DEV Community

Dan Benitah
Dan Benitah

Posted on

Fixing Podman Image Pulls Behind Zscaler on Windows

#containers #zscaler #docker

When using Podman on Windows behind Zscaler, image pulls can fail because the Podman Linux VM does not trust the Zscaler root certificate, even though Windows does.

> podman pull --tls-verify=false mcr.microsoft.com/k8se/services/codeinterpreter:0.9.18-python3.12
Trying to pull mcr.microsoft.com/k8se/services/codeinterpreter:0.9.18-python3.12...
Error: unable to copy from source docker://mcr.microsoft.com/k8se/services/codeinterpreter:0.9.18-python3.12: initializing source docker://mcr.microsoft.com/k8se/services/codeinterpreter:0.9.18-python3.12: pinging container registry mcr.microsoft.com: Get "http://mcr.microsoft.com/v2/": proxyconnect tcp: dial tcp: lookup socks=127.0.0.1: no such host
Enter fullscreen mode Exit fullscreen mode

Using --tls-verify=false may not be enough. The reliable fix is to export the Zscaler CA from Windows and install it into the Podman VM.

1. Find the Zscaler certificate

In PowerShell:

$cert = Get-ChildItem Cert:\CurrentUser\Root |
    Where-Object {
        $_.Subject -match "Zscaler" -or
        $_.Issuer -match "Zscaler"
    } |
    Select-Object -First 1

$cert | Format-List Subject, Issuer, Thumbprint
Enter fullscreen mode Exit fullscreen mode

If it isn't present there, also check:

Get-ChildItem Cert:\LocalMachine\Root |
    Where-Object {
        $_.Subject -match "Zscaler" -or
        $_.Issuer -match "Zscaler"
    }
Enter fullscreen mode Exit fullscreen mode

For me it was called Zscaler but I do not know what the convention is. So if it cannot find it, try and open regedit to check for an equivalent.

2. Export it as PEM 

$cerFile = "$env:TEMP\zscaler.cer"
$pemFile = "$env:TEMP\zscaler.pem"

Export-Certificate `
    -Cert $cert `
    -FilePath $cerFile `
    -Force

certutil -encode $cerFile $pemFile
Enter fullscreen mode Exit fullscreen mode

The resulting file should contain:

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
Enter fullscreen mode Exit fullscreen mode

3. Install it into the Podman VM

Start Podman if necessary:

podman machine start
Enter fullscreen mode Exit fullscreen mode

Encode the certificate so it can safely be sent through SSH:

$pem = Get-Content $pemFile -Raw

$base64 = [Convert]::ToBase64String(
    [Text.Encoding]::ASCII.GetBytes($pem)
)
Enter fullscreen mode Exit fullscreen mode

Then install it into the Podman VM trust store:

podman machine ssh `
    "echo '$base64' | base64 -d | sudo tee /etc/pki/ca-trust/source/anchors/zscaler.crt > /dev/null && sudo update-ca-trust"
Enter fullscreen mode Exit fullscreen mode

4. Verify connectivity

Test HTTPS from inside the Podman VM:

podman machine ssh "curl -Iv https://mcr.microsoft.com/v2/"
Enter fullscreen mode Exit fullscreen mode

A 401 Unauthorized response from /v2/ is fine — it means TLS and connectivity are working.

You should no longer see errors such as:

certificate signed by unknown authority
Enter fullscreen mode Exit fullscreen mode

5. Pull the image normally

For example:

podman pull mcr.microsoft.com/k8se/services/codeinterpreter:0.9.18-python3.12
Enter fullscreen mode Exit fullscreen mode

No --tls-verify=false is required.

Why this works

Podman on Windows runs Linux containers inside its own Linux/WSL VM. Windows may already trust the corporate Zscaler CA, but the Podman VM has a separate certificate trust store.

Installing the Zscaler root CA under:

/etc/pki/ca-trust/source/anchors/
Enter fullscreen mode Exit fullscreen mode

and running:

sudo update-ca-trust
Enter fullscreen mode Exit fullscreen mode

allows Podman and other tools inside the VM to validate HTTPS connections intercepted by Zscaler normally.

Top comments (0)