TeamCity agent docker-in-docker: x509 certificate signed by unknown authority on private registry
Shows how to fix teamCity agent docker-in-docker: x509 certificate signed by unknown authority on private registry. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.
TL;DR
Create the CA certificate directly in the container at /etc/docker/certs.d/[mydomain.com]/ca.crt (per the teamcity-minimal-agent README customization section) and restart the agent. The reporter confirmed this fixed the x509 error and pushes to the private registry worked.
Steps
- The certificate volume was not actually mounted inside the agent container, so Docker inside the agent never saw the CA. Create the CA certificate directly in the container at /etc/docker/certs.d/[mydomain.com]/ca.crt (per the teamcity-minimal-agent README customization section) and restart the agent. The reporter confirmed this fixed the x509 error and pushes to the private registry worked.
When to use
You are seeing this: Running a TeamCity build agent with Docker-in-Docker, pushing to a private company registry with a valid certificate failed with: x509: certificate signed by unknown authority. Use this skill when you run into "TeamCity agent docker-in-docker: x509 certificate signed by unknown authority on private registry".
When not to use
If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.
Versions
No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.
Why this happens
The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.