[CI:DOCS] List /etc/containers/certs.d as default for --cert-path

[rhatdan]

Helps Document #10116

Signed-off-by: Daniel J Walsh [email protected]

What this PR does / why we need it:

How to verify it

Which issue(s) this PR fixes:

Special notes for your reviewer:

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rhatdan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rhatdan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rhatdan]

Replaces: #12411

[vrothberg]

LGTM

[jonyhy96]

Can u show any code ref that really use /etc/containers/certs.d/ as default? I tried deploy a registry with self-signed certification, it will only work when i do pull with --cert-dir specific to /etc/containers/certs.d/.

[vrothberg]

https://github.com/containers/image/blob/main/docker/docker_client.go#L188

Do you have a $HOME/.config/containers/certs.d? If that exists, rootless Podman will use that.

[jonyhy96]

https://github.com/containers/image/blob/main/docker/docker_client.go#L188

Do you have a $HOME/.config/containers/certs.d? If that exists, rootless Podman will use that.

After reading through source code of podman pull, i can't found any code ref point to docker_client.go#L188.

Pull => abi.Pull => r.copyFromRegistry => copySingleImageFromRegistry => r.newCopier

[umohnani8]

LGTM

[rhatdan]

@umohnani8 when you give the second LGTM, could you add a / in front to merge please.

[jonyhy96]

@rhatdan @umohnani8 Have time to take a look at #12412 (comment)?

[rhatdan]

@jonyhy96 Please open a new issue. @vrothberg PTAL

[rhatdan]

@mtrmac WDYT?

[mtrmac]

What this PR does / why we need it:

? The last comment of #10116 shows this was an user error, but not in the path.

Meanwhile

Do you have a $HOME/.config/containers/certs.d? If that exists, rootless Podman will use that.

so the /etc/containers/certs.d value is not “the default”, at least not without further qualification/explanation.

So I think the short paragraph for --cert-dir should primarily be a bit more prominent about pointing to the man page to understand the specific directory structure and naming convention — and if users understand that more difficult part, they are also going to find the default paths in the same man page.

[mtrmac]

After reading through source code of podman pull, i can't found any code ref point to docker_client.go#L188.

Pull => abi.Pull => r.copyFromRegistry => copySingleImageFromRegistry =>

No,

podman/vendor/github.com/containers/common/libimage/pull.go

Line 558 in 295a6f7

srcRef, err := registryTransport.NewReference(candidate.Value)

(or another way to get a c/image/docker.dockerReference) is how it is connected.

[jonyhy96]

After reading through source code of podman pull, i can't found any code ref point to docker_client.go#L188.
Pull => abi.Pull => r.copyFromRegistry => copySingleImageFromRegistry =>

No,

podman/vendor/github.com/containers/common/libimage/pull.go

Line 558 in 295a6f7

srcRef, err := registryTransport.NewReference(candidate.Value)

(or another way to get a c/image/docker.dockerReference) is how it is connected.

Thanks for explanation! for each sourceReference it will new a docker-client which will actually use perHostCertDirs