I’d say the first question is if this is even relevant for your use case. This is a failure of Caddy’s local CA feature trying to register its auto-generated Root CA as trusted on your system. Where the system in this case means still inside the container. That is often quite irrelevant. Where you primarily want that certificate trusted is on the client web browsers that will be connecting to that Caddy instance.
What is the local CA? Caddy by default automatically obtains or generates valid certificates for any HTTPS address you configure it to serve. When your site uses a publicly accessible domain name, such as https://example.com, Caddy will go ahead and procure a valid, widely-accepted certificate on your behalf. No further action should be necessary on the clients accessing sites like this. The local CA only kicks in when you are serving a host name Internet certificate authorities are unable to serve. These are local names, such as https://localhost https://machine.local or any plain IP addresses like https://10.10.10.10. Since you cannot obtain a certificate with built-in trust for names like that, Caddy does the next best thing, and signs them using an automatically generated local certificate authority.
These certificates, of course, will not be trusted by anyone by default. So Caddy goes one step further, and also tries to automatically register its CA as trusted. It can naturally only even attempt to do this on the local machine it’s running on. If you are a developer with a single machine, who will only ever be visiting their site on that same computer, this is sufficient. For anything beyond that, it’s barely a start. In your case the error is that it’s failing to auto-register its local CA as trusted inside the container. It’s unlikely that this makes much difference to you.
To squelch the error, you should edit the global options section in your Caddyfile, and add the setting skip_install_trust
to it: Global options (Caddyfile) — Caddy Documentation
Then your use case determines if you need to do anything further. If you don’t use https, or use Internet-accessible host names, you’re already good to go. If you do use local names or IP addresses, and through https, you have to copy Caddy’s root CA to each device you’ll be accessing your site from, and add it to that system’s list of trusted root certificate authorities. The way to do so depends by OS, but you generally get on the right track by simply opening the certificate file.
The certificate file in question that you want to copy, will be, as shown in your error message, located in storage:pki/authorities/local/root.crt. The “storage:” here stands for Caddy’s storage location. On Linux it defaults to .local/share/caddy inside the home folder of the user Caddy runs as.