# Doppler run in a Docker Image Created with Nix Gets a Certificate Signed by Unkown Authority Error

**URL:** <https://community.doppler.com/t/doppler-run-in-a-docker-image-created-with-nix-gets-a-certificate-signed-by-unkown-authority-error/1427>\
**Category:** Need Help\
**Created:** [December 28, 2023, 5:29am UTC](https://community.doppler.com/t/doppler-run-in-a-docker-image-created-with-nix-gets-a-certificate-signed-by-unkown-authority-error/1427 "2023-12-28T05:29:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zestsystem](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/zestsystem/32/838_2.png) [@zestsystem](https://community.doppler.com/u/zestsystem)\
**Post date:** [December 28, 2023, 5:29am UTC](https://community.doppler.com/t/doppler-run-in-a-docker-image-created-with-nix-gets-a-certificate-signed-by-unkown-authority-error/1427/1 "2023-12-28T05:29:41Z")

</div>

Hi,

I have a node.js server built with Nix that is deployed to ECS Fargate. Once deployed I get these errors:

 ![Screenshot 2023-12-27 at 9.26.34 PM](https://us1.discourse-cdn.com/flex016/uploads/doppler/original/1X/ac59da418b08b4486d745a9f80a184fb01865621.png)

What is normally the reason for such errors? I have already tried `--no-dns-resolver` flag.

Here’s the relevant flake-parts module that defines the docker image for those who are familiar with nix. I have found this [article](https://blog.tjll.net/a-doppler-test-drive/) that uses direnv, but I would like to use `doppler run` if possible. Thank you!

```nix
{inputs, ...}: let
  imageName = "myproject/app";
  imageTag = "latest";
in {
  config = {
    perSystem = {
      self',
      pkgs,
      lib,
      system,
      ...
    }: {
      packages = lib.optionalAttrs pkgs.stdenv.isLinux {
        appStgDockerImage = pkgs.dockerTools.buildImage {
          name = imageName;
          tag = imageTag;
          created = "now";
          copyToRoot = pkgs.buildEnv {
            name = imageName;
            paths = with pkgs; [doppler coreutils bash_5 self'.packages.app];
            pathsToLink = ["/bin" "/lib"];
          };
          keepContentsDirlinks = true;
          config = {
            Cmd = ["doppler" "run" "-p" "app" "-c" "stg" "-t" "$DOPPLER_TOKEN" "--no-dns-resolver" "--debug" "--" "/bin/app"];
            ExposedPorts = {"8080/tcp" = {};};
          };
        };
      };
    };
  };
}

```

---

<div class="post-metadata">

**Author:** ![zestsystem](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/zestsystem/32/838_2.png) [@zestsystem](https://community.doppler.com/u/zestsystem)\
**Post date:** [December 28, 2023, 8:18pm UTC](https://community.doppler.com/t/doppler-run-in-a-docker-image-created-with-nix-gets-a-certificate-signed-by-unkown-authority-error/1427/2 "2023-12-28T20:18:22Z")

</div>

Adding cacert in paths attribute solves the problem. Also had to change the CMD to access the env variable. This is the flake that works:

```nix
{...}: let
  imageName = "myproject/app";
  imageTag = "latest";
in {
  config = {
    perSystem = {
      self',
      pkgs,
      lib,
      system,
      ...
    }: {
      packages = lib.optionalAttrs pkgs.stdenv.isLinux {
        appStgDockerImage = pkgs.dockerTools.buildImage {
          name = imageName;
          tag = imageTag;
          created = "now";
          copyToRoot = pkgs.buildEnv {
            name = imageName;
            paths = with pkgs; [doppler cacert coreutils bash_5 self'.packages.app];
            pathsToLink = ["/bin" "/lib"];
          };
          keepContentsDirlinks = true;
          config = {
            Cmd = [
              "sh"
              "-c"
              "doppler -p app -c stg -t $DOPPLER_TOKEN run -- /bin/app"
            ];
            ExposedPorts = {"8080/tcp" = {};};
          };
        };
      };
    };
  };
}

```