Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 2. Creating container images in a network restricted environment

As an application developer, configure OpenShift Container Platform with an HTTP or HTTPS proxy to enforce security and prevent direct internet access for your build processes. This setup enforces security by routing build pulls of dependencies, images, and code through a monitored outgoing proxy gateway.

Create a buildah build in a network-restricted environment by mirroring the images that buildah build strategy requires. Mirroring the images eliminates the need for public registry access. This ensures clusters use only images that comply with external content controls.

Prerequisites

  • You have installed the oc CLI.
  • Your cluster can connect and interact with the Git source that you can use to create the buildah build.
  • You have the builder-image required to create the buildah build in your local registry. If the builder-image is not present in the local registry, mirror the source image.

Procedure

  1. Run the following command to mirror the images that buildah build strategy requires: 

    $ oc image mirror --insecure -a <registry_authentication> registry.redhat.io/ubi8/buildah@sha256:1c89cc3cab0ac0fc7387c1fe5e63443468219aab6fd531c8dad6d22fd999819e <mirror_registry>/<repo>/ubi8_buildah
    Copy to Clipboard Toggle word wrap

    where:

    <registry_authentication>
    Specifies the authentication credentials used to access a container registry. This is required when pushing to or pulling from a private registry.
    <mirror_registry>
    Specifies the registry where the image you want to mirror is stored.
    <image_name>
    Specifies the name of the image.
    <tag>
    Specifies the tag of the image.
  2. Perform the steps mentioned in the "Creating a buildah build" section.

Create a source-to-image build in a network-restricted environment by mirroring the images that source-to-image build strategy requires. Mirroring the images eliminates the need for public registry access. This ensures clusters use only images that comply with external content controls.

Prerequisites

  • You have installed the oc CLI.
  • Your cluster can connect and interact with the Git source used to create the source-to-image build.
  • You have the builder-image required to create the source-to-image build in your local registry. If the builder-image is not present in the local registry, mirror the source image.

Procedure

  1. Run the following command to mirror the images that source-to-image build strategy requires: 

    $ oc image mirror --insecure -a <registry_authentication> registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:d041c1bbe503d152d0759598f79802e257816d674b342670ef61c6f9e6d401c5 <mirror_registry>/<repo>/source-to-image-source-to-image-rhel8
    Copy to Clipboard Toggle word wrap

    where:

    <registry_authentication>
    Specifies the authentication credentials used to access a container registry. This is required when pushing to or pulling from a private registry.
    <mirror_registry>
    Specifies the registry where the image you want to mirror is stored.
    <image_name>
    Specifies the name of the mirror image.
    <tag>
    Specifies the tag of the image.
  2. Perform the steps mentioned in the "Creating a source-to-image build" section.

2.3. Verifying proxy details
Copy link

If you run a cluster behind a proxy, ensure that cluster-wide proxy settings and environment variables are correctly configured in the OpenShift Container Platform cluster. This ensures all Builds traffic is routed through the monitored outbound proxy gateway.

Prerequisites

  • You have installed the oc CLI.

Procedure

  1. To verify the cluster-wide proxy settings, run the following command: 

    $ oc describe proxy/cluster
    Copy to Clipboard Toggle word wrap

    Example output: 

    Name:         cluster
Namespace:
Labels:       hypershift.openshift.io/managed=true
Annotations:  hypershift.io/hosted-cluster-proxy-config: true
              include.release.openshift.io/ibm-cloud-managed: true
              include.release.openshift.io/self-managed-high-availability: true
              release.openshift.io/create-only: true
API Version:  config.openshift.io/v1
Kind:         Proxy
Metadata:
  Creation Timestamp:  2026-01-05T09:56:06Z
  Generation:          2
  Owner References:
    API Version:     config.openshift.io/v1
    Kind:            ClusterVersion
    Name:            version
    UID:             bfb9588f-106f-4e9f-965b-03daa0cd8c33
  Resource Version:  1451
  UID:               8bbf0aef-6d78-479d-abdf-ddbb34bf3ff1
Spec:
  Trusted CA:
    Name:
Events:    <none>
    Copy to Clipboard Toggle word wrap

  2. To verify the environment variables, run the following command: 

    $ oc set env deployment/openshift-builds-operator --list -n openshift-builds | grep PROXY
    Copy to Clipboard Toggle word wrap

    Example output: 

    HTTP_PROXY=http://192.168.130.1:3128
HTTPS_PROXY=https://192.168.130.1:3129
NO_PROXY=.cluster.local,.svc,.testing,10.217.0.0/22,10.217.4.0/23,127.0.0.1,192.168.126.0/24,192.168.1
30.11,api-int.crc.testing,localhost
    Copy to Clipboard Toggle word wrap
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top