Configure container pull secrets

You can configure container pull secrets for an image that is already built. If you use an external installer such as Anaconda for bare metal or bootc-image-builder, you must configure the systems by using any applicable pull secrets.

Before you begin

  • The container-tools meta-package is installed.
  • You have a valid registry pull secret file with authentication credentials for the target container registry.

Procedure

  1. Create a symbolic link between bootc and Podman to use a single pull secret. By creating the symbolic link, you ensure that both locations are present to a common persistent file embedded in the container image. 
    FROM quay.io/<namespace>/<image>:<tag>
COPY containers-auth.conf /usr/lib/tmpfiles.d/link-podman-credentials.conf
RUN --mount=type=secret,id=creds,required=true cp /run/secrets/creds /usr/lib/container-auth.json && \
  chmod 0600 /usr/lib/container-auth.json && \
  ln -sr /usr/lib/container-auth.json /etc/ostree/auth.json

    You can configure the container pull secrets to an image that is already built. If you use an external installer such as Anaconda for bare metal, or bootc-image-builder, you must configure the systems with any applicable pull secrets.

  2. Create the containers-auth.conf file. 
    # Make /run/containers/0/auth.json (a transient runtime file)
# a symlink to our /usr/lib/container-auth.json (a persistent file)
# which is also symlinked from /etc/ostree/auth.json.
d /run/containers/0 0755 root root -
L /run/user/0/containers/auth.json - - - - ../../../../usr/lib/container-auth.json
  3. Build an image by using the podman build command: 
    $ podman build --secret id=creds,src=$HOME/.docker/config.json

    When you run the Containerfile, the following actions happen:

    • The Containerfile makes containers-auth.conf a transient runtime file.
    • It creates a symbolic link to the containers-auth.conf file.
    • It also creates a persistent file, which is also symbolic linked from /etc/ostree/auth.json.

      Podman does not have system-wide credentials. Podman accepts the containers-auth locations that are underneath the following directories:

    • /run: The content of this directory vanishes on reboot, which is not required.
    • /root: Part of root home directory, which is local mutable state by default.

      To unify bootc and Podman credentials, use a single default global pull secret for both bootc and Podman. The following container build is an example to unify the bootc and the Podman credentials. The example expects a secret named creds to contain the registry pull secret to build.