQKExVta2NlcnQgZGV2ZWxvcG1lbnQgQ0ExHTAbBgNVBAsMFG1hcmll
4+
bGxAbWFyaWVsbC1hcmNoMSQwIgYDVQQDDBtta2NlcnQgbWFyaWVsbEBtYXJpZWxs
5+
LWFyY2gwHhcNMjUwNzIzMTExMzUzWhcNMjcxMDIzMTExMzUzWjBIMScwJQYDVQQK
6+
Ex5ta2NlcnQgZGV2ZWxvcG1lbnQgY2VydGlmaWNhdGUxHTAbBgNVBAsMFG1hcmll
7+
bGxAbWFyaWVsbC1hcmNoMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
8+
wzV/xNELiqKloGdf6XSSphbTS4efrexykCx4zlkkpppLA6EDkjcn4JkWELqaCJuv
9+
Wik1BfxToXgpJVeP+vOs+mB5/fp59wf83hCK3fVY2uGvhZ9Vr8I/u2ZCdDeIkrSH
10+
1hcZrz3gbp9TfmQ93fNcTd/gpDblxjFTNg/4j0RfWKaCtoTeBAgzEaZvVprfrXeQ
11+
+IpW2H8MdrcKTvDxSFxsRCnGO9q71OWYdfui9iRMRxG/tFcttczd+GlhENHcTHdn
12+
pfTaLbADJMtNke5h7epXzEuAC8nkW4I+DGPh4P35KvSl8gN4mpX1QGh2pwU6X3c1
13+
tNPD+72YBwn0MMS+jz0oHwIDAQABo28wbTAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0l
14+
BAwwCgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUY9jLFc5QNGlyXVo2ipyXIW6LW0Qw
15+
JQYDVR0RBB4wHIIRZ3JhZmFuYS5sb2NhbGhvc3SCB2dyYWZhbmEwDQYJKoZIhvcN
16+
AQELBQADggGBAG5EcJ9hOmkhUr+2P7YADg21AtqIlWWf+sjr7YGa71HjxFfzaCER
17+
p3F3TJYowOyAdGsNViyHsegVT6dcaV+T2BjGTAwW9tnHOLqvWJK8Y909jhuOPHoa
18+
CvelhHunYVO2uu7OO3nzhNKpdYUL8ktnc7XBh0+FlEHJMws1qjcr28CcK2eCeUn/
19+
MPW0fM98Zw6BH9crSVDZ34YUsQ+dlinZIKKS8SPZyp6j8rX0BypQULTobGiahIeo
20+
8OP31QkCSo5doTLX0jE8btDMOA4N8xx9ktV7jghSrAnf5j0iU/WjFZQj5TQvzj1d
21+
31/hgl5ZzgkwtjHG3LkAZP3Mnt+LLgmPM1mRYYjYb7ujEdCw0tfvwZEbmohSq6c0
22+
uH4DuKmzLPqSsHwL9CmmaBSGrervKg+6VQb8y9HT4eVDZa5uC7jvIyYYyRz8LTih
23+
+YVCopqpQ1HGeKSHfWa6svDqC7XkJJF6KsOm2Hg5fspPAxFDimpFvEfhvBSpzTwZ
24+
hcv63JgkbGfRvg==
25+
-----END CERTIFICATE-----
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
FROM mariell/test
2+
3+
USER root
4+
COPY ./rootCA.pem rootCA.pem
5+
RUN mkdir -p /usr/share/ca-certificates/
6+
RUN openssl x509 -inform PEM -in rootCA.pem -out /usr/share/ca-certificates/rootCA.crt
7+
RUN update-ca-certificates --fresh
8+
9+
USER nonroot
Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIG/AIBADANBgkqhkiG9w0BAQEFAASCBuYwggbiAgEAAoIBgQDTSQ6EKEq/DKiT
3+
EaVKLJey4TCfwPHKGkU7AJqEcZQUror46D2UbWroteTGsiAImoG3Ze9nI1SGhfUy
4+
ziHwPPIZdM3eLAfHW9+eZEG7j3sLAbeL1bG/eDNXLCPj//U13WH9jA9tdOlQyRex
5+
