Support /etc/docker/certs.d/

[mattmoor]

Docker enables folks to use custom certs for their registries via this directory (and possibly environment variables). We should figure out how tools can support this, perhaps through support directly in the library, or perhaps through documentation on how to properly set up the http.RoundTripper passed into remote.Foo calls.

crane and ko would be good examples for how we add support for this to tools.

[karan]

Setting SSL_CERT_FILE to the ca file worked for me. However, transport-level config would be great as well.

[dprotaso]

Note: SSL_CERT_FILE only works on Linux/Unix and not Darwin/MacOS

[jonjohnsonjr]

I believe you can achieve the same thing on darwin by adding certificates to the system keychain: https://golang.org/src/crypto/x509/root_darwin.go

It seems like the only system without a workaround is windows: golang/go#16736

TBH having to maintain a separate, application-specific set of certificates under /etc/docker/certs.d/ like this seems like a huge antipattern to me, but I'm open to an explanation of why this is good or useful or necessary. We probably want to implement this regardless, for compatibility, but I don't love it.

[rosenhouse]

The value I see in per-registry certs is when my registry is for "dev" or "test" environment. I can generate a CA for it and not worry about the sensitivity of the secret, and be sure that the CA is trusted only for that one registry.

The alternative is adding a poorly-secured CA cert to my system's root trust bundle.