NAME

podsec-create-podmanusers - creating users that run containers of signed images

SYNOPSIS

podsec-create-podmanusers username ...

DESCRIPTION

The script creates users of container images that have rights to run signed images in rootless mode.

OPTIONS

○

The script receives a list of users to create as parameters.

○

The users are assigned the podman group. Users use the system files /etc/containers/policy.json, /etc/containers/registries.d/default.yaml as image access policies.

○

The local user configuration files generated by the script in the ~/.config/containers/ directory are closed for changes.

EXAMPLES

podsec-create-podmanusers user1 user2 user3

SECURITY CONSIDERATIONS

○

Each user has its own namespace.

○

All used images are downloaded only from the registrars specified in the policy file /etc/containers/policy.json and placed in the user´s local cache;

○

Containers are launched in their own namespace, stored in the local cache and are not available to other users

○

The system file /etc/containers/registries.d/defaylt.yaml is used to verify the signature of images. All signatures are stored in the local WEB-server for the created cluster at the address: http://sigstore.local:81/sigstore/`

SEE ALSO

○

Description of periodic integrity monitoring of container images and containerization tool settings https://github.com/alt-cloud/podsec/tree/master/ImageSignatureVerification

AUTHOR

Aleksey Kostarev, Basalt LLC kaf@basealt.ru