p1m+MIVlYDjR2d9+1XPvrNyGS2Lq2EGSKcCGI3ebZ67yxLQmyIjg8YFbPl8sLUCR
6+
PEaloz+WvRvSnmP4aI7ZDCXTsU+HU2v/z0L/919uhU00HW/NodTIHznR9In7EsoP
7+
+rgboiCLykRRJ2iaLaE9L4zfdm59P557C6xHUguXvND+H8zeOiGAaWxms/FnsaAx
8+
Zk7AodCrSkHaBEBdHSbgKVHZoOVrHzZLjHGn5pPMKe0QmfDWO9WB0StMzx3FopXR
9+
WTwGtITdnM0xBM9Azd/zCUWLP7RWIFAyTpWJMIyMhqcK8pyrF/BVby+UzQGjtZsO
10+
hm/1a/EMttm84/pwmr6n/76DHvubRPftxWnmbHdvj5Ltc4dUISUCAwEAAQKCAYAv
11+
AFqFVb1DANrjVJKTjJX2ihfaAf8HuY5bEMhO3EFX1Hg/5NIGGc0llYkeFnP/1fcz
12+
SC7Yn8hm4JfqRGbSXYxx00UUvnDAjZSSVLU2tzVk/m3JYrFW6bNqGfyl9MOkxunM
13+
kILCE7bvbLyjnZneMEcMhTo+nJwWR/+xep/YFB8eJRt5G2ajsHIkFQ2bHd0Bn6yr
14+
da4UESz00+BALst8f3Ne4hS1ZtzQXtogOI6VqCUL8qfc0UuTS4FkQa0qAb5kXTJk
15+
DiqQBW8yr1N2RnQHfvNxztTK3QxFE6lXIew0Wj+afBje+J3LGbsAFGET1T800s7J
16+
4S1cvkF/t1ntZ0e0zsQm0xHXZN8llKI51dUPHjzkAIF+uKtbrtSmvqTPEYh2LMqQ
17+
GIlksRezFe8FrJcPvfpYF+tFezazokdIELoVSTPFC6XTxcW9Dbneiu2+2PCP1aJH
18+
c/TyJD2fDMInsQhGFGXq3UBNaEOVvi9nxX6irlNMr8uZySpOAhM8yW/zipYS4kEC
19+
gcEA7eetWU6ulAPtMfmskBHhIOy9PZ9hbnpHEgdZSuyunb+LxtL/dpcrXLHxCyWL
20+
bMgwliegoocymzBXQBt/HQ1ljLuiaGqZ/D3MQ/hNVjfXw3npCmswyxCP7tLGrxJr
21+
5all30B94Ywl6OQB6JBcQU2zHHCrEG5TQDn/vweiZgi8vdE/kA3OqebDrotfRxtf
22+
vLaalivKU98Di8+b+rhpdmeZQQ3Fu/XKDmP76io5zCk5Ati00Gp155stKJUgsAXu
23+
iRrxAoHBAONbD4y37AMDKmHBKITtI3eJ2JfGWCcnZUmQwy1QvAy9I4ZY753eU6cP
24+
12TYYfZMzz3ORIq+jh/YVWoCmr+LM04NO5MgVuDrlCl0547+koX+p0KsGE/Cdyry
25+
wKVxiwU8MDrJZ1FD1t1mjNJ5LRjp+ELluxlByqvn88ImgneHVgaOwWpeQBIq4ZqO
26+
foB88JqeMbanq7xaJUxyhYFI9ccNQ2MFOjyWcb1wh2QkUX2Tg9rmyY69uUX6wunZ
27+
MXIdX83hdQKBwGWXc20Zrm9Cpf2bUtdK60o2DjHMZ7zXtpW6UaUvIPn4G+ZRoAmy
28+
UDALRJWv+LQBYM4eKfh9p1yh7gBQPZ3YZK8OSTIxo4QVl67Gz6+rtRWib6OlVnbA
29+
odYoZ/PG+BBgoEIPtjGkuWOUSkRXsS2p0nyomEQx+JcKrW2UAwNzY7XjLzOC0ee3
30+
xYQ5u/wPcniRub27AXGDYG5Jv5/3NAH+B3HCQdgcA6bVh3PdiETorZHLnJsLe0Hm
31+
AAi+dfD094HQ4QKBwEimeouO4h38Tvi5zobbeC/kno+xU83/KsCdP6ElYVH4xndR
32+
yA/8UWLbDwsskfEwjjDDzuc/CQ9oA7NCbcyzYIuacuUKunhZDxlIQA5TjuK+gxgt
33+
Af/KtmXE+IZlh/T+TLMcVKWFNg29jVZcXmrNqQVHf8gMXAUes6fgwmQLnROvXmLt
34+
BzBG/5xx2D6arg/aaSxi29/uNmj9V2f+tnsK4/OqYfemY2YTpU/8wwWLs+CpStMQ
35+
ETopbUtomgJLHKgfWQKBwFC1gxBtQoZXPOZQfTwh/swtYl68g62/rritLNwZEfPz
36+
