title: gpgp key request fails in dockerfile but not bash
body: <p>I have an issue in that my attempts to receive a gpg key fails when building my docker container. The command that I am providing works correctly when executed at the command line. </p>
  
  <ul>
  <li>I am behind a firewall; I have the proxy settings detailed below for this.</li>
  <li>Host: CentOS 7.4; Docker version 17.09.0-ce, build afdb6d4</li>
  <li>No environment variables for proxies are set for the account being used.</li>
  <li>The Docker service has the environment variables for the proxies set <a href="https://docs.docker.com/engine/admin/systemd/#httphttps-proxy" rel="nofollow noreferrer">according to Docker</a>:</li>
  </ul>
  
  <p>In <code>/etc/systemd/system/docker.service.d/http-proxy.conf</code>:</p>
  
  <pre><code>[Service]
  Environment="HTTP_PROXY=http://&lt;corporate proxy&gt;/" "HTTPS_PROXY="&lt;corporate proxy&gt;/" "NO_PROXY=localhost,127.0.0.1,.domain.local,.corp"
  </code></pre>
  
  <p>I use a <code>build.sh</code> shell script to build the image:</p>
  
  <pre><code>#/bin/bash
  docker build -t hgk/test-container .
  </code></pre>
  
  <p>The shell script is in the same location as my Dockerfile. These are the only two things in that directory.</p>
  
  <pre><code>FROM openjdk:8
  ARG KEYSERV=hkp://p80.pool.sks-keyservers.net:80
  ARG THEPROXY=&lt;my corporate proxy&gt;
  
  # grab gosu for easy step-down from root
  # (see docker-sonarqube pull request #115)
  RUN set -x \
      &amp;&amp; wget -e https_proxy=$THEPROXY -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.10/gosu-$(dpkg --print-architecture)" \
      &amp;&amp; wget -e https_proxy=$THEPROXY-O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.10/gosu-$(dpkg --print-architecture).asc" \
      &amp;&amp; export GNUPGHOME="$(mktemp -d)" \
      &amp;&amp; gpg --version \
      &amp;&amp; gpg -vv --keyserver $KEYSERV --keyserver-options http-proxy=$THEPROXY --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
      &amp;&amp; gpg --list-keys \
      &amp;&amp; gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
      &amp;&amp; rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc \
      &amp;&amp; chmod +x /usr/local/bin/gosu \
      &amp;&amp; gosu nobody true
  </code></pre>
  
  <p>The two wget commands work correctly and they retrieve the files. The first gpg command eventually times out:</p>
  
  <pre><code>+ mktemp -d
  + export GNUPGHOME=/tmp/tmp.LJ1EVFQmpO
  + gpg --version
  gpg (GnuPG) 2.1.18
  libgcrypt 1.7.6-beta
  Copyright (C) 2017 Free Software Foundation, Inc.
  License GPLv3+: GNU GPL version 3 or later 
  &lt;https://gnu.org/licenses/gpl.html&gt;
  This is free software: you are free to change and redistribute it.
  There is NO WARRANTY, to the extent permitted by law.
  
  Home: /tmp/tmp.LJlEVFQmpO
  Supported algorithms:
  Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
  Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
          CAMELLIA128, CAMELLIA192, CAMELLIA256
  Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
  Compression: Uncompressed, ZIP, ZLIB, BZIP2
  + gpg -vv --keyserver hkp://p80.pool.sks-keyservers.net:80 --keyserver-options http-proxy=&lt;corp proxy&gt; --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
  gpg: keybox '/tmp/tmp.LJlEVFQmpO/pubring.kbx' created
  gpg: no running Dirmngr - starting '/usr/bin/dirmngr'
  gpg: waiting for the dirmngr to come up ... (5s)
  gpg: connection to the dirmngr established
  
  [[I am hung here - It just waits for ... something? I'll update the question if anything prints after this]] 
  </code></pre>
  
  <p>I put the <code>gpg --list-keys</code> command in the Dockerfile to see if we got past there. However, if I run it via the command line, it successfully retrieves the key:</p>
  
  <pre><code>[root@me foo]# printenv | grep proxy
  [root@me foo]# gpg --keyserver hkp://p80.pool.sks-keyservers.net:80 --
  keyserver-options http-proxy=&lt;corp proxy&gt; --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
  gpg: keyring `/root/.gnupg/pubring.gpg' created
  gpg: requesting key BF357DD4 from hkp server p80.pool.sks-keyservers.net
  Version: SKS 1.1.6
  gpg: armor header:
  Comment: Hostname: sks.okoyono.de
  gpg: armor header:
  gpg: pub  4096R/BF357DD4 2014-02-28  Tianon Gravi &lt;tianon@debian.org&gt;
  gpg: key BF357DD4: removed multiple subkey binding
  gpg: key BF357DD4: removed multiple subkey binding
  gpg: /tmp/tmp.DIX6yQQf25/trustdb.gpg: trustdb created
  gpg: using PGP trust model
  gpg: key BF357DD4: public key "Tianon Gravi &lt;tianon@tianon.xyz&gt;" imported
  gpg: 1 keys cached (126 signatures)
  gpg: 0 keys processed (0 validity counts cleared)
  gpg: no ultimately trusted keys found
  gpg: Total number processed: 1
  gpg:               imported: 1  (RSA: 1)
  
  [root@me foo]# gpg --list-keys
  /root/.gnupg/pubring.gpg
  ------------------------
  pub   4096R/BF357DD4 2014-02-28 [expires: 2019-07-06]
  uid                  Tianon Gravi &lt;tianon@tianon.xyz&gt;
  uid                  Tianon Gravi &lt;tianon@debian.org&gt;
  uid                  Tianon Gravi &lt;tianon@dockerproject.org&gt;
  uid                  Andrew Page (tianon) &lt;andrew@infosiftr.com&gt;
  uid                  Andrew Page (tianon) &lt;andrew@vitalroute.com&gt;
  uid                  Andrew Page (Tianon Gravi) &lt;admwiggin@gmail.com&gt;
  uid                  Tianon Gravi (Andrew Page) &lt;tianon@infosiftr.com&gt;
  sub   4096R/769826E6 2014-02-28 [expires: 2019-07-06]
  </code></pre>
  
  <p>I've tried different sks-keyservers (ubuntu, MIT, and other sks) with the same behavior - correct from bash, wrong from Docker.</p>
  
  <p>Any thoughts/tips/suggestions?</p>
  
  <p><strong>Update</strong>: My "openjdk:8" version had not been updated in a while (since 8u121). I found I was running gpg v1.4.18. I did a <code>docker image pull openjdk:8</code> which brought me up to 8u151 and gpg 2.1.18. The version of gpg on the CentOS 7 machine is 2.0.22. </p>