containers-certs.d - Man Page

A custom TLS configuration for a container registry can be configured by creating a directory named after the registry host ⟨for example, `my-registry.com:5000`⟩ in one of the following locations. Directories are consulted in this order (highest priority first):

• For both rootful and rootless:

  • $XDG_CONFIG_HOME/containers/certs.d/ (or $HOME/.config/containers/certs.d/ if XDG_CONFIG_HOME is unset)

• For rootful (UID == 0):

  • /etc/containers/certs.rootful.d/

• For rootless (UID > 0):

  • /etc/containers/certs.rootless.d/<UID>/
  • /etc/containers/certs.rootless.d/

• For both rootful and rootless:

  • /etc/containers/certs.d/

• For rootful (UID == 0):

  • /usr/share/containers/certs.rootful.d/

• For rootless (UID > 0):

  • /usr/share/containers/certs.rootless.d/<UID>/
  • /usr/share/containers/certs.rootless.d/

• For both rootful and rootless:

  • /usr/share/containers/certs.d/

• Compatibility fallback:

  • /etc/docker/certs.d/

The port part presence / absence must precisely match the port usage in image references, e.g. to affect podman pull registry.example/foo, use a directory named registry.example, not registry.example:443. registry.example:443 would affect podman pull registry.example:443/foo.

A certs directory can contain one or more files with the following extensions:

• *.crt  files with this extensions will be interpreted as CA certificates
• *.cert files with this extensions will be interpreted as client certificates
• *.key  files with this extensions will be interpreted as client keys

Note that the client certificate-key pair will be selected by the file name (e.g., client.{cert,key}). An exemplary setup for a registry running at my-registry.com:5000 may look as follows:

/etc/containers/certs.d/    <- Certificate directory
└── my-registry.com:5000    <- Hostname[:port]
   ├── client.cert          <- Client certificate
   ├── client.key           <- Client key
   └── ca.crt               <- Certificate authority that signed the registry certificate

Feb 2019, Originally compiled by Valentin Rothberg rothberg@redhat.com ⟨mailto:rothberg@redhat.com⟩

containers-registries.conf(5), flatpak-remote(5), podman-artifact-pull(1), podman-artifact-push(1), podman-build(1), podman-container-runlabel(1), podman-create(1), podman-farm-build(1), podman-image-sign(1), podman-image.unit(5), podman-kube-down(1), podman-kube-play(1), podman-login(1), podman-manifest-add(1), podman-manifest-push(1), podman-pull(1), podman-push(1), podman-run(1), podman-search(1), skopeo-login(1).