debian's puppetmaster is too old, so I use ubuntu as base image
volume /var/lib/puppet/ssl