Git LFS give x509: certificate signed by unknown authority

症狀:

使用Git LFS管理檔案時，進行push或pull如果有產生x509錯誤，就表示該網域名稱沒有取得認證。這種狀況會比較常發生在實驗室內有Self-hosted的git server同時搭配self-hosted DNS。

狀況1. 要進行git clone時的解決辦法

GIT_SSL_NO_VERIFY=1 git clone ...  <==適合用在要進行clone的時候

假設已經都clone下來了，但是在推拉lfs的時候出問題，就到該repo的資料夾底下

git config http.sslverify false
狀況2. 發生在gitlab-runner進行ci的時候
這時候如果把上面的指令光是寫到yml是沒有用的，只能透過註冊在variables裡面，例如:
stages:
  - build
  - test
  - release
  - deploy

variables:
  REGISTRY_URL: "192.168.71.204/"
  CONTAINER_NAME: "xxxx:xxxx"
  GIT_SSL_NO_VERIFY: "true"

Ref:

https://stackoverflow.com/questions/60349972/git-lfs-give-x509-certificate-signed-by-unknown-authority

https://gitlab.com/gitlab-org/gitlab-runner/-/issues/3417

runtime/cgo: pthread_create failed: Operation not permitted

 跑docker的時候噴錯如下:

runtime/cgo: pthread_create failed: Operation not permitted

SIGABRT: abort

PC=0x7f1fd83469fc m=0 sigcode=18446744073709551610

goroutine 0 gp=0x12690280 m=0 mp=0x12691580 [idle]:

runtime: g 0 gp=0x12690280: unknown pc 0x7f1fd83469fc

stack: frame={sp:0x7fffa7f376c0, fp:0x0} stack=[0x7fffa773a000,0x7fffa7f37c20)

0x00007fffa7f375c0:  0x0002f7ff0002ebe1  0x0002ffff0002fa1e

0x00007fffa7f375d0:  0x000e00ff0003134b  0x0010ffff000e01f0

0x00007fffa7f375e0:  0x0000000000000000  0x0000000000000000

0x00007fffa7f375f0:  0x0000000000000000  0x0000000000000000

0x00007fffa7f37600:  0x0002a6ff0002a6de  0x0002b73f0002b735

0x00007fffa7f37610:  0x0002b81f0002b81e  0x0002ceaf0002cea2

0x00007fffa7f37620:  0x0000000000000000  0x0000000000000000

0x00007fffa7f37630:  0x0000000000000000  0x0000000000000000

0x00007fffa7f37640:  0x0001faff0001fad7  0x0001fb930001fb93

0x00007fffa7f37650:  0x0001fbef0001fbcb  0x0001ffff0001fbfa

0x00007fffa7f37660:  0x0000000000000000  0x0000000000000000

0x00007fffa7f37670:  0x0000000000000000  0x0000000000000000

0x00007fffa7f37680:  0x0001fa8f0001fa87  0x0001faaf0001faa9

0x00007fffa7f37690:  0x0001fabf0001fab7  0x0001facf0001fac3

0x00007fffa7f376a0:  0x0000000000000000  0x0000000000000000

0x00007fffa7f376b0:  0x0000000000000000  0x00007f1fd83469ee

0x00007fffa7f376c0: <0x0000000000000000  0x0000000000000000

0x00007fffa7f376d0:  0x0000000000000000  0x0000000000000000

0x00007fffa7f376e0:  0x0000000000000000  0x0000000000000000

0x00007fffa7f376f0:  0x0000000000000000  0x0000000000000000

0x00007fffa7f37700:  0x0000000000000000  0x0000000000000000

0x00007fffa7f37710:  0x0000000000000000  0x0000000000000000

0x00007fffa7f37720:  0x0000000000000000  0x0000000000000000

0x00007fffa7f37730:  0x0000000000000000  0x0000000000000000

0x00007fffa7f37740:  0x0000000000000000  0x374c47a345892e00

0x00007fffa7f37750:  0x00007f1fd82af3c0  0x0000000000000006

0x00007fffa7f37760:  0x0000000000000001  0x00007fffa7f37a90

0x00007fffa7f37770:  0x0000000012690280  0x00007f1fd82f2476

0x00007fffa7f37780:  0x00007f1fd84cbe90  0x00007f1fd82d87f3

0x00007fffa7f37790:  0x0000000000000020  0x0000000000000000

0x00007fffa7f377a0:  0x0000000000000000  0x0000000000000000

0x00007fffa7f377b0:  0x0000000000000000  0x0000000000000000

runtime: g 0 gp=0x12690280: unknown pc 0x7f1fd83469fc

stack: frame={sp:0x7fffa7f376c0, fp:0x0} stack=[0x7fffa773a000,0x7fffa7f37c20)

.......

解決辦法:

在Docker前使用 --security-opt seccomp=unconfined  

e.g.,

docker run -it --rm --security-opt seccomp=unconfined ollama/ollama