Configuring Docker to Work with Zscaler Proxies

--- title: Using Docker with Zscaler tags: [networking, admin] summary: | This guide explains how to embed Zscaler’s root certificate into Docker images, allowing containers to operate securely with Zscaler proxies and avoid SSL errors. params: time: 10 minutes --- In many corporate environments, network traffic is intercepted and monitored using HTTPS proxies, such as Zscaler. While Zscaler ensures security compliance and network control, it can cause issues for developers using Docker, particularly during build processes, where SSL certificate validation errors might occur. This guide outlines how to configure Docker containers and builds to properly handle Zscaler's custom certificates, ensuring smooth operation in monitored environments. ## The role of certificates in Docker When Docker builds or runs containers, it often needs to fetch resources from the internet—whether it's pulling a base image from a registry, downloading dependencies, or communicating with external services. In a proxied environment, Zscaler intercepts HTTPS traffic and replaces the remote server's certificate with its own. However, Docker doesn't trust this Zscaler certificate by default, leading to SSL errors. ```plaintext x509: certificate signed by unknown authority ``` These errors occur because Docker cannot verify the validity of the certificate presented by Zscaler. To avoid this, you must configure Docker to trust Zscaler's certificate. ## Configure Zscaler proxy for Docker Desktop Depending on how Zscaler is deployed, you may need to configure Docker Desktop proxy settings manually to use the Zscaler proxy. If you're using Zscaler as a system-level proxy via the [Zscaler Client Connector](https://help.zscaler.com/zscaler-client-connector/what-is-zscaler-client-connector), all traffic on the device is automatically routed through Zscaler, so Docker Desktop uses the Zscaler proxy automatically with no additional configuration necessary. If you are not using Zscaler as a system-level proxy, manually configure proxy settings in Docker Desktop. Set up proxy settings for all clients in the organization using [Settings Management](/manuals/security/for-admins/hardened-desktop/settings-management/_index.md), or edit proxy configuration in the Docker Desktop GUI under [**Settings > Resources > Proxies**](/manuals/desktop/settings-and-maintenance/settings.md#proxies). ## Install root certificates in Docker images To enable containers to use and trust the Zscaler proxy, embed the certificate in the image and configure the image's trust store. Installing certificates at image build time is the preferred approach, as it removes the need for configuration during startup and provides an auditable, consistent environment. ### Obtaining the root certificate The easiest way to obtain the root certificate is to export it from a machine where an administrator has already installed it. You can use either a web browser or the system's certificate management service (for example, Windows

This document explains how to configure Docker to work with Zscaler proxies, focusing on embedding Zscaler's root certificate into Docker images to avoid SSL errors. It covers the role of certificates in Docker, configuring Zscaler proxy settings for Docker Desktop, and installing root certificates within Docker images for secure operation in environments using Zscaler for traffic interception and monitoring.