[Bug]: The HttpClient used by Testcontainer.Net does not respect DOCKER_TLS_VERIFY

[prochnowc]

Testcontainers version

4.10

Using the latest Testcontainers version?

Yes

Host OS

Linux

Host arch

x64

.NET version

10.0.2

Docker version

28.5.2

Docker info

Doesnt matter i guess.

What happened?

We are using Testcontainers in a build pipeline which runs inside a container. We use Docker In Docker container where the host only allows secure connections and has a self signed certificate.

Setting DOCKER_TLS_VERIFY: "false" works so far for the docker client, but Testcontainers gives the following error:

 System.AggregateException : One or more errors occurred. (Failed to connect to Docker endpoint at 'tcp://docker:2376/'.) (Failed to connect to Docker endpoint at 'tcp://docker:2376/'.) (Failed to connect to Docker endpoint at 'unix:///var/run/docker.sock'.) (Failed to connect to Docker endpoint at 'tcp://docker:2376/'.)
------------ DotNet.Testcontainers.Builders.DockerUnavailableException : Failed to connect to Docker endpoint at 'tcp://docker:2376/'.
---------------- System.Security.Authentication.AuthenticationException : Authentication failed, see inner exception.
-------------------- Interop+OpenSsl+SslException : SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL.
------------------------ Interop+Crypto+OpenSslCryptographicException : error:0A000412:SSL routines::sslv3 alert bad certificate

Relevant log output

Additional information

No response

[coderabbitai]

📝 CodeRabbit Plan Mode

Generate an implementation plan and prompts that you can use with your favorite coding agent.

• Create Plan

Examples

• Example 1
• Example 2

---

🔗 Related PRs

#1576 - feat: Support configuring Docker API version [merged]

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[HofmeisterAn]

Did you configure and set the directory path that contains the client certificate? Your configuration should look something like:

DOCKER_HOST=tcp://<host>:<port>
DOCKER_CERT_PATH=.../client
DOCKER_TLS=true
DOCKER_TLS_VERIFY=false

[prochnowc]

No, I dont have the client certificate available, I would need to build my own DIND-Container which contains these certificates. That's why I just want to disable TLS verification - it runs in a separate isolated environment, so I would rather simply disable TLS verification instead of maintaining my own container.

But yeah, as I said. The docker client itself works fine with "DOCKER_TLS_VERIFY=false", only the Docker .NET client (and therefore Testcontainers) doesnt respect this env variable.

[HofmeisterAn]

No, I dont have the client certificate available, I would need to build my own DIND-Container which contains these certificates.

This isn't how it works. Setting DOCKER_TLS_VERIFY=false disables verification against a CA, but the traffic still needs to be encrypted. You must provide the certificates. If you don't want encrypted communication, use a plain connection on 2375.

[prochnowc]

I will check how I can inject the certificate, but anyways "DOCKER_TLS_VERIFY=false" doenst disable CA verification in Testcontainers, it applies only to the docker client.

Let me check with the injected certificate, I get back to you later.

[HofmeisterAn]

It's been a while since we added (M)TLS support. I've reviewed the tests and PR, and IIRC the client mode TLS still needs the CA (client/ca.pem). These are the client modes according to the Docker docs, what we've implemented and tested.

[prochnowc]

It's been a while since we added (M)TLS support. I've reviewed the tests and PR, and IIRC the client mode TLS still needs the CA (client/ca.pem). These are the client modes according to the Docker docs, what we've implemented and tested.

That is than a Bug I guess.

[HofmeisterAn]

That is than a Bug I guess.

Dunno. The docs are ambiguities:

tls: Authenticate server based on public/default CA pool

According to the discussion in the PR, it's necessary:

So if system trusted root CAs storage does not contain any valid ceritificate and ca.pem file is not available then the docke CLI client complains that ca.pem file si not available.

[HofmeisterAn]

I ran a quick local test, and the behavior is as described above. Without the CA certificate, the CLI client fails to connect too:

Failed to initialize: unable to resolve docker endpoint: open C:\Users\<username>\.docker\ca.pem: The system cannot find the file specified.

Tetcontainers for .NET doesn't explicitly support --tlscacert on its own, but it works used with DOCKER_CERT_PATH.

docker run --detach --privileged --publish 2376:2376 --volume "$(PWD):/certs" --env DOCKER_TLS_CERTDIR=/certs docker:dind

# ❌
docker --tls --host tcp://localhost:2376 info

# ✅
docker --tls --tlscacert .\client\ca.pem --host tcp://localhost:2376 info

[prochnowc]

@HofmeisterAn I also ran some quick tests, it shows that the client is supposed to work WITHOUT the CA certificate.

# docker --tlsverify=false --tlscacert="" -H=127.0.0.1:2376 version
Client:
 Version:           28.2.2
 API version:       1.50
 Go version:        go1.23.1
 Git commit:        28.2.2-0ubuntu1~24.04.1
 Built:             Wed Sep 10 14:16:39 2025
 OS/Arch:           linux/amd64
 Context:           default
Server:
 Engine:
  Version:          28.2.2
  API version:      1.50 (minimum version 1.24)
  Go version:       go1.23.1
  Git commit:       28.2.2-0ubuntu1~24.04.1
  Built:            Wed Sep 10 14:16:39 2025
  OS/Arch:          linux/amd64
  Experimental:     false
 ...

# docker --tlsverify --tlscacert="" -H=127.0.0.1:2376 version
Client:
 Version:           28.2.2
 API version:       1.50
 Go version:        go1.23.1
 Git commit:        28.2.2-0ubuntu1~24.04.1
 Built:             Wed Sep 10 14:16:39 2025
 OS/Arch:           linux/amd64
 Context:           default
error during connect: Get "https://127.0.0.1:2376/v1.50/version": tls: failed to verify certificate: x509: certificate signed by unknown authority

My assumption is, that the Dotnet Docker Client does not respect the "tlsverify" environment variable, do you think I should open a bug report there?

[prochnowc]

dotnet/Docker.DotNet#685