Context

When attempting to clone a repository into a Blaxel sandbox, you may encounter an SSL certificate verification error similar to:

fatal: unable to access 'https://github.com/blaxel-ai/sdk-typescript.git': server certificate verification failed. CAfile: none CRLfile: none

This error typically occurs when using minimal base Docker images that don't include the necessary SSL certificate authorities.

Answer

The SSL certificate verification error is caused by missing CA certificates in your Docker image. This commonly happens when using slim base images like node:22-bookworm-slim that don't include certificate authorities by default.

To resolve this issue, you have two options:

Option 1: Install ca-certificates in your Dockerfile

Add ca-certificates to your package installation in your Dockerfile:

RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

Option 2: Use a different base image

Switch to a base image that includes CA certificates by default, such as:

• node:22-alpine - includes CA certificates

• node:22-bookworm (full version instead of slim)

The Alpine variant is particularly reliable for this use case and has been tested to work successfully with repository cloning.

Note: If you switch to Alpine, be aware that you may need to adjust other package installations in your Dockerfile, as Alpine uses apk instead of apt-get and may have different package names or availability.