Self signed certificate cannot be authenticated

Contributing guidelines

• I've read the contributing guidelines and wholeheartedly agree

I've found a bug and checked that ...

• ... the documentation does not mention anything about my problem
• ... there are no open or closed issues that are related to my problem

Description

ERROR: failed to solve: failed to push www.harbor.com/king/taxi-bus-server:0.1.9: failed to authorize: failed to fetch oauth token: Post "https://www.harbor.com/service/token": tls: failed to verify certificate: x509: certificate signed by unknown authority

Expected behaviour

Can be pushed normally

Actual behaviour

I searched for historical discussions and feedback on issues, but I still couldn't find a solution. I configured Toml and copied the certificate into the container. But x509 will still appear, but I can push normally using Docker Push

Buildx version

github.com/docker/buildx v0.10.5 86bdced

Docker info

Client: Docker Engine - Community
 Version:    24.0.2
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.10.5
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.18.1
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 10
  Running: 10
  Paused: 0
  Stopped: 0
 Images: 19
 Server Version: 24.0.2
 Storage Driver: overlay2
  Backing Filesystem: xfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 3dce8eb055cbb6872793272b4f20ed16117344f8
 runc version: v1.1.7-0-g860f061
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
 Kernel Version: 3.10.0-1160.90.1.el7.x86_64
 Operating System: CentOS Linux 7 (Core)
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 7.637GiB
 Name: harbor
 ID: f21487ee-68a3-48d6-997c-1df4e3577f87
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  www.harbor.com
  127.0.0.0/8
 Registry Mirrors:
  https://3ighvcgt.mirror.aliyuncs.com/
 Live Restore Enabled: false

Builders list

kingbuilder *  docker-container                                                          
  kingbuilder0 unix:///var/run/docker.sock running 81cd697                               linux/amd64, linux/386
default        docker                                                                    
  default      default                     running v0.11.7-0.20230525183624-798ad6b0ce9f linux/amd64, linux/386

Configuration

FROM azul/zulu-openjdk:8-jre-headless-latest

RUN mkdir -p /app
WORKDIR /app
COPY ./target/yudao-server.jar app.jar
ENV TZ=Asia/Shanghai
ENTRYPOINT ["java","-jar","app.jar"]

docker buildx build --platform linux/amd64,linux/arm64 -t www.harbor.com/king/taxi-bus-server:0.1.9 --push .

Build logs

[+] Building 4.8s (17/17) FINISHED                                                                                                                                                
 => [internal] load build definition from Dockerfile                                                                                                                         0.1s
 => => transferring dockerfile: 583B                                                                                                                                         0.0s
 => [linux/amd64 internal] load metadata for docker.io/azul/zulu-openjdk:8-jre-headless-latest                                                                               1.8s
 => [linux/arm64 internal] load metadata for docker.io/azul/zulu-openjdk:8-jre-headless-latest                                                                               1.9s
 => [internal] load .dockerignore                                                                                                                                            0.1s
 => => transferring context: 2B                                                                                                                                              0.0s
 => [linux/amd64 1/4] FROM docker.io/azul/zulu-openjdk:8-jre-headless-latest@sha256:d73a99fee1fa81ba16f6fb37998be6204d7e9dac81c4e2cc0b645c2820d37cca                         0.3s
 => => resolve docker.io/azul/zulu-openjdk:8-jre-headless-latest@sha256:d73a99fee1fa81ba16f6fb37998be6204d7e9dac81c4e2cc0b645c2820d37cca                                     0.3s
 => [internal] load build context                                                                                                                                            0.1s
 => => transferring context: 179B                                                                                                                                            0.0s
 => [linux/arm64 1/4] FROM docker.io/azul/zulu-openjdk:8-jre-headless-latest@sha256:d73a99fee1fa81ba16f6fb37998be6204d7e9dac81c4e2cc0b645c2820d37cca                         0.3s
 => => resolve docker.io/azul/zulu-openjdk:8-jre-headless-latest@sha256:d73a99fee1fa81ba16f6fb37998be6204d7e9dac81c4e2cc0b645c2820d37cca                                     0.3s
 => CACHED [linux/amd64 2/4] RUN mkdir -p /app                                                                                                                               0.0s
 => CACHED [linux/amd64 3/4] WORKDIR /app                                                                                                                                    0.0s
 => CACHED [linux/amd64 4/4] COPY ./target/yudao-server.jar app.jar                                                                                                          0.0s
 => CACHED [linux/arm64 2/4] RUN mkdir -p /app                                                                                                                               0.0s
 => CACHED [linux/arm64 3/4] WORKDIR /app                                                                                                                                    0.0s
 => CACHED [linux/arm64 4/4] COPY ./target/yudao-server.jar app.jar                                                                                                          0.0s
 => ERROR exporting to image                                                                                                                                                 1.6s
 => => exporting layers                                                                                                                                                      0.0s
 => => exporting manifest sha256:24986b7a9a2a90be027deacd9af996e85a0918638f4af9c047e4ab4173b63c6f                                                                            0.1s
 => => exporting config sha256:e2550a7cbbc72a19c26d151ef15b01e081870fd0d2d12c3dcd99df44319a6330                                                                              0.1s
 => => exporting attestation manifest sha256:b45acfa2ff21ee3949e38051bd71665b6c82f5237252b9700494ece5cf559954                                                                0.3s
 => => exporting manifest sha256:48093dce8b9e6d95234a7955036a743315d76fe599d3ed229804036ec71ead32                                                                            0.1s
 => => exporting config sha256:afdf5369c4787d7a11563750094f2e9a9ef768e0b3c9ca46c44cb69c713489c4                                                                              0.1s
 => => exporting attestation manifest sha256:c9629a393c4c893ec8255dd33a528e905cfe1245f88c735a585140b8cb2d31d9                                                                0.2s
 => => exporting manifest list sha256:85244e7cd337ebd6f533946e6d59f830ddf7a0633fa02a1d4b91befb1288790b                                                                       0.1s
 => => pushing layers                                                                                                                                                        0.0s
 => [auth] king/taxi-bus-server:pull,push token for www.harbor.com                                                                                                           0.0s
 => [auth] king/taxi-bus-server:pull,push token for www.harbor.com                                                                                                           0.0s
 => [auth] king/taxi-bus-server:pull,push token for www.harbor.com                                                                                                           0.0s
------
 > exporting to image:
------
ERROR: failed to solve: failed to push www.harbor.com/king/taxi-bus-server:0.1.9: failed to authorize: failed to fetch oauth token: Post "https://www.harbor.com/service/token": tls: failed to verify certificate: x509: certificate signed by unknown authority

Additional info

debug = true

insecure-entitlements = [ "network.host", "security.insecure" ]


[registry."www.harbor.com"]
  mirrors = [
    "3ighvcgt.mirror.aliyuncs.com"
  ]
  insecure = true
  ca=["/etc/buildkit/www.harbor.com.crt"]
  [[registry."www.harbor.com".keypair]]
    key="/etc/buildkit/www.harbor.com.key"
    cert="/etc/buildkit/www.harbor.com.cert"

Start with the docker buildx build --push command, the Dockerfile, and the [registry."www.harbor.com"] configuration, reproducing the token-fetch failure with the docker-container builder. Compare this behavior with docker push; done means the self-signed Harbor certificate is accepted during Buildx authentication or the issue is narrowed to a documented configuration limitation.