containers-certs.d(5)

📦
version 6.0 · 8 versions
, in centos-stream 10

🎀 NAME — containers-certs.d(5) 🎀

okay bestie, containers-certs.d is literally the directory for storing custom container-registry TLS configurations. It's giving "put your certs here so your registry pull can slay securely" energy. 💅

✨ DESCRIPTION ✨

A custom TLS configuration for a container registry can be configured by creating a directory named after the registry host — for example, my-registry.com:5000 — in one of the following locations. Directories are consulted in this order, highest priority first:

  • For both rootful and rootless:
    • $XDG_CONFIG_HOME/containers/certs.d/ (or $HOME/.config/containers/certs.d/ if XDG_CONFIG_HOME is unset)
  • For rootful (UID == 0):
    • /etc/containers/certs.rootful.d/
  • For rootless (UID > 0):
    • /etc/containers/certs.rootless.d/<UID>/
    • /etc/containers/certs.rootless.d/
  • For both rootful and rootless:
    • /etc/containers/certs.d/
  • For rootful (UID == 0):
    • /usr/share/containers/certs.rootful.d/
  • For rootless (UID > 0):
    • /usr/share/containers/certs.rootless.d/<UID>/
    • /usr/share/containers/certs.rootless.d/
  • For both rootful and rootless:
    • /usr/share/containers/certs.d/
  • Compatibility fallback:
    • /etc/docker/certs.d/
🚨 Port matching is not a vibe-you-can-ignore situation. The port part's presence or absence must precisely match the port usage in image references. For example, to affect podman pull registry.example/foo, use a directory named registry.example, not registry.example:443. A directory named registry.example:443 would affect podman pull registry.example:443/foo.

🎀 Directory Structure 🎀

A certs directory can contain one or more files with the following extensions:

  • *.crt — files with this extensions will be interpreted as CA certificates
  • *.cert — files with this extensions will be interpreted as client certificates
  • *.key — files with this extensions will be interpreted as client keys

Note that the client certificate-key pair will be selected by the file name (e.g., client.{cert,key}). An exemplary setup for a registry running at my-registry.com:5000 may look as follows:

/etc/containers/certs.d/    <- Certificate directory
└── my-registry.com:5000    <- Hostname[:port]
   ├── client.cert          <- Client certificate
   ├── client.key           <- Client key
   └── ca.crt               <- Certificate authority that signed the registry certificate

🦋 HISTORY 🦋

Feb 2019 — Originally compiled by Valentin Rothberg rothberg@redhat.com (mailto: mailto:rothberg@redhat.com). Iconic archival behavior, no cap. 🫶

💌 tiny footer sign-off: source/version says for, the center/date slot says Directory (no separate date text is printed, bestie), and the manual name is containers-certs.d(5). Catch u later! 🫶💅

📦 where this page comes from