Chapter 10. Pushing a container to a registry and embedding it into an image With RHEL image builder, you can build security hardened images using the OpenSCAP tool. You can take advantage of the support for container customization in the blueprints to create a container and embed it directly into the image you create. 10.1. Blueprint customization to embed a container into an image To embed a container from registry.access.redhat.com registry, you must add a container customization to your blueprint. For example: source - Mandatory field. It is a reference to the container image at a registry. This example uses the registry.access.redhat.com registry. You can specify a tag version. The default tag version is latest . name - The name of the container in the local registry. tls-verify - Boolean field. The tls-verify boolean field controls the transport layer security. The default value is true . RHEL image builder pulls the container during the image build and stores the container into the image. The default local container storage location depends on the image type, so that all support container-tools , such as Podman, are able to work with it. The embedded containers are not started. To access protected container resources, you can use a containers-auth.json file. 10.2. The Container registry credentials The osbuild-worker@.service is a template service that can start multiple service instances. By default, the osbuild-composer service always starts with only one local osbuild-worker , specifically osbuild-worker@1.service . The osbuild-worker service is responsible for the communication with the container registry. To enable the service, set up the /etc/osbuild-worker/osbuild-worker.toml configuration file. Note After setting the /etc/osbuild-worker/osbuild-worker.toml configuration file, you must restart the osbuild-worker service, because it reads the /etc/osbuild-worker/osbuild-worker.toml configuration file only once, during the osbuild-worker service start. To stop the service instance, restart the systemd service with the following command: With that, you restart all the started instances of osbuild-worker , specifically osbuild-worker@1.service , the only service that might be running. The /etc/osbuild-worker/osbuild-worker.toml configuration file has a containers section with an auth_field_path entry that is a string referring to a path of a containers-auth.json file to be used for accessing protected resources. The container registry credentials are only used to pull a container image from a registry, when embedding the container into the image. For example: Additional resources The containers-auth.json man page on your system 10.3. Pushing a container artifact directly to a container registry You can push container artifacts, such as RHEL for Edge container images directly, directly to a container registry after you build it, by using the RHEL image builder CLI. Prerequisites Access to quay.io registry . This example uses the quay.io container registry as a target registry, but you can use a container registry of your choice. Procedure Set up a registry-config.toml file to select the container provider. The credentials are optional. Create a blueprint in the .toml format. This is a blueprint for the container in which you install an nginx package into the blueprint. Push the blueprint: Build the container image, by passing the registry and the repository to the composer-cli tool as arguments. simple-container - is the blueprint name. container - is the image type. "quay.io:8080/osbuild/ repository " - quay.io is the target registry, osbuild is the organization and repository is the location to push the container when it finishes building. Optionally, you can set a tag . If you do not set a value for :tag , it uses :latest tag by default. Note Building the container image takes time because of resolving dependencies of the customized packages. After the image build finishes, the container you created is available in quay.io . Verification Open quay.io . and click Repository Tags . Copy the manifest ID value to build the image in which you want to embed a container. Additional resources Quay.io - Working with tags 10.4. Building an image and pulling the container into the image After you have created the container image, you can build your customized image and pull the container image into it. For that, you must specify a container customization in the blueprint, and the container name for the final image. During the build process, the container image is fetched and placed in the local Podman container storage. Prerequisites You created a container image and pushed it into your local quay.io container registry instance. See Pushing a container artifact directly to a container registry . You have access to registry.access.redhat.com . You have a container manifest ID . You have the qemu-kvm and qemu-img packages installed. Procedure Create a blueprint to build a qcow2 image. The blueprint must contain the " " customization. Push the blueprint: Build the container image: image is the blueprint name. qcow2 is the image type. Note Building the image takes time because it checks the container on quay.io registry. To check the status of the compose: A finished compose shows the FINISHED status value. To identify your compose in the list, use its UUID. After the compose process is finished, download the resulting image file to your default download location: Replace UUID with the UUID value shown in the steps. You can use the qcow2 image you created and downloaded to create a VM. Verification From the resulting qcow2 image that you downloaded, perform the following steps: Start the qcow2 image in a VM. See Creating a virtual machine from a KVM guest image . The qemu wizard opens. Login in to the qcow2 image. Enter the username and password. These can be the username and password you set up in the .qcow2 blueprint in the "customizations.user" section, or created at boot time with cloud-init . Run the container image and open a shell prompt inside the container: registry.access.redhat.com is the target registry, osbuild is the organization and repository is the location to push the container when it finishes building. Check that the packages you added to the blueprint are available: The output shows you the nginx package path. Additional resources Red Hat Container Registry Authentication Accessing and Configuring the Red Hat Registry Basic Podman commands Running Skopeo in a container

Commands:
[[containers]] source = "registry.access.redhat.com/ubi9/ubi:latest" name = "local-name" tls-verify = true
systemctl restart osbuild-worker@*
[containers] auth_file_path = "/etc/osbuild-worker/containers-auth.json"
provider = " container_provider " [settings] tls_verify = false username = " admin " password = " your_password "
name = "simple-container" description = "Simple RHEL container" version = "0.0.1" [[packages]] name = "nginx" version = "*"
composer-cli blueprints push blueprint.toml
composer-cli compose start simple-container container "quay.io:8080/osbuild/ repository " registry-config.toml
You can see details about the container you created, such as: - last modified - image size - the `manifest ID`, that you can copy to the clipboard.
name = "image" description = "A qcow2 image with a container" version = "0.0.1" distro = "rhel-90" [[packages]] name = "podman" version = "*" [[containers]] source = "registry.access.redhat.com/ubi9:8080/osbuild/container/container-image@sha256:manifest-ID-from-Repository-tag: tag-version" name = "source-name" tls-verify = true
composer-cli blueprints push blueprint-image .toml
composer-cli start compose image qcow2
composer-cli compose status
composer-cli compose image UUID
podman run -it registry.access.redhat.com/ubi9:8080/osbuild/ repository /bin/bash/
type -a nginx