This repository was archived by the owner on Oct 13, 2026. It is now read-only.
Repository navigation
Detect corporate TLS interception from inside a container - #1
Merged
Merged
Conversation
Students on corporate laptops hit "unable to get local issuer certificate" only when the Lab 06 / capstone GitHub Actions runner container tries to register — every existing preflight check (git, gh, docker pull) passes because those use the host's trust store, where IT has installed the proxy's root CA. The runner image only trusts its own CA bundle. New required check "GitHub from inside a container": probes api.github.com, github.com and pipelines.actions.githubusercontent.com from a pinned curlimages/curl container. curl exit 60 is reported as TLS interception with the issuer of the certificate the container saw; other failures point at Docker's proxy settings. If ~/corp-root.crt exists and makes the probe verify, the check passes with a reminder about the compose override, so a student who has done the fix sees green. troubleshooting.md gains a full walkthrough: exporting the root CA per OS, re-running the preflight, a tested docker-compose.corp-ca.yaml override for the runner (update-ca-certificates wrapper + NODE_EXTRA_CA_CERTS for JS actions) enabled via COMPOSE_FILE in .env, and what to do when IT won't release the certificate. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- Redact user:password@ from proxy URLs before they land in the report (students paste it into Discord). - Reject a corp-root.crt that holds no self-signed certificate: curl accepts a partial chain so an exported intermediate turned the check green, while update-ca-certificates in the runner needs the root. - Name the "~/corp-root.crt is a directory" case, which Docker produces when the compose override runs before the file exists. - Report host-side curl exit 60 as a missing CA in this OS/WSL distro instead of a generic connectivity failure, with a doc section for it. - After the corporate CA rescues the first failing host, re-probe every GitHub host with it rather than declaring victory on one. - Compose override: long bind syntax with create_host_path: false so a missing cert is an error, and an openssl verify guard that prints why the runner refused to start instead of exiting silently. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was referenced Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Students on corporate laptops hit
unable to get local issuer certificate— but only in Lab 06 / the capstone, when the GitHub Actions runner container tries to register. Every existing preflight check passes on those machines:git,ghanddocker pullall use the host's trust store, where IT has installed the intercepting proxy's root CA. A container only trusts the CA bundle baked into its image, so nothing in the preflight caught it and it surfaced mid-course.What
New required check — "GitHub from inside a container" (
scripts/preflight.sh, placed before the slow image pull):api.github.comfirst (otherwise the problem is upstream of Docker).curlimages/curl:8.14.1container, GETsapi.github.com,github.comandpipelines.actions.githubusercontent.com— the hosts the runner needs. Any HTTP response counts; only transport/TLS failures matter. One retry per host, except curl exit 60 which is deterministic.Zscaler Root CAetc.) so the TA can read it straight off the report.~/corp-root.crtexists and makes the probe verify, the check passes with a reminder about the compose override — so a student who has done the fix sees green rather than a red check they've already dealt with. A cert that exists but doesn't help gets its own message.troubleshooting.md— full walkthrough: exporting the root CA per OS (with theissuer:hint andcertlm.mscfor the Windows machine store), re-running the preflight, a testeddocker-compose.corp-ca.yamloverride for the runner (update-ca-certificateswrapper +NODE_EXTRA_CA_CERTSfor JS actions, enabled viaCOMPOSE_FILEin.env), and options when IT won't release the certificate. Plus a short section for the non-certificate "containers can't get out" case.README.md— table row.Verified
bash -n+ shellcheck (same as CI) clean.myoung34/github-runner:latest: CA installed and verified against the rebuilt bundle, CMD forwarded intact, real entrypoint reached the "Configuring" banner.Follow-up (not in this PR)
Ship
docker-compose.corp-ca.yamlinside Lab 06 andcapstone/with a commented-outCOMPOSE_FILE=line in their.env.example, so the fix is "uncomment one line" instead of creating the file by hand.🤖 Generated with Claude Code