https://orbstack.dev logo
Powered by
/usr/local/share/ca-certificates not available in ...
# support
t
Hey there. I've got a compose file with a database and Keycloak set up. The directory 
/usr/local/share/ca-certificates
with 
orbstack-root.crt
in it exists in the database container, but not in the Keycloak one. The Keycloak one is where I need it. Why is that? Sample compose file:
Copy code
YAML
name: auth

services:
  db:
    image: postgres:18
    restart: unless-stopped
    volumes:
      - db:/var/lib/postgresql
    environment:
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: keycloak
      POSTGRES_DB: keycloak
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d keycloak -U keycloak"]
      interval: 5s
      timeout: 3s
      retries: 5

  iam:
    image: quay.io/keycloak/keycloak:26.5.3
    restart: unless-stopped
    command: start
    depends_on:
      db:
        condition: service_healthy
    environment:
      KC_CACHE: local
      KC_DB: postgres
      KC_DB_URL_HOST: db
      KC_DB_URL_DATABASE: keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
      KC_HTTP_ENABLED: true
      KC_PROXY_HEADERS: xforwarded
      KC_HOSTNAME: https://auth.local
    labels:
      - dev.orbstack.domains=auth.local
      - dev.orbstack.http-port=8080

volumes:
  db:
    name: auth-db
OrbStack info: Version: 2.0.5 Commit: cfe47627f138ffd822c958553b0a93eaf2692c71 (v2.0.5) System info: macOS: 15.7.4 (24G517) CPU: arm64, 11 cores CPU model: Apple M3 Pro Model: Mac15,6 Memory: 36 GiB Full report:
d
we don't add anything to containers unless they already have the relevant directories / files
t
I don't understand. What do you mean by this? Why does Postgres have the orbstack-root.crt file then?
d
because that directory exists in it
t
so unless the container has this specific directory, i cannot access the orbstack certificate?
d
it will be installed in some other location depending on what the container has
t
are the possible locations documented?
d
no
t
i didn't find anything in the docs
i see, which locations could it be then?
d
Copy code
/etc/ssl/certs
/usr/local/share/certs
/etc/pki/tls/certs
/etc/openssl/certs
/var/ssl/certs
/usr/local/share/ca-certificates
/etc/pki/ca-trust/source/anchors
/etc/ca-certificates/trust-source/anchors
/etc/ssl/certs/ca-certificates.crt
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/ca-bundle.pem
/etc/pki/tls/cacert.pem
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
/etc/ssl/cert.pem
t
that's quite the list, thank you!
2 Views
PreviousNext
Powered by