Configuring pod specification for the guest image

Edit online

Registry mapping changes only the image reference that is pulled inside the confidential guest; you must also prepare the pod specification for the guest image.

The following examples show how to update the pod specification when the host image and guest image are different.

Example: Public Fedora image mapped to private PostgreSQL image

This example shows how to update the pod specification when a public Fedora image is mapped to a private PostgreSQL image.
  1. Identify the host image and guest image.

    In this example, the host image is quay.io/fedora/fedora:38 and the guest image is private-registry.company.com/postgresql-15-c9s:latest.

  2. Review the pod specification after registry mapping. All the basic variables required to map to PostgreSQL will be added as shown in the example below. 
    containers:
- name: postgres
  image: quay.io/fedora/fedora:38
  env:
  - name: POSTGRESQL_USER
    value: testuser
  - name: POSTGRESQL_PASSWORD
    value: testpass
  - name: POSTGRESQL_DATABASE
    value: testdb
  volumeDevices:
  - name: postgresspvc
    devicePath: /dev/postgress
  command:
    - sh
    - -c
    - |
      chown -R 26:26 /var/lib/pgsql/data
      chmod -R 770 /var/lib/pgsql/data
      exec /usr/libexec/s2i/run

    In case of additional variables, you must inspect the guest image metadata to determine the runtime requirements.

  3. Inspect the guest image metadata to determine the runtime requirements, by running the following command:
    podman image inspect private-registry.company.com/postgresql-15-c9s:latest | jq '.[0].Config | del(.Labels)'

    Example output:

    {
  "User": "26",
  "ExposedPorts": {
    "5432/tcp": {}
  },
  "Env": [
    "NAME=s2i-core",
    "VERSION=9",
    "STI_SCRIPTS_URL=image:///usr/libexec/s2i",
    "STI_SCRIPTS_PATH=/usr/libexec/s2i",
    "APP_ROOT=/opt/app-root",
    "PATH=/opt/app-root/src/bin:/opt/app-root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
    "PLATFORM=el9",
    "POSTGRESQL_VERSION=15",
    "POSTGRESQL_PREV_VERSION=13",
    "HOME=/var/lib/pgsql",
    "PGUSER=postgres",
    "APP_DATA=/opt/app-root",
    "SUMMARY=PostgreSQL is an advanced Object-Relational database management system",
    "DESCRIPTION=PostgreSQL is an advanced Object-Relational database management system (DBMS). The image contains the client and server programs that you'll need to create, run, maintain and access a PostgreSQL DBMS server.",
    "CONTAINER_SCRIPTS_PATH=/usr/share/container-scripts/postgresql",
    "ENABLED_COLLECTIONS="
  ],
  "Entrypoint": [
    "container-entrypoint"
  ],
  "Cmd": [
    "run-postgresql"
  ],
  "WorkingDir": "/opt/app-root/src"
}

    From the output, you can extract the user details, environment variables, entry point, and command. Based on your use case, the requirements may differ.

    Note: To perform a full inspection of the guest image, use the command according to the following example:
    podman image inspect private-registry.company.com/postgresql-15-c9s:latest
  4. Update the pod specification to match the guest image requirements.

    In this example, the pod specification is updated with the host image reference, security context, all required environment variables from the guest image, and the startup commands:

    containers:
- name: postgres
  image: quay.io/fedora/fedora:38
  securityContext:
    runAsUser: 26
    runAsGroup: 26
    allowPrivilegeEscalation: false
  env:
  - name: POSTGRESQL_USER
    value: testuser
  - name: POSTGRESQL_PASSWORD
    value: testpass
  - name: POSTGRESQL_DATABASE
    value: testdb
  - name: NAME
    value: s2i-core
  - name: VERSION
    value: "9"
  - name: STI_SCRIPTS_URL
    value: image:///usr/libexec/s2i
  - name: STI_SCRIPTS_PATH
    value: /usr/libexec/s2i
  - name: APP_ROOT
    value: /opt/app-root
  - name: PATH
    value: /opt/app-root/src/bin:/opt/app-root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  - name: PLATFORM
    value: el9
  - name: POSTGRESQL_VERSION
    value: "15"
  - name: POSTGRESQL_PREV_VERSION
    value: "13"
  - name: HOME
    value: /var/lib/pgsql
  - name: PGUSER
    value: postgres
  - name: APP_DATA
    value: /opt/app-root
  - name: SUMMARY
    value: PostgreSQL is an advanced Object-Relational database management system
  - name: DESCRIPTION
    value: PostgreSQL is an advanced Object-Relational database management system (DBMS). The image contains the client and server programs that you'll need to create, run, maintain and access a PostgreSQL DBMS server.
  - name: CONTAINER_SCRIPTS_PATH
    value: /usr/share/container-scripts/postgresql
  - name: ENABLED_COLLECTIONS
    value: ""
  volumeDevices:
  - name: postgresspvc
    devicePath: /dev/postgress
  command:
    - sh
    - -c
    - |
      chown -R 26:26 /var/lib/pgsql/data
      chmod -R 770 /var/lib/pgsql/data
      container-entrypoint
      run-postgresql
      exec /usr/libexec/s2i/run

In this example, the pod specification is updated to use the public Fedora image as the host image while maintaining all the runtime requirements of the private PostgreSQL guest image.