asp.net - 在 docker 镜像中生成开发证书

Question

我有一个 .NET 应用程序，我希望在生产中生成一个开发证书（自签名）。在本地，为此我使用以下命令：

dotnet dev-certs https --clean
dotnet dev-certs https
dotnet dev-certs https --trust

所以我尝试了 2 种方法，但似乎都没有。我已经在我的“/root/.aspnet/https”中搜索了 .pfx 文件（实际上是 /data/socloze/web/keys/https，因为卷映射），但是这个文件夹不存在。

方法一：在镜像构建时创建证书

在 DockerFile 文件中，我有以下内容

### >>> GLOBALS
ARG ENVIRONMENT="Production"
ARG PROJECT="Mycorp.MyApp.Web"
### <<<

#--------------------------------------------------
# Build / Publish
#--------------------------------------------------

# debian buster - AMD64
FROM mcr.microsoft.com/dotnet/sdk:5.0 AS build

### >>> IMPORTS
ARG ENVIRONMENT
ARG PROJECT
### <<<

ARG NUGET_CACHE=https://api.nuget.org/v3/index.json
ARG NUGET_FEED=https://api.nuget.org/v3/index.json

# Copy sources
COPY src/ /app/src
ADD common.props /app

WORKDIR /app

# Installs NodeJS to build typescripts
#RUN apt-get update -yq && apt-get upgrade -yq && apt-get install -yq curl git nano
#RUN curl -sL https://deb.nodesource.com/setup_8.x | bash - && apt-get install -yq nodejs build-essential
#RUN npm install -g npm
#RUN npm install

RUN apt-get update
RUN apt-get install curl
RUN curl -sL https://deb.nodesource.com/setup_14.x | bash -
RUN apt-get install -y nodejs
RUN npm install /app/src/MyCorp.Core.Blazor/
#RUN npm install -g parcel-bundler

# Installs the required dependencies on top of the base image
# Publish a self-contained image
RUN apt-get update && apt-get install -y libgdiplus libc6-dev && dotnet dev-certs https --clean && dotnet dev-certs https && dotnet dev-certs https --trust &&\
    dotnet publish --self-contained --runtime linux-x64 -c Debug -o out src/${PROJECT};

#--------------------------------------------------
# Execute
#--------------------------------------------------

# Start a new image from aspnet runtime image
FROM mcr.microsoft.com/dotnet/sdk:5.0 AS runtime

### >>> IMPORTS
ARG ENVIRONMENT
ARG PROJECT
### <<<

#ENV DOTNET_GENERATE_ASPNET_CERTIFICATE=true
ENV ASPNETCORE_ENVIRONMENT=${ENVIRONMENT}
ENV ASPNETCORE_URLS="http://+:80;https://+:443;https://+:44390" 
#ENV ASPNETCORE_URLS="http://+:80"  
ENV PROJECT="${PROJECT}.dll"

# Make logs a volume for persistence
VOLUME /app/Logs

# App directory
WORKDIR /app

# Copy our build from the previous stage in /app
COPY --from=build /app/out ./

RUN apt-get update && apt-get install -y ffmpeg libgdiplus libc6-dev

# Ports
EXPOSE 80
EXPOSE 443
EXPOSE 44390

# Execute
ENTRYPOINT dotnet ${PROJECT}

方法二：使用 docker-compose 创建证书

另一种方法是在容器启动后生成证书，在我的 myappstack.yaml 中，我有以下内容：

version: '3.3'
services:
  web:
    image: registry.gitlab.com/mycorp/myapp/socloze.web:1.1.1040
    command:
     - sh -c "dotnet dev-certs https --clean"
     - sh -c "dotnet dev-certs https"
     - sh -c "dotnet dev-certs https --trust"
     - sh -c "echo MYPASS | sudo -S -k update-ca-certificates"
    volumes:
     - keys-vol:/root/.aspnet
     - logs-vol:/app/Logs
     - sitemap-vol:/data/sitemap/
    networks:
     - haproxy-net
     - socloze-net
    configs:
     -
      source: socloze-web-conf
      target: /app/appsettings.json
    logging:
      driver: json-file
    deploy:
      placement:
        constraints:
         - node.role == manager
networks:
  haproxy-net:
    external: true
  socloze-net:
    external: true
volumes:
  keys-vol:
    driver: local
    driver_opts:
      device: /data/socloze/web/keys
      o: bind
      type: none
  logs-vol:
    driver: local
    driver_opts:
      device: /data/socloze/web/logs
      o: bind
      type: none
  sitemap-vol:
    driver: local
    driver_opts:
      device: /data/sitemap
      o: bind
      type: none
configs:
  socloze-web-conf:
    external: true

但似乎没有一个工作。我知道第一种方法已经奏效，但我不能让它再次奏效。

标签： asp.netlinuxdockerasp.net-corecertificate