From 993389d4288d9a9660b8ad5f6aa13af8038d1a8b Mon Sep 17 00:00:00 2001 From: bircni Date: Fri, 6 Nov 2026 21:36:06 +0000 Subject: [PATCH] docs: trust a private registry CA in the dind images (#1397) The bundled Docker daemon pulls job images, so it needs to trust a private registry's CA itself, which `runner.ca_file` doesn't cover. Documents the `certs.d` mount for both dind images. Ref: https://gitea.com/gitea/runner/issues/1390 Reviewed-on: https://gitea.com/gitea/runner/pulls/1397 Reviewed-by: Lunny Xiao --- examples/docker/README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/examples/docker/README.md b/examples/docker/README.md index fc80a002..ccf683df 100644 --- a/examples/docker/README.md +++ b/examples/docker/README.md @@ -12,3 +12,15 @@ docker run --privileged \ ``` The volumes keep the runner's registration and the job image cache. See [image flavours](../../README.md#image-flavours) for alternatives. + +#### Pull job images from a registry with a private CA + +The bundled Docker daemon pulls job images, so it needs to trust the registry's CA itself. `runner.ca_file` doesn't cover this. Mount the CA where the daemon looks for it, naming the directory after the registry's host and port: + +```sh +--mount "type=bind,src=$PWD/ca.crt,dst=/etc/docker/certs.d/registry.example.com:5000/ca.crt,readonly" +``` + +Use `--mount`, since `-v` rejects a container path with a port in it. + +On `latest-dind-rootless`, use `/home/rootless/.config/docker/certs.d/registry.example.com:5000/ca.crt` as the target.