Gitlab cloud runner docker pull throw certificate has expired or is not yet valid exception

GitLab CI/CD
, ,
1

Overview

I’m trying to build docker image in gitlab.com cloud runner but it fails with:

...
$ docker build -t ${CONTAINER_IMAGE} .
Step 1 : FROM node:21-alpine
21-alpine: Pulling from library/node
4abcf2066143: Pulling fs layer
62af34686b6b: Pulling fs layer
87cba792d632: Pulling fs layer
67eb332999b7: Pulling fs layer
67eb332999b7: Waiting
error pulling image configuration: Get https://production.cloudflare.docker.com/registry-v2/docker/registry/v2/blobs/sha256/cc/cc08f601c4a2da4b0eb9c24d27d044a86af1485b69656f10f1b625e11157a796/data?verify=1713129602-kg1o6eq6sZwNc%2FlzNUkAu%2BRhPkk%3D: x509: certificate has expired or is not yet valid
Cleaning up project directory and file based variables
00:00
ERROR: Job failed: exit code 1

This is my .gitlab-ci.yml config:

stages:
  - docker

docker-build:
  image: gitlab/dind
  stage:
    docker
  services:
    - docker:dind
  variables:
    CONTAINER_IMAGE: registry.gitlab.com/$CI_PROJECT_PATH:${CI_COMMIT_REF_NAME}
  script:
    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
    - docker build -t ${CONTAINER_IMAGE} .
    - docker push ${CONTAINER_IMAGE}
  only:
    - tags

This is my Dockerfile:


FROM node:21-alpine

WORKDIR /app
COPY package.json .

RUN yarn install --frozen-lockfile

COPY . .

RUN yarn build

ENV NODE_ENV production

EXPOSE 3000

ENV PORT 3000

CMD ["yarn", "start"]

Here is the full log from the gitlab runner:

Running with gitlab-runner 16.11.0~pre.21.gaa21be2d (aa21be2d)
  on blue-1.saas-linux-small.runners-manager.gitlab.com/default j1aLDqxS, system ID: s_ccdc2f364be8
  feature flags: FF_USE_IMPROVED_URL_MASKING:true
Preparing the "docker+machine" executor
00:38
Using Docker executor with image gitlab/dind ...
Starting service docker:dind ...
Pulling docker image docker:dind ...
Using docker image sha256:1eeb10c9d6c50079f0303574f312ad616070f07af8f874410e7967270751d1f5 for docker:dind with digest docker@sha256:a2d55c6061a342e42db62654b7b7cdf16113828a80b3827cbd9453806c08549c ...
Waiting for services to be up and running (timeout 30 seconds)...
Pulling docker image gitlab/dind ...
Using docker image sha256:cc674e878f23bdc3c36cc37596d31adaa23bca0fc3ed18bea9b59abc638602e1 for gitlab/dind with digest gitlab/dind@sha256:da5d8fabf924951430ff844add85ac780d38c51315b862241f5196b4422070cc ...
Preparing environment
00:05
Running on runner-j1aldqxs-project-55920795-concurrent-0 via runner-j1aldqxs-s-l-s-amd64-1713126452-c29bf7bd...
Getting source from Git repository
00:05
Fetching changes with git depth set to 20...
Initialized empty Git repository in /builds/gama8364611/gama-website/.git/
Created fresh repository.
Checking out 4ab10ccd as detached HEAD (ref is 1.1.0)...
Skipping Git submodules setup
$ git remote set-url origin "${CI_REPOSITORY_URL}"
Executing "step_script" stage of the job script
00:05
Using docker image sha256:cc674e878f23bdc3c36cc37596d31adaa23bca0fc3ed18bea9b59abc638602e1 for gitlab/dind with digest gitlab/dind@sha256:da5d8fabf924951430ff844add85ac780d38c51315b862241f5196b4422070cc ...
ln: failed to create symbolic link '/sys/fs/cgroup/systemd/name=systemd': Operation not permitted
$ docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
Login Succeeded
$ docker build -t ${CONTAINER_IMAGE} .
Step 1 : FROM node:21-alpine
21-alpine: Pulling from library/node
4abcf2066143: Pulling fs layer
62af34686b6b: Pulling fs layer
87cba792d632: Pulling fs layer
67eb332999b7: Pulling fs layer
67eb332999b7: Waiting
error pulling image configuration: Get https://production.cloudflare.docker.com/registry-v2/docker/registry/v2/blobs/sha256/cc/cc08f601c4a2da4b0eb9c24d27d044a86af1485b69656f10f1b625e11157a796/data?verify=1713129602-kg1o6eq6sZwNc%2FlzNUkAu%2BRhPkk%3D: x509: certificate has expired or is not yet valid
Cleaning up project directory and file based variables
00:00
ERROR: Job failed: exit code 1

Expected result

This is a super straightforward scenario that was working a few hours ago. I guess you need to update the certificate on your public runners.

2

I fixed my issue. The problem is with image: gitlab/dind that I used during my build. To fix the issue I replaced it with image: docker so my .gitlab-ci.yml config looks like this now:

stages:
  - docker

docker-build:
  stage:
    docker
  image: docker
  services:
    - docker:dind
  variables:
    CONTAINER_IMAGE: registry.gitlab.com/$CI_PROJECT_PATH:${CI_COMMIT_REF_NAME}
  script:
    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
    - docker build -t ${CONTAINER_IMAGE} .
    - docker push ${CONTAINER_IMAGE}
  only:
    - tags

I saw that gitlab/dind last update in docker hub was 8 years ago: Docker So maybe gitlab needs to update this image to fix the issue. Since then you need to migrate to another base image.