docker buildx 忽略容器镜像服务的证书校验的方法

最近在使用docker的最新版本docker 29.6.2版本，使用最新buildx的方法，上传个人搭建的容器镜像服务上，在证书忽略校验这块，需要需要注意一下。

1、docker安装

我docker安装，直接使用二进制的安装方法，直接从阿里云的mirror下载docker二进制压缩包，执行命令启动的方式。这种方式很容易安装各个版本的docker，大家可以参考一下，安装脚本如下：

bash 复制代码

PKG_DIR="/tmp/docker-version-packages"   # Persistent directory for Docker packages and buildx binary
TEST_DIR="/tmp/docker-version-test-$$"
BUILDX_VERSION="v0.34.1"
BUILDX_PLUGIN_DIR="${HOME}/.docker/cli-plugins"
BUILDX_BUILDER_NAME="my-builder"
BUILDKIT_IMAGE="moby/buildkit:buildx-stable-1"

install_docker_version() {
    local docker_version="$1"
    local download_url="https://mirrors.aliyun.com/docker-ce/linux/static/stable/x86_64/${docker_version}"

    log_info "========== Installing Docker: ${docker_version} =========="

    # Stop existing Docker service
    log_info "Stopping existing Docker service..."
    if systemctl is-active --quiet docker 2>/dev/null; then
        service docker stop || true
        sleep 2
    fi

    # Kill any lingering dockerd processes
    if pgrep -x dockerd > /dev/null; then
        log_warn "Found lingering dockerd process, cleaning up..."
        pkill -x dockerd || true
        sleep 2
    fi

    # Create persistent package directory and working directory
    mkdir -p "${PKG_DIR}"
    mkdir -p "${TEST_DIR}"

    # Download Docker (use local package if available)
    if [[ -f "${PKG_DIR}/${docker_version}" ]]; then
        log_info "Local package already exists: ${docker_version}, skipping download"
    else
        log_info "Downloading Docker: ${download_url}"
        if ! curl -k -fSL -o "${PKG_DIR}/${docker_version}" "${download_url}"; then
            log_error "Download failed: ${download_url}"
            return 1
        fi
        log_success "Download complete"
    fi

    # Copy to working directory and extract
    log_info "Extracting Docker package..."
    cp "${PKG_DIR}/${docker_version}" "${TEST_DIR}/"
    cd "${TEST_DIR}"
    tar -zxf "${docker_version}"

    # Copy binaries
    log_info "Installing Docker binaries to /usr/bin..."
    cp -p docker/* /usr/bin/

    # Start Docker daemon
    log_info "Starting Docker daemon..."
    nohup dockerd > "${TEST_DIR}/dockerd.log" 2>&1 &

    # Wait for Docker to start
    log_info "Waiting for Docker to start..."
    local max_wait=30
    local waited=0
    while ! docker info > /dev/null 2>&1; do
        sleep 1
        waited=$((waited + 1))
        if [[ $waited -ge $max_wait ]]; then
            log_error "Docker startup timeout (${max_wait}s)"
            log_error "Check logs: ${TEST_DIR}/dockerd.log"
            return 1
        fi
    done

    # Verify insecure-registries configuration is loaded
    log_info "Verifying insecure-registries configuration..."
    if ! docker info 2>/dev/null | grep -q "xxx.registry.com"; then
        log_warn "insecure-registries not loaded, restarting Docker daemon..."
        pkill -9 -x dockerd || true
        sleep 3
        rm -f /var/run/docker.sock /run/docker.sock 2>/dev/null || true
        nohup dockerd > "${TEST_DIR}/dockerd-restart.log" 2>&1 &
        waited=0
        while ! docker info > /dev/null 2>&1; do
            sleep 1
            waited=$((waited + 1))
            if [[ $waited -ge $max_wait ]]; then
                log_error "Docker restart timeout"
                return 1
            fi
        done
    fi

    # Verify Docker installation
    log_info "Verifying Docker installation..."
    if ! docker info > /dev/null 2>&1; then
        log_error "docker info failed"
        return 1
    fi

    if ! docker version > /dev/null 2>&1; then
        log_error "docker version failed"
        return 1
    fi

    local docker_ver
    docker_ver=$(docker version --format '{{.Server.Version}}')
    log_success "Docker ${docker_version} installed successfully, version: ${docker_ver}"

    return 0
}

install_docker_version "docker-29.6.2.tgz"

1、buildkit安装

bash 复制代码

PKG_DIR="/tmp/docker-version-packages"   # Persistent directory for Docker packages and buildx binary
TEST_DIR="/tmp/docker-version-test-$$"
BUILDX_VERSION="v0.34.1"
BUILDX_PLUGIN_DIR="${HOME}/.docker/cli-plugins"
BUILDX_BUILDER_NAME="my-builder"
BUILDKIT_IMAGE="moby/buildkit:buildx-stable-1"

# Install Docker buildx plugin (reentrant, binary downloaded only once)
install_docker_buildx() {
    local buildx_bin="${BUILDX_PLUGIN_DIR}/docker-buildx"

    # 1. Check if buildx is already installed and usable
    if [[ -x "${buildx_bin}" ]]; then
        local installed_ver
        installed_ver=$("${buildx_bin}" version 2>&1 | head -1)
        log_success "buildx already installed: ${installed_ver}, skipping"
        return 0
    fi

    # 2. Detect system architecture
    local arch
    arch=$(uname -m)
    case "${arch}" in
        x86_64)   arch="amd64" ;;
        aarch64)  arch="arm64" ;;
        armv7l)   arch="arm-v7" ;;
        *)
            log_error "Unsupported architecture: ${arch}"
            return 1
            ;;
    esac

    local buildx_file="buildx-${BUILDX_VERSION}.linux-${arch}"
    local download_url="https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/${buildx_file}"

    mkdir -p "${PKG_DIR}"

