Chapter 3. Working with container registries

A container registry is a repository or collection of repositories for storing container images and container-based application artifacts.

The registries that Red Hat provides are:

To get container images from a remote registry, such as Red Hat’s own container registry, and add them to your local system, use the podman pull command:

# podman pull <registry>[:<port>]/[<namespace>/]<name>:<tag>

where <registry>[:<port>]/[<namespace>/]<name>:<tag> is the name of the container image.

If there are multiple versions of the same image, add a tag to explicitly specify the image name. By default, Podman uses the :latest tag, for example ubi10/ubi:latest. Some registries also use <namespace> to distinguish between images with the same <name> owned by different users or organizations. For example:

To control how Podman searches for and retrieves images, you can configure container registries on RHEL. Defining trusted sources and search priorities ensures predictable application deployment across your infrastructure.

You can display the container registries by using the podman info --format command:

$ podman info -f json | jq '.registries["search"]'
[
  "registry.access.redhat.com",
  "registry.redhat.io",
  "docker.io"
]

You can edit the list of container registries in the registries.conf configuration file. As a root user, edit the /etc/containers/registries.conf file to change the default system-wide search settings. As a user, create the $HOME/.config/containers/registries.conf file to override the system-wide settings.

unqualified-search-registries = ["registry.access.redhat.com", "registry.redhat.io", "docker.io"]
short-name-mode = "enforcing"

By default, the podman pull and podman search commands search for container images from registries listed in the unqualified-search-registries list in the given order.

You can search for images across container registries by using the podman search command. You can also search for images at Red Hat Container Catalog. The catalog includes the image description, contents, health index, and other information.

To search for the postgresql-10 images in the quay.io registry, follow the steps.

Configure short-name aliases in registries.conf to map short names, such as ubi10, to fully qualified image names. This provides control over image sources and helps prevent spoofing risks associated with short names.

Always pull an image by its fully-qualified name. However, it is customary to pull images by short names. For example, you can use ubi10 instead of registry.access.redhat.com/ubi10:latest.

The registries.conf file allows to specify aliases for short names, giving administrators full control over where images are pulled from. Aliases are specified in the table in the form "name" = "value".

You can see the lists of aliases in the /etc/containers/registries.conf.d directory. Red Hat provides a set of aliases in this directory. For example, podman pull ubi10 directly resolves to the right image, that is registry.access.redhat.com/ubi10:latest.

For example:

unqualified-search-registries=["registry.fedoraproject.org", "quay.io"]

[aliases]
"fedora"="registry.fedoraproject.org/fedora"

The short-names modes are:

You can configure Red Hat Enterprise Linux (RHEL) to require and verify container image signatures. This ensures that the images you pull come from a trusted source and are not modified. You can manage this trust policy by modifying the policy.json file, which forces tools, such as Podman, Buildah, and Skopeo to enforce valid container image signatures.

For a system-wide configuration, you can modify the /etc/containers/policy.json file. For rootless users, you can apply these rules in the $HOME/.config/containers/policy.json file.

You can configure a default rule to accept everything. However, you can restrict a specific scoped namespace, localhost:5003/simple-sq-signed-centos, within the docker transport to strictly require a valid signature. For example:

{
  "default": [
    {
      "type": "insecureAcceptAnything"
    }
  ],
  "transports": {
    "docker": {
      "localhost:5003/simple-sq-signed-centos": [
        {
          "type": "signedBy",
          "keyType": "GPGKeys",
          "keyPath": "testdata/sequoia-key.pgp"
        }
      ]
    }
  }
}