<p>I am trying to make an HTTPS call in a Docker container running a Go binary. This gives me the following error:</p>

<blockquote>
  <p>x509: failed to load system roots and no roots provided</p>
</blockquote>

<p>Having looked this up, it seems the problem is that the BusyBox docker image does not have a root CA certificate. From other answers on StackOverflow it seems that the best approach is to mount the CA root into the <code>/etc/ssl/certs</code> container directory.</p>

<p>To test locally, it makes sense to mount the host machine's root CA certificate. When running in production (I use Google Container Engine), I'm not sure how to specify a root CA certificate. Do I need to create one myself? Or is there an existing cert in GKE that I can reuse?</p>

<p>There are multiple options you can have</p>

<p><strong>Share certificates from host</strong></p>

<p>As you pointed out you can share <code>/etc/ssl/certs</code> from the host.</p>

<p><strong>Use busybox with certificates</strong></p>

<p>You can use a image like <code>odise/busybox-curl</code> which already has the certificates installed.</p>

<p><strong>Use docker-compose and shared volumes for this</strong></p>

<p>This is a better approach as it would not require you to have dependency on host</p>

<pre><code>version: '2'

services:
  busybox:
    image: busybox
    command: sleep 1000
    volumes:
      - certificates:/etc/ssl/certs:ro
  certifcate_installer:
    image: alpine
    command: sh -c 'apk update &amp;&amp; apk add ca-certificates'
    volumes:
      - certificates:/etc/ssl/certs
volumes:
  certificates:
</code></pre>

<p><strong>Build it using multi-stage Dockerfile</strong></p>

<pre><code>FROM alpine as certs
RUN apk update &amp;&amp; apk add ca-certificates

FROM busybox
COPY --from=certs /etc/ssl/certs /etc/ssl/certs
</code></pre>

<p>And then build it like normal file</p>

<pre><code>vagrant@vagrant:~/certs$ docker build -t busyboxcerts .
Sending build context to Docker daemon  49.66kB
Step 1/4 : FROM alpine as certs
 ---&gt; 4a415e366388
Step 2/4 : RUN apk update &amp;&amp; apk add ca-certificates
 ---&gt; Running in 0059f93b5fc5
fetch http://dl-cdn.alpinelinux.org/alpine/v3.5/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.5/community/x86_64/APKINDEX.tar.gz
v3.5.2-131-g833fa41a4d [http://dl-cdn.alpinelinux.org/alpine/v3.5/main]
v3.5.2-125-g9cb91a548a [http://dl-cdn.alpinelinux.org/alpine/v3.5/community]
OK: 7966 distinct packages available
(1/1) Installing ca-certificates (20161130-r1)
Executing busybox-1.25.1-r0.trigger
Executing ca-certificates-20161130-r1.trigger
OK: 5 MiB in 12 packages
 ---&gt; 1a84422237e4
Removing intermediate container 0059f93b5fc5
Step 3/4 : FROM busybox
 ---&gt; efe10ee6727f
Step 4/4 : COPY --from=certs /etc/ssl/certs /etc/ssl/certs
 ---&gt; af9936f55fc4
Removing intermediate container 1af54c34a5b5
Successfully built af9936f55fc4
Successfully tagged busyboxcerts:latest
vagrant@vagrant:~/certs$ docker run busyboxcerts:latest ls /etc/ssl/certs
02265526.0
024dc131.0
03179a64.0
</code></pre>

<p>For more details on multistage build refer to <a href="https://docs.docker.com/engine/userguide/eng-image/multistage-build/#before-multi-stage-builds" rel="noreferrer">https://docs.docker.com/engine/userguide/eng-image/multistage-build/#before-multi-stage-builds</a></p>

<p>All methods have their own pros and cons. I would prefer the last or the second last method personally</p>
