Chapter 4. Building and managing physically bound images

Procedure

1. Create a playbook file, for example ./setup.yml, with the following content:

   ---
   - name: Configure physically bound images with RHEL system roles
     hosts: all
     vars:
       podman_registries_conf:
         unqualified-search-registries:
           - "registry.access.redhat.com"
           - "docker.io"
           - "my-company-registry.com"
         registry:
           - location: "my-company-registry.com"
           - location: "my-local-registry:5000"
             insecure: true
       podman_quadlet_specs:
         - file_src: my-quadlet.container
           state: started
     tasks:
         - name: Run the podman role
           include_role:
             name: redhat.rhel_system_roles.podman

   The Podman system role in the Ansible Playbook configures the system with registries and a Quadlet application.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ./setup.yml

   This command only validates the syntax and does not protect against a wrong but valid configuration.

3. Create a quadlet.container file to configures the container application, for example:

   [Install]
   WantedBy=default.target
   
   [Container]
   Image=quay.io/my_org/my_image:20260326
   ContainerName=my-quadlet

4. Create a Containerfile file with the following content:

   FROM quay.io/centos-bootc/centos-bootc:stream10
   RUN dnf -y install ansible-core rhel-system-roles
   COPY ./setup.yml .
   COPY ./quadlet.container .
   RUN ansible-playbook -c local setup.yml

   You perform every action inside the image build, running the playbooks against localhost. You can use a multi-stage build to keep Ansible and the roles out of your final image. Because this process is entirely self-contained, it works well in your automatic container build pipelines.

   Note

   The images must be copied over before any container or service (e.g., Quadlet) depending on such an image is started.

5. Build the bootc image, for example:

   $ podman build -t quay.io/<namespace>/<image>:<tag> .