Answers: <p>Oh well, the answer was simple: why do you need to use <code>volume</code> only for file transfer? Just <code>volume</code> the directory, containing problematic folder with cert in it.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-10-28T11:16:31.107Z
Answers: 2019-10-28T11:16:31.107Z
Answers: ahtohio
Body: <p>I've set up a Gitlab registry with self-signed certificate. After that I had to convince docker app to trust my CA, I did this by putting CA.crt into </p>
  
  <pre><code>/etc/docker/certs.d/registry.gitlab.yourdomain:5000
  </code></pre>
  
  <p>But you have to convince docker executor and dind service in Gitlab Runner too, I've done this by passing cert through volumes in <code>config.toml</code>:</p>
  
  <pre><code>volumes = ["/cache", "/certs/client", "path/to/cert/ca.crt:/etc/docker/registry.gitlab.yourdomain:5000/ca.crt"]
  </code></pre>
  
  <p>See the problem? Gitlab Runner uses old volume specification, so <code>:5000</code> part will break it. I know about existence of <code>pre_clone_script</code>, so that you can map your cert into some folder and then move it. But that will not solve the dind service problem - <code>pre_clone_script</code> will only be executed in 'main' container.</p>
  
Tags: <docker><gitlab-ci-runner>
Title: Gitlab runner, docker registry and self-signed certs
UserDisplayName: ahtohio
ThreadText: # Gitlab runner, docker registry and self-signed certs
  
  (Asked by: username_0 on 2019-10-24)
  
  I've set up a Gitlab registry with self-signed certificate. After that I had to convince docker app to trust my CA, I did this by putting CA.crt into
  
  ```
  /etc/docker/certs.d/registry.gitlab.yourdomain:5000
  
  ```
  
  But you have to convince docker executor and dind service in Gitlab Runner too, I've done this by passing cert through volumes in `config.toml`:
  
  ```
  volumes = ["/cache", "/certs/client", "path/to/cert/ca.crt:/etc/docker/registry.gitlab.yourdomain:5000/ca.crt"]
  
  ```
  
  See the problem? Gitlab Runner uses old volume specification, so `:5000` part will break it. I know about existence of `pre_clone_script`, so that you can map your cert into some folder and then move it. But that will not solve the dind service problem - `pre_clone_script` will only be executed in 'main' container.
  
  **Tags:** docker, gitlab-ci-runner
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2019-10-28. Score: 1
  
  Oh well, the answer was simple: why do you need to use `volume` only for file transfer? Just `volume` the directory, containing problematic folder with cert in it.
  
  
  ---
  
  