sam pipeline using docker:dind image fails on sam build with docker TLS error but manually doing sam build in same image works

I am connected to corporate VPN.

I created a hello world app to test sam pipeline with `sam init` and choose AWS hello world template - python/Zip. I copied `ca-bundle.pem` to `sam-app/hello_world/`.

On the same directory I did `sam pipeline init --bootstrap`, created `test` and `deploy` stage to the AWS account.

Before going any further, I wanted to see if manually running things works (if I find any issue with certificates or error, I would fix it with pre-scripts)
1. I provisioned a container off of image `docker:dind` with `docker run --privileged docker:dind`
2. Set environment variables from `.gitlab-ci.yaml` generated with `sam pipeline init --bootstrap`, certificate variables (`PIP_CONFIG_FILE`, `AWS_CA_BUNDLE`, `CURL_CA_BUNDLE`, `REQUESTS_CA_BUNDLE`), and additional Docker variables (`DOCKER_TLS_CERTDIR: "/certs"`, `DOCKER_CERT_PATH: "/certs/client"`, `DOCKER_HOST: "unix:///var/run/docker.sock"`)
3. Ran same pre-script (I added in some additional script with `update-ca-certificates` with `zscaler.crt`. Only then apk add works)
4. Ran `sam build --template template.yaml`. Worked as expected. Pulled in all the packages mentioned in requirements file into `.aws-sam/build`, etc.
5. Ran `sam package` and `sam deploy` from gitlab-ci.yaml. It worked.
6. I can access the REST API using `CURL` or from browser.

Manually running this works as expected.

I registered a `gitlab-runner` in my windows with `docker`. I set `AWS_ACCESS_KEY_ID`, and `AWS_SECRET_ACCESS_KEY` in Gitlab repository and pushed the code into Gitlab repository.

Everything works fine until `sam build --template {SAM_TEMPLATE}` (`SAM_TEMPLATE` variable is `sam-app/template.yaml`)

I get error with timeout from Amazon and TLS certificate error from Docker.

