RHCSA Rapid Track

A container image is a packaged version of your application, with all the dependencies that are necessary for the application to run. You can use image registries to store container images to later share them in a controlled manner. Some examples of image registries include Quay.io, Red Hat Registry, Docker Hub, and Amazon ECR.

For example, consider the following Podman command.

[user@host ~]$ podman pull registry.redhat.io/ubi9/ubi:9.1
Trying to pull registry.redhat.io/ubi9/ubi:9.1...
Getting image source signatures
...output omitted...
Writing manifest to image destination
Storing signatures
3434...8f6b

The registry.redhat.io/ubi9 image is stored in the Red Hat Registry, because the container name uses the registry.redhat.io host.

Red Hat distributes container images by using two registries:

However, Red Hat provides a centralized searching utility for both registries: the Red Hat Ecosystem Catalog, available at https://catalog.redhat.com/. You can use the Red Hat Ecosystem Catalog to search for images and get technical details about them. Navigate to https://catalog.redhat.com/software/containers/explore to search for container images.

Figure 16.10: The Red Hat Ecosystem Catalog

The container image details page provides relevant information about the container image, such as the Containerfile used to create the image, the packages installed within the image, or a security scanning. You can also change the image version by selecting a specific tag.

Figure 16.11: The Node.js 16 image based on RHEL 9

Although the Red Hat Registry only stores images from Red Hat and certified providers, you can use the Quay.io registry to store your custom images. Storing public images in Quay.io is free, and paying customers receive further benefits, such as private repositories. Developers can also deploy an on-premise Quay instance, which you can use to set up an image registry on your infrastructure.

To log in to Quay.io, you can use your Red Hat developer account.

Figure 16.12: The Quay.io welcome page

When you pull a container image, you provide a number of details. For example, the registry.access.redhat.com/ubi9/nodejs-18:latest image name consists of the following information:

Developers can specify a shorter, unqualified name, which omits the registry URL. For example, you might shorten the registry.redhat.io/ubi9/nodejs-18:latest to ubi9/nodejs-18:latest.

[user@host ~]$ podman pull ubi9/nodejs-18

If you do not provide the registry URL, then Podman uses the /etc/containers/registries.conf file to search other container registries that might contain the image name. This file contains registries that Podman searches to find the image, in order of preference.

For example, with the following configuration, Podman searches the Red Hat Registry first. If the image is not found in the Red Hat Registry, then Podman searches in the Docker Hub registry.

unqualified-search-registries == ['registry.redhat.io', 'docker.io']

You can also block a registry. For example, the following configuration blocks pulling from Docker Hub.

[[registry]]
location="docker.io"
blocked=true

Some systems do not have a /etc/containers/registries.conf file, such as Microsoft Windows. In such cases, the registries.conf file might exist in a different location.

For example, on Microsoft Windows, execute the podman machine ssh command to connect to the Linux-based virtual machine that starts your containers. In the virtual machine, you can find the /etc/containers/registries.conf file:

[user@host ~]$ podman machine ssh
[user@DESKTOP-AA1A111 ~]$ ls /etc/containers/containers.conf
/etc/containers/containers.conf

See the references section for more details about the registries.conf file.

Red Hat recommends that you always use a fully qualified container image name to avoid duplicate container images in multiple container registries. For example, depending on your Podman configuration, the rhel9/rhel-guest-image:9.4 container image might resolve to a potentially unsupported or malicious docker.io/library/rhel9/rhel:9:4 container image.

Skopeo is a command-line tool for working with container images. Developers can use Skopeo for various tasks:

Skopeo can inspect remote images or transfer images between registries without using local storage. The skopeo command uses the transport:image format, such as docker://remote_image, dir:path, or oci:path:tag.

Use the skopeo inspect command to read image metadata.

[user@host ~]$ skopeo inspect \
 docker://registry.access.redhat.com/ubi9/nodejs-18
{
    "Name": "registry.access.redhat.com/ubi9/nodejs-18",
    "Digest": "sha256:741b...22e0",
    "RepoTags": [
...output omitted...

Use the skopeo copy command to copy images between registries. The following example copies the registry.access.redhat.com/ubi9/nodejs-18:latest image into the quay.io/myuser/nodejs-18 Quay.io repository.

[user@host ~]$ skopeo copy \
 docker://registry.access.redhat.com/ubi9/nodejs-18 \
 docker://quay.io/myuser/nodejs-18
Getting image source signatures
...output omitted...

The following example changes the transport format to download an image into a local directory.

[user@host ~]$ skopeo copy \
 docker://registry.access.redhat.com/ubi9/nodejs-18 \
 dir:/var/lib/images/nodejs-18
Getting image source signatures
...output omitted...

See the references section for more details about Skopeo.

Some registries require users to authenticate, such as the registry.redhat.io registry.

[user@host ~]$ podman pull registry.redhat.io/rhel9/nginx-120
Trying to pull registry.redhat.io/rhel9/nginx-120:latest...
Error: initializing source docker://registry.redhat.io/ubi9/httpd-24:latest: unable to retrieve auth token: invalid username/password: unauthorized: Please login to the Red Hat Registry using your Customer Portal credentials. Further instructions can be found here: https://access.redhat.com/RegistryAuthentication

You might choose a different image that does not require authentication, such as the UBI 9 image from the registry.access.redhat.com registry:

[user@host ~]$ podman pull registry.access.redhat.com/ubi9:latest
Trying to pull registry.access.redhat.com/ubi9:latest...
Getting image source signatures
Checking if image destination supports signatures
...output omitted...

Alternatively, authenticate your calls by executing the podman login command.

[user@host ~]$ podman login registry.redhat.io
Username: YOUR_USER
Password: YOUR_PASSWORD
Login Succeeded!
[user@host ~]$ podman pull registry.redhat.io/rhel9/nginx-120
Trying to pull registry.redhat.io/rhel9/nginx-120:latest...
Getting image source signatures
...output omitted...

Podman stores the credentials in the ${XDG_RUNTIME_DIR}/containers/auth.json file, where the ${XDG_RUNTIME_DIR} refers to a directory specific to the current user. The credentials are encoded in the base64 format:

[user@host ~]$ cat ${XDG_RUNTIME_DIR}/containers/auth.json
{
	"auths": {
		"registry.redhat.io": {
			"auth": "dXNlcjpodW50ZXIy"
		}
	}
}
[user@host ~]$ echo -n dXNlcjpodW50ZXIy | base64 -d
user:hunter2

Skopeo uses the same ${XDG_RUNTIME_DIR}/containers/auth.json file to access authentication details for each registry.