rpms/containers-common
7
0
Fork 0
Code Issues Pull Requests Releases Activity
a8fc88fc2a
containers-common/containers-certs.d.5.md
Jindrich Novy 9e5f3d1358 containers-common-6.0-1.el10 
- bump to container_libs_branch podman-6.0
- use RHEL-specific mounts.conf from common/contrib/redhat/ (container-libs#842)
- move config files from /etc/containers to /usr/share/containers (vendor defaults model)
- add vendor drop-in configs: containers.conf.d, storage.conf.d, storage.rootful.conf.d, registries.conf.d
- add Conflicts: podman < 5:6, buildah < 2:1.44, skopeo < 1:1.23
- add %posttrans scriptlet for .rpmsave migration
- add /etc/containers/networks directory
- fix Source16: containers-registries.conf.d.5 (no longer .md, now .so redirect)
- fix Source3: mounts.conf from common/contrib/redhat/ (non-empty RHEL version)
- regenerate 001-rhel-shortnames-pyxis.conf from Pyxis API

Resolves: RHEL-189270
Signed-off-by: Jindrich Novy <jnovy@redhat.com>
2026-06-26 21:28:35 +02:00

2.3 KiB
Raw Blame History

% containers-certs.d 5 Directory for storing custom container-registry TLS configurations

NAME

containers-certs.d - Directory for storing custom container-registry TLS configurations

DESCRIPTION

A custom TLS configuration for a container registry can be configured by creating a directory named after the registry host[:port] (for example, my-registry.com:5000) in one of the following locations. Directories are consulted in this order (highest priority first):

  • For both rootful and rootless:
    • $XDG_CONFIG_HOME/containers/certs.d/ (or $HOME/.config/containers/certs.d/ if XDG_CONFIG_HOME is unset)
  • For rootful (UID == 0):
    • /etc/containers/certs.rootful.d/
  • For rootless (UID > 0):
    • /etc/containers/certs.rootless.d/<UID>/
    • /etc/containers/certs.rootless.d/
  • For both rootful and rootless:
    • /etc/containers/certs.d/
  • For rootful (UID == 0):
    • /usr/share/containers/certs.rootful.d/
  • For rootless (UID > 0):
    • /usr/share/containers/certs.rootless.d/<UID>/
    • /usr/share/containers/certs.rootless.d/
  • For both rootful and rootless:
    • /usr/share/containers/certs.d/
  • Compatibility fallback:
    • /etc/docker/certs.d/

The port part presence / absence must precisely match the port usage in image references, e.g. to affect podman pull registry.example/foo, use a directory named registry.example, not registry.example:443. registry.example:443 would affect podman pull registry.example:443/foo.

Directory Structure

A certs directory can contain one or more files with the following extensions:

  • *.crt files with this extensions will be interpreted as CA certificates
  • *.cert files with this extensions will be interpreted as client certificates
  • *.key files with this extensions will be interpreted as client keys

Note that the client certificate-key pair will be selected by the file name (e.g., client.{cert,key}). An exemplary setup for a registry running at my-registry.com:5000 may look as follows:

/etc/containers/certs.d/    <- Certificate directory
└── my-registry.com:5000    <- Hostname[:port]
   ├── client.cert          <- Client certificate
   ├── client.key           <- Client key
   └── ca.crt               <- Certificate authority that signed the registry certificate

HISTORY

Feb 2019, Originally compiled by Valentin Rothberg rothberg@redhat.com