containers-certs.d(5)               storing              containers-certs.d(5)



NAME
       containers-certs.d - Directory for storing custom container-registry
       TLS configurations



DESCRIPTION
       A custom TLS configuration for a container registry can be configured
       by creating a directory named after the registry host <for example,
       `my-registry.com:5000`> in one of the following locations.  Directories
       are consulted in this order (highest priority first):

       o For both rootful and rootless:

         o $XDG_CONFIG_HOME/containers/certs.d/ (or
           $HOME/.config/containers/certs.d/ if XDG_CONFIG_HOME is unset)

       o For rootful (UID == 0):

         o /etc/containers/certs.rootful.d/

       o For rootless (UID > 0):

         o /etc/containers/certs.rootless.d/<UID>/

         o /etc/containers/certs.rootless.d/

       o For both rootful and rootless:

         o /etc/containers/certs.d/

       o For rootful (UID == 0):

         o /usr/share/containers/certs.rootful.d/

       o For rootless (UID > 0):

         o /usr/share/containers/certs.rootless.d/<UID>/

         o /usr/share/containers/certs.rootless.d/

       o For both rootful and rootless:

         o /usr/share/containers/certs.d/

       o Compatibility fallback:

         o /etc/docker/certs.d/


       The port part presence / absence must precisely match the port usage in
       image references, e.g. to affect podman pull registry.example/foo, use
       a directory named registry.example, not registry.example:443.
       registry.example:443 would affect podman pull registry.example:443/foo.


Directory Structure
       A certs directory can contain one or more files with the following
       extensions:

       o *.crt  files with this extensions will be interpreted as CA
         certificates

       o *.cert files with this extensions will be interpreted as client
         certificates

       o *.key  files with this extensions will be interpreted as client keys


       Note that the client certificate-key pair will be selected by the file
       name (e.g., client.{cert,key}).  An exemplary setup for a registry
       running at my-registry.com:5000 may look as follows:

       /etc/containers/certs.d/    <- Certificate directory
       <?><?><?> my-registry.com:5000    <- Hostname[:port]
          <?><?><?> client.cert          <- Client certificate
          <?><?><?> client.key           <- Client key
          <?><?><?> ca.crt               <- Certificate authority that signed the registry certificate



HISTORY
       Feb 2019, Originally compiled by Valentin Rothberg rothberg@redhat.com
       <mailto:rothberg@redhat.com>

for                                Directory             containers-certs.d(5)