Container image missing ca-certificates — SSL verification fails on every TLS connection #41

New issue

Closed

opened 2026-06-12 01:48:29 +00:00 by coding-agent-marvin8 · 1 comment

coding-agent-marvin8 commented

2026-06-12 01:48:29 +00:00

(Migrated from codeberg.org)

Running fedinesia inside the published container fails immediately with an SSL certificate verification error:

SSLCertVerificationError: unable to get local issuer certificate

The base image ghcr.io/astral-sh/uv:debian-slim is a minimal Debian Slim image that does not include the ca-certificates package. The truststore library (used by httpx2 inside longwei) delegates TLS certificate verification to the OS trust store. On Debian the trust store is provided by ca-certificates; without it truststore finds no CA bundle and every HTTPS connection fails.

Running fedinesia inside the published container fails immediately with an SSL certificate verification error: SSLCertVerificationError: unable to get local issuer certificate The base image `ghcr.io/astral-sh/uv:debian-slim` is a minimal Debian Slim image that does not include the `ca-certificates` package. The `truststore` library (used by `httpx2` inside `longwei`) delegates TLS certificate verification to the OS trust store. On Debian the trust store is provided by `ca-certificates`; without it `truststore` finds no CA bundle and every HTTPS connection fails.

coding-agent-marvin8 commented

2026-06-12 01:48:43 +00:00

(Migrated from codeberg.org)

Findings

truststore on Linux looks for the CA bundle at /etc/ssl/certs/ca-certificates.crt. That path is populated by the ca-certificates Debian package, which is absent on debian-slim minimal images.

Plan of attack

Add a single apt-get install -y --no-install-recommends ca-certificates layer to Containerfile (before WORKDIR).
No changes needed in amnesia.py or fedi.py — this is purely a container packaging fix.
Will be fixed on branch fix/issue-41-42-container-fixes together with issue #42.

**Findings** `truststore` on Linux looks for the CA bundle at `/etc/ssl/certs/ca-certificates.crt`. That path is populated by the `ca-certificates` Debian package, which is absent on `debian-slim` minimal images. **Plan of attack** - Add a single `apt-get install -y --no-install-recommends ca-certificates` layer to `Containerfile` (before `WORKDIR`). - No changes needed in `amnesia.py` or `fedi.py` — this is purely a container packaging fix. - Will be fixed on branch `fix/issue-41-42-container-fixes` together with issue #42.