Install company CA certificates into the sandbox Debian store #6

Merged

mathieu merged 1 commit from lain/custom-ca-certificates-20261102144655 into main

2026-11-02 13:54:50 +00:00

Lain commented

2026-11-02 13:48:32 +00:00

Collaborator

Adds a ca_certificates list to dash.yaml. Each PEM file is mounted read-only into /usr/local/share/ca-certificates in the sandbox, and the entrypoint runs sudo update-ca-certificates at start, so the Debian store and the bundle used by curl, git, Go, Python and Node's system CAs trust it.

Missing or relative paths fail the run.
Nothing is written back to the host.
Documented in README and examples; the default template lists it commented out.

Verified: gofmt, go vet, go test ./internal/... and bash -n on the entrypoint, plus unit tests for mount paths and errors.
Not verified: a real image build and install inside a container (no dash image on this host, limited disk).

Adds a `ca_certificates` list to dash.yaml. Each PEM file is mounted read-only into /usr/local/share/ca-certificates in the sandbox, and the entrypoint runs `sudo update-ca-certificates` at start, so the Debian store and the bundle used by curl, git, Go, Python and Node's system CAs trust it. - Missing or relative paths fail the run. - Nothing is written back to the host. - Documented in README and examples; the default template lists it commented out. Verified: gofmt, go vet, go test ./internal/... and bash -n on the entrypoint, plus unit tests for mount paths and errors. Not verified: a real image build and install inside a container (no dash image on this host, limited disk).

Lain added 1 commit

2026-11-02 13:48:33 +00:00

Install company CA certificates into the sandbox Debian store

ci / test (pull_request) Successful in 1m10s

Details

eaa8ceddbf