Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

Chapter 2. Creating container images in a network restricted environment

As an application developer, configure OpenShift Container Platform with an HTTP or HTTPS proxy to enforce security and prevent direct internet access for your build processes. This setup enforces security by routing build pulls of dependencies, images, and code through a monitored outgoing proxy gateway.

2.1. Creating a buildah build in a network-restricted environment
リンクのコピー

Create a buildah build in a network-restricted environment by mirroring the images that buildah build strategy requires. Mirroring the images eliminates the need for public registry access. This ensures clusters use only images that comply with external content controls.

Prerequisites

  • You have installed the oc CLI.
  • Your cluster can connect and interact with the Git source that you can use to create the buildah build.
  • You have the builder-image required to create the buildah build in your local registry. If the builder-image is not present in the local registry, mirror the source image.

Procedure

  1. Run the following command to mirror the images that buildah build strategy requires: 

    $ oc image mirror --insecure -a <registry_authentication> registry.redhat.io/ubi8/buildah@sha256:1c89cc3cab0ac0fc7387c1fe5e63443468219aab6fd531c8dad6d22fd999819e <mirror_registry>/<repo>/ubi8_buildah
    Copy to Clipboard Toggle word wrap

    where:

    <registry_authentication>
    Specifies the authentication credentials used to access a container registry. This is required when pushing to or pulling from a private registry.
    <mirror_registry>
    Specifies the registry where the image you want to mirror is stored.
    <image_name>
    Specifies the name of the image.
    <tag>
    Specifies the tag of the image.
  2. Perform the steps mentioned in the "Creating a buildah build" section.

2.2. Creating a source-to-image build in a network-restricted environment
リンクのコピー

Create a source-to-image build in a network-restricted environment by mirroring the images that source-to-image build strategy requires. Mirroring the images eliminates the need for public registry access. This ensures clusters use only images that comply with external content controls.

Prerequisites

  • You have installed the oc CLI.
  • Your cluster can connect and interact with the Git source used to create the source-to-image build.
  • You have the builder-image required to create the source-to-image build in your local registry. If the builder-image is not present in the local registry, mirror the source image.

Procedure

  1. Run the following command to mirror the images that source-to-image build strategy requires: 

    $ oc image mirror --insecure -a <registry_authentication> registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:d041c1bbe503d152d0759598f79802e257816d674b342670ef61c6f9e6d401c5 <mirror_registry>/<repo>/source-to-image-source-to-image-rhel8
    Copy to Clipboard Toggle word wrap

    where:

    <registry_authentication>
    Specifies the authentication credentials used to access a container registry. This is required when pushing to or pulling from a private registry.
    <mirror_registry>
    Specifies the registry where the image you want to mirror is stored.
    <image_name>
    Specifies the name of the mirror image.
    <tag>
    Specifies the tag of the image.
  2. Perform the steps mentioned in the "Creating a source-to-image build" section.

2.3. Verifying proxy details
リンクのコピー

If you run a cluster behind a proxy, ensure that cluster-wide proxy settings and environment variables are correctly configured in the OpenShift Container Platform cluster. This ensures all Builds traffic is routed through the monitored outbound proxy gateway.

Prerequisites

  • You have installed the oc CLI.

Procedure

  1. To verify the cluster-wide proxy settings, run the following command: 

    $ oc describe proxy/cluster
    Copy to Clipboard Toggle word wrap

    Example output: 

    Name:         cluster
Namespace:
Labels:       hypershift.openshift.io/managed=true
Annotations:  hypershift.io/hosted-cluster-proxy-config: true
              include.release.openshift.io/ibm-cloud-managed: true
              include.release.openshift.io/self-managed-high-availability: true
              release.openshift.io/create-only: true
API Version:  config.openshift.io/v1
Kind:         Proxy
Metadata:
  Creation Timestamp:  2026-01-05T09:56:06Z
  Generation:          2
  Owner References:
    API Version:     config.openshift.io/v1
    Kind:            ClusterVersion
    Name:            version
    UID:             bfb9588f-106f-4e9f-965b-03daa0cd8c33
  Resource Version:  1451
  UID:               8bbf0aef-6d78-479d-abdf-ddbb34bf3ff1
Spec:
  Trusted CA:
    Name:
Events:    <none>
    Copy to Clipboard Toggle word wrap

  2. To verify the environment variables, run the following command: 

    $ oc set env deployment/openshift-builds-operator --list -n openshift-builds | grep PROXY
    Copy to Clipboard Toggle word wrap

    Example output: 

    HTTP_PROXY=http://192.168.130.1:3128
HTTPS_PROXY=https://192.168.130.1:3129
NO_PROXY=.cluster.local,.svc,.testing,10.217.0.0/22,10.217.4.0/23,127.0.0.1,192.168.126.0/24,192.168.1
30.11,api-int.crc.testing,localhost
    Copy to Clipboard Toggle word wrap
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2026 Red Hatトップに戻る