Install apk packages behind a proxy or with a custom CA

"certificate verify failed" (custom CA)

Add your organization's CA certificate before running apk:

USER root
COPY corp-ca.crt /usr/local/share/ca-certificates/corp-ca.crt
RUN update-ca-certificates
RUN apk add --no-cache <package>

"Permission denied" fetching from apk.cgr.dev

Pulling Chainguard APK packages requires authentication and entitlement. The APK audience for token exchange is apk.cgr.dev. Confirm your build has valid credentials and that your organization is entitled to the packages you are installing. For how to authenticate, see Authenticate to the Chainguard registry.

Production (distroless) images

Production images do not include apk. Install packages in a -dev stage and copy the result into the final stage, or use a custom image build.