SSL certificate verification paths not configured correctly when Python is installed via uv (in Red Hat UBI8 base image) #16703
Description
Summary
When using uv to install and run Python inside a Red Hat UBI8-based container, the resulting Python environment does not appear to have correct SSL verification paths configured.
Standard HTTPS connections (e.g., via requests, aiohttp etc) fail due to missing or misconfigured CA certificates.
Inspecting the SSL configuration shows that the default verify paths are either empty or pointing to incorrect locations.
MRE
- Dockerfile (uv managed python)
# uv.Dockerfile
FROM redhat/ubi8:latest
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
ENV UV_LINK_MODE=copy
RUN echo -e 'import ssl; print(ssl.get_default_verify_paths())' > /app.py
CMD ["uv", "run", "--python", "3.11.13", "/app.py"]- Dockerfile (native python)
# native.Dockerfile
FROM redhat/ubi8:latest
RUN yum update -y && yum install -y python3.11 && yum clean all
RUN echo -e 'import ssl; print(ssl.get_default_verify_paths())' > /app.py
CMD ["/usr/bin/python3.11", "/app.py"]- Build images
docker build -t uv-ssl-test:uv -f uv.Dockerfile .
docker build -t uv-ssl-test:native -f native.Dockerfile .
- Run the examples
$ docker run --rm uv-ssl-test:uv
Downloading cpython-3.11.13-linux-x86_64-gnu (download) (28.8MiB)
Downloading cpython-3.11.13-linux-x86_64-gnu (download)
DefaultVerifyPaths(cafile=None, capath='/etc/ssl/certs', openssl_cafile_env='SSL_CERT_FILE', openssl_cafile='/etc/ssl/cert.pem', openssl_capath_env='SSL_CERT_DIR', openssl_capath='/etc/ssl/certs')
$ docker run --rm uv-ssl-test:native
DefaultVerifyPaths(cafile='/etc/pki/tls/cert.pem', capath='/etc/pki/tls/certs', openssl_cafile_env='SSL_CERT_FILE', openssl_cafile='/etc/pki/tls/cert.pem', openssl_capath_env='SSL_CERT_DIR', openssl_capath='/etc/pki/tls/certs')Platform
Linux 6.6.105+ x86_64 GNU/Linux
Version
uv 0.9.8
Python version
Python 3.11.13