H+yKLSyQ1GpKGsVRKA6wSdZ0jWeEHrbp9hqHx/zrU180KZutPXT9csOWCWDXA9mr
37+
YwhUleVeFNmgg3WILrXLA1S5bv4xnCNkVg6et+2TkxkHJLshNdj7/S2nPSg2fpHR
38+
JxlY+fjpa8Bg0jkyiL/H2GqlPNsXuLpqN55VIuevPHsaeqmECJusooftJTokiPk0
39+
6gcrR5oywQcM9Rkm0q0Wtg==
40+
-----END PRIVATE KEY-----

devenv/docker/custom-ca/rootCA.pem

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIEmjCCAwKgAwIBAgIRAMRNuMhHFTVyfgiyNlw6KxUwDQYJKoZIhvcNAQELBQAw
3+
ZTEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMR0wGwYDVQQLDBRtYXJp
4+
ZWxsQG1hcmllbGwtYXJjaDEkMCIGA1UEAwwbbWtjZXJ0IG1hcmllbGxAbWFyaWVs
5+
bC1hcmNoMB4XDTI1MDcyMzExMDYwNVoXDTM1MDcyMzExMDYwNVowZTEeMBwGA1UE
6+
ChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMR0wGwYDVQQLDBRtYXJpZWxsQG1hcmll
7+
bGwtYXJjaDEkMCIGA1UEAwwbbWtjZXJ0IG1hcmllbGxAbWFyaWVsbC1hcmNoMIIB
8+
ojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA00kOhChKvwyokxGlSiyXsuEw
9+
n8DxyhpFOwCahHGUFK6K+Og9lG1q6LXkxrIgCJqBt2XvZyNUhoX1Ms4h8DzyGXTN
10+
3iwHx1vfnmRBu497CwG3i9Wxv3gzVywj4//1Nd1h/YwPbXTpUMkXsadZvjCFZWA4
11+
0dnfftVz76zchkti6thBkinAhiN3m2eu8sS0JsiI4PGBWz5fLC1AkTxGpaM/lr0b
12+
0p5j+GiO2Qwl07FPh1Nr/89C//dfboVNNB1vzaHUyB850fSJ+xLKD/q4G6Igi8pE
13+
USdomi2hPS+M33ZufT+eewusR1ILl7zQ/h/M3johgGlsZrPxZ7GgMWZOwKHQq0pB
14+
2gRAXR0m4ClR2aDlax82S4xxp+aTzCntEJnw1jvVgdErTM8dxaKV0Vk8BrSE3ZzN
15+
MQTPQM3f8wlFiz+0ViBQMk6ViTCMjIanCvKcqxfwVW8vlM0Bo7WbDoZv9WvxDLbZ
16+
vOP6cJq+p/++gx77m0T37cVp5mx3b4+S7XOHVCElAgMBAAGjRTBDMA4GA1UdDwEB
17+
/wQEAwICBDASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRj2MsVzlA0aXJd
18+
WjaKnJchbotbRDANBgkqhkiG9w0BAQsFAAOCAYEACUCssPQi6vjLy0teBXx/TQPt
19+
Gvzmt9dNPxKh30yHnmoiOW1tfY8oUKkB+4IQdwGWEZ2JiVijF5yE5M6oCBeOxKmH
20+
fTrMppwmJx/UkGPrPjYilf92WTpL2iqRSTBcagVZQ8sbdPsexl/vpByHtS3LA5oC
21+
gFqnZgLI77UiZeEz4qjmRZg5JUiQxXmQ7smdBuQBwwq6guyn45I+w6YUcScM3H3J
22+
vRyGiH/S8T6MsU34OK6aH09y2aPTOLP+NR2tfSxY/6Ju27XtDzVLV47M5IvDH+IC
23+
tZq9fk28faeddMZs/PTR3h6gzn/+s78hh91SPa1JoWxHanlX4SMt/Qq853HyS/zf
24+
IVC8mlu7ZHDgNDZ/cPc2LjO6ryxqaohGjOamWdF1ssXeLOruXLgzV8sStlTWCtPN
25+
itPWFzeb1hWCvvaxk7xjT0EtdxUy2OWkT2thSzyw9gzHXDZZNoNN8jbC4viOXyif
26+
o5RW/XTnFnk14xFtnv5EnbufRBfs5fg0kgFzzNaz
27+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)