15.4. Configuring container pull secrets

Procedure

1. Create a symbolic link between bootc and Podman to use a single pull secret. By creating the symbolic link, you ensure that both locations are present to a common persistent file embedded in the container image.

2. Create the /usr/lib/container-auth.json file.

   FROM quay.io/<namespace>/<image>:<tag>
   COPY containers-auth.conf /usr/lib/tmpfiles.d/link-podman-credentials.conf
   RUN --mount=type=secret,id=creds,required=true cp /run/secrets/creds /usr/lib/container-auth.json && \
       chmod 0600 /usr/lib/container-auth.json && \
       ln -sr /usr/lib/container-auth.json /etc/ostree/auth.json

   When you run the containerfile, the following actions happen:

   • The Containerfile makes /run/containers/0/auth.json a transient runtime file.
   • It creates a symbolic link to the /usr/lib/container-auth.json.
   • It also creates a persistent file, which is also symbolic linked from /etc/ostree/auth.json.