    # 3. Download buildx (use local cache if available)
    if [[ -f "${PKG_DIR}/${buildx_file}" ]]; then
        log_info "buildx package already exists: ${PKG_DIR}/${buildx_file}, skipping download"
    else
        log_info "Downloading buildx ${BUILDX_VERSION}: ${download_url}"
        if ! curl -k -fSL -o "${PKG_DIR}/${buildx_file}" "${download_url}"; then
            log_error "buildx download failed"
            return 1
        fi
        log_success "buildx download complete"
    fi

    # 4. Install to cli-plugins directory
    mkdir -p "${BUILDX_PLUGIN_DIR}"
    cp "${PKG_DIR}/${buildx_file}" "${buildx_bin}"
    chmod +x "${buildx_bin}"

    # 5. Configure daemon.json (insecure-registries)
    local daemon_json="/etc/docker/daemon.json"
    local need_restart=0

    if [[ ! -f "${daemon_json}" ]]; then
        cat > "${daemon_json}" <<'DAEMON_EOF'
{
    "insecure-registries": [
        "xxx.registry.com"
    ],
    "log-level": "debug",
    "experimental": true
}
DAEMON_EOF
        log_info "daemon.json created"
        need_restart=1
    else
        # Check if insecure-registries contains our registries
        if ! grep -q "xxx.registry.com" "${daemon_json}"; then
            log_warn "daemon.json exists but missing insecure-registries, updating..."
            # Backup existing daemon.json
            cp "${daemon_json}" "${daemon_json}.bak"
            cat > "${daemon_json}" <<'DAEMON_EOF'
{
    "insecure-registries": [
        "xxx.registry.com"
    ],
    "log-level": "debug",
    "experimental": true
}
DAEMON_EOF
            need_restart=1
        else
            log_info "daemon.json already configured"
        fi
    fi

    # Restart Docker daemon if needed to apply insecure-registries
    if [[ $need_restart -eq 1 ]] && pgrep -x dockerd > /dev/null; then
        log_info "Restarting Docker daemon to apply insecure-registries..."
        # Stop Docker completely
        pkill -9 -x dockerd || true
        sleep 3
        # Clean up any leftover socket files
        rm -f /var/run/docker.sock /run/docker.sock 2>/dev/null || true
        # Start Docker daemon fresh
        nohup dockerd > "${TEST_DIR}/dockerd-restart.log" 2>&1 &
        # Wait for Docker to be ready
        local max_wait=30
        local waited=0
        while ! docker info > /dev/null 2>&1; do
            sleep 1
            waited=$((waited + 1))
            if [[ $waited -ge $max_wait ]]; then
                log_error "Docker restart timeout"
                return 1
            fi
        done
        # Verify insecure-registries configuration
        if docker info 2>/dev/null | grep -q "xxx.registry.com"; then
            log_success "Docker daemon restarted with insecure-registries"
        else
            log_warn "insecure-registries may not be loaded correctly"
        fi
    fi

    export BUILDKIT_NO_CLIENT_TOKEN=true

    log_success "buildx ${BUILDX_VERSION} installation complete"
    return 0
}

# Configure buildkit builder (re-run after each Docker reinstall)
setup_buildkit_builder() {
    log_info "========== Configuring buildkit builder =========="

    # 1. Write buildkitd config
    mkdir -p /etc/buildkit
    cat > /etc/buildkit/buildkitd.toml <<'BUILDKIT_EOF'
debug = true
insecure-entitlements = ["security.insecure"]

[registry."xxx.registry.com"]
http = false
insecure = true

BUILDKIT_EOF
    log_info "buildkitd.toml written"

    # 2. Create buildx builder (remove old one with same name first)
    #    Do NOT use --use here, so docker build keeps using legacy builder
    docker buildx rm "${BUILDX_BUILDER_NAME}" > /dev/null 2>&1 || true
    if ! docker buildx create \
        --name "${BUILDX_BUILDER_NAME}" \
        --driver docker-container \
        --driver-opt network=host,image=${BUILDKIT_IMAGE} \
        --buildkitd-config /etc/buildkit/buildkitd.toml; then
        log_error "buildx builder creation failed"
        return 1
    fi
    log_info "builder '${BUILDX_BUILDER_NAME}' created"

    # 3. Pull buildkit image (check if already present locally)
    if docker image inspect "${BUILDKIT_IMAGE}" > /dev/null 2>&1; then
        log_info "buildkit image already exists, skipping pull"
    else
        log_info "Pulling buildkit image..."
        if ! docker pull "${BUILDKIT_IMAGE}"; then
            log_warn "buildkit image pull failed, builder will auto-pull"
        else
            docker tag "${BUILDKIT_IMAGE}" "moby/buildkit:buildx-stable-1" 2>/dev/null || true
            log_success "buildkit image ready"
        fi
    fi

    # 4. Bootstrap builder
    log_info "Bootstrapping builder..."
    docker buildx inspect --bootstrap

    # 5. List all builders
    docker buildx ls

    log_success "buildkit builder configuration complete"
    return 0
}

忽略容器镜像服务的证书校验主要有3个地方：

1、在docker的配置文件/etc/docker/daemon.json的insecure-registries中增加你容器镜像服务的地址：

{

"insecure-registries": [

"xxx.registry.com"

"log-level": "debug",

"experimental": true

}

2、在buildx的配置文件中/etc/buildkit/buildkitd.toml增加你容器镜像服务地址的忽略证书校验。

registry."xxx.registry.com"

http = false

insecure = true

3、最后一个地方，获取jwttoken的时候需要忽略证书校验，设置环境变量：

export BUILDKIT_NO_CLIENT_TOKEN=true