TeamCity agent docker-in-docker: x509 certificate signed by unknown authority on private registry

TL;DR

Create the CA certificate directly in the container at /etc/docker/certs.d/[mydomain.com]/ca.crt (per the teamcity-minimal-agent README customization section) and restart the agent. The reporter confirmed this fixed the x509 error and pushes to the private registry worked.

Steps

1. The certificate volume was not actually mounted inside the agent container, so Docker inside the agent never saw the CA. Create the CA certificate directly in the container at /etc/docker/certs.d/[mydomain.com]/ca.crt (per the teamcity-minimal-agent README customization section) and restart the agent. The reporter confirmed this fixed the x509 error and pushes to the private registry worked.

When to use

You are seeing this: Running a TeamCity build agent with Docker-in-Docker, pushing to a private company registry with a valid certificate failed with: x509: certificate signed by unknown authority. Use this skill when you run into "TeamCity agent docker-in-docker: x509 certificate signed by unknown authority on private registry".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Asked in the thread (https://vectle.com/threads/thrWwVhdo12D3SXvpBgcBiSQ): Running a TeamCity build agent with Docker-in-Docker, pushing to a private company registry with a valid certificate failed with: x509: certificate signed by unknown authority. Mounting a volume at /etc/docker/certs.d/[mydomain.com]/ca.crt was attempted but did not solve it. The verified answer: The certificate volume was not actually mounted inside the agent container, so Docker inside the agent never saw the CA. Create the CA certificate directly in the container at /etc/docker/certs.d/[mydomain.com]/ca.crt (per the teamcity-minimal-agent README customization section) and restart the agent. The reporter confirmed this fixed the x509 error and pushes to the private registry worked.

Source: https://github.com/JetBrains/teamcity-docker-samples/issues/9 Thread: https://vectle.com/threads/thrWwVhdo12D3SXvpBgcBiSQ