Full debug log of the same:

```
$ sam build --template ${SAM_TEMPLATE} --debug
2022-03-15 12:00:34,373 | Telemetry endpoint configured to be https://aws-serverless-tools-telemetry.us-west-2.amazonaws.com/metrics
2022-03-15 12:00:34,373 | Using config file: samconfig.toml, config environment: default
2022-03-15 12:00:34,373 | Expand command line arguments to:
2022-03-15 12:00:34,373 | --template_file=/builds/User/sam-hello-pipeline/sam-app/template.yaml --build_dir=.aws-sam/build --cache_dir=.aws-sam/cache
2022-03-15 12:00:34,805 | 'build' command is called
2022-03-15 12:00:34,821 | No Parameters detected in the template
2022-03-15 12:00:34,863 | There is no customer defined id or cdk path defined for resource HelloWorldFunction, so we will use the resource logical id as the resource id
2022-03-15 12:00:34,863 | There is no customer defined id or cdk path defined for resource ServerlessRestApi, so we will use the resource logical id as the resource id
2022-03-15 12:00:34,867 | 2 stacks found in the template
2022-03-15 12:00:34,867 | No Parameters detected in the template
2022-03-15 12:00:34,900 | There is no customer defined id or cdk path defined for resource HelloWorldFunction, so we will use the resource logical id as the resource id
2022-03-15 12:00:34,900 | There is no customer defined id or cdk path defined for resource ServerlessRestApi, so we will use the resource logical id as the resource id
2022-03-15 12:00:34,902 | 2 resources found in the stack
2022-03-15 12:00:34,903 | No Parameters detected in the template
2022-03-15 12:00:34,937 | There is no customer defined id or cdk path defined for resource HelloWorldFunction, so we will use the resource logical id as the resource id
2022-03-15 12:00:34,937 | There is no customer defined id or cdk path defined for resource ServerlessRestApi, so we will use the resource logical id as the resource id
2022-03-15 12:00:34,940 | Found Serverless function with name='HelloWorldFunction' and CodeUri='hello_world/'
2022-03-15 12:00:34,940 | --base-dir is not presented, adjusting uri hello_world/ relative to /builds/User/sam-hello-pipeline/sam-app/template.yaml
2022-03-15 12:00:34,940 | No Parameters detected in the template
2022-03-15 12:00:34,978 | There is no customer defined id or cdk path defined for resource HelloWorldFunction, so we will use the resource logical id as the resource id
2022-03-15 12:00:34,979 | There is no customer defined id or cdk path defined for resource ServerlessRestApi, so we will use the resource logical id as the resource id
2022-03-15 12:00:35,000 | No Parameters detected in the template
2022-03-15 12:00:35,037 | There is no customer defined id or cdk path defined for resource HelloWorldFunction, so we will use the resource logical id as the resource id
2022-03-15 12:00:35,037 | There is no customer defined id or cdk path defined for resource ServerlessRestApi, so we will use the resource logical id as the resource id
2022-03-15 12:00:35,039 | Your template contains a resource with logical ID "ServerlessRestApi", which is a reserved logical ID in AWS SAM. It could result in unexpected behaviors and is not recommended.
Traceback (most recent call last):
File "/usr/bin/sam", line 8, in
sys.exit(cli())
File "/usr/lib/python3.9/site-packages/click/core.py", line 829, in __call__
return self.main(*args, **kwargs)
File "/usr/lib/python3.9/site-packages/click/core.py", line 782, in main
rv = self.invoke(ctx)
File "/usr/lib/python3.9/site-packages/click/core.py", line 1259, in invoke
return _process_result(sub_ctx.command.invoke(sub_ctx))
File "/usr/lib/python3.9/site-packages/click/core.py", line 1066, in invoke
return ctx.invoke(self.callback, **ctx.params)
File "/usr/lib/python3.9/site-packages/click/core.py", line 610, in invoke
return callback(*args, **kwargs)
File "/usr/lib/python3.9/site-packages/click/decorators.py", line 73, in new_func
return ctx.invoke(f, obj, *args, **kwargs)
File "/usr/lib/python3.9/site-packages/click/core.py", line 610, in invoke
return callback(*args, **kwargs)
File "/usr/lib/python3.9/site-packages/samcli/lib/telemetry/metric.py", line 166, in wrapped
raise exception # pylint: disable=raising-bad-type
File "/usr/lib/python3.9/site-packages/samcli/lib/telemetry/metric.py", line 124, in wrapped
return_value = func(*args, **kwargs)
File "/usr/lib/python3.9/site-packages/samcli/lib/utils/version_checker.py", line 41, in wrapped
actual_result = func(*args, **kwargs)
File "/usr/lib/python3.9/site-packages/samcli/cli/main.py", line 87, in wrapper
return func(*args, **kwargs)
File "/usr/lib/python3.9/site-packages/samcli/commands/build/command.py", line 174, in cli
do_cli(
File "/usr/lib/python3.9/site-packages/samcli/commands/build/command.py", line 251, in do_cli
ctx.run()
File "/usr/lib/python3.9/site-packages/samcli/commands/build/build_context.py", line 169, in run
builder = ApplicationBuilder(
File "/usr/lib/python3.9/site-packages/samcli/lib/build/app_builder.py", line 168, in __init__
self._docker_client = docker_client if docker_client else docker.from_env()
File "/usr/lib/python3.9/site-packages/docker/client.py", line 85, in from_env
timeout=timeout, version=version, **kwargs_from_env(**kwargs)
File "/usr/lib/python3.9/site-packages/docker/utils/utils.py", line 361, in kwargs_from_env
params['tls'] = tls.TLSConfig(
File "/usr/lib/python3.9/site-packages/docker/tls.py", line 80, in __init__
raise errors.TLSParameterError(
docker.errors.TLSParameterError: Path to a certificate and key files must be provided through the client_config param. TLS configurations should map the Docker CLI client configurations. See https://docs.docker.com/engine/articles/https/ for API details.
Cleaning up project directory and file based variables
00:03
ERROR: Job failed: exit code 1
```

I checked the /usr/lib/python3.9/site-packages/docker/tls.py on how the exception is being thrown:

```
if not (tls_cert and tls_key) or (not os.path.isfile(tls_cert) or not os.path.isfile(tls_key)):
raise errors.TLSParameterError('Path to a certificate and key files must be providedthrough the client_config param')
```

I went through `DOCKER_TLS_CERTDIR`, i.e., /certs. I found three directories `ca`, `client`, `server`.

I went though `client` and found `ca.pem`, `cert.pem`, `csr.pem`, `key.pem`, and `openssl.conf`.

Certificate looks like it is in place.

Gitlab runner environment: Windows
config:
```
[[runners]]
name = "name"
url = "https://hostname/"
token = "token"
executor = "docker"
[runners.custom_build_dir]
[runners.cache]
[runners.cache.s3]
[runners.cache.gcs]
[runners.cache.azure]
[runners.docker]
tls_verify = false
image = "docker:dind"
privileged = false
disable_entrypoint_overwrite = false
oom_kill_disable = false
disable_cache = false
volumes = ["/cache"]
shm_size = 0
```
Docker Desktop version in Windows: Docker Desktop 4.5.1 (74721)
AWS SAM version: 1.40.1
AWS CLI version: 1.22.74
(Both AWS SAM and AWS CLI was download through pre-script with pip install awscli aws-sam-cli)