Accessing SSL Cert Key for Rootless Podman Container on Fedora CoreOS with SELinux Active

Accessing SSL Cert Key in Rootless Podman Container on Fedora CoreOS with SELinux Active

In this article, we will discuss how to access SSL cert key in a rootless Podman container on a Fedora CoreOS machine with SELinux active. The main server that hosts the SSL certificate is not accessible, and we need to access the SSL cert key in a Podman container for various purposes, such as setting up a web server or configuring a reverse proxy.

Prerequisites

Before we begin, make sure you have the following prerequisites:

• A Fedora CoreOS machine with SELinux active
• Podman installed and configured for rootless operation
• An SSL certificate and key generated using Certbot or any other SSL certificate generator

Accessing SSL Cert Key in Rootless Podman Container

To access the SSL cert key in a rootless Podman container, we need to perform the following steps:

1. Create a directory to store the SSL cert and key in the host machine.
2. Copy the SSL cert and key to the directory created in step 1.
3. Create a Podman container with the necessary software to use the SSL cert and key.
4. Mount the directory created in step 1 to the Podman container.
5. Configure the software in the Podman container to use the SSL cert and key.

Step 1: Create a Directory to Store the SSL Cert and Key

Create a directory to store the SSL cert and key in the host machine using the following command:

$ mkdir /mnt/certs

Step 2: Copy the SSL Cert and Key to the Directory Created in Step 1

Copy the SSL cert and key to the directory created in step 1 using the following commands:

$ cp /etc/letsencrypt/live/example.com/fullchain.pem /mnt/certs/
$ cp /etc/letsencrypt/live/example.com/privkey.pem /mnt/certs/

Step 3: Create a Podman Container with the Necessary Software

Create a Podman container with the necessary software to use the SSL cert and key. For example, if we want to use Nginx as the web server, we can create a Podman container using the following command:

$ podman run -d --name nginx -v /mnt/certs:/etc/nginx/certs:z nginx

In the above command, we are creating a Podman container named "nginx" with Nginx installed. We are also mounting the directory created in step 1 to the container's /etc/nginx/certs directory using the -v flag. The "z" option sets the SELinux security context for the mounted directory to allow Nginx to access the SSL cert and key.

Step 4: Configure Nginx to Use the SSL Cert and Key

Configure Nginx to use the SSL cert and key by modifying the Nginx configuration file located at /etc/nginx/conf.d/default.conf in the Podman container. We can use the following configuration as an example:

<p>server {
<br /> listen 443 ssl;
<br /> server\_name example.com;
<br />
<br /> ssl\_certificate /etc/nginx/certs/fullchain.pem;
<br /> ssl\_certificate\_key /etc/nginx/certs/privkey.pem;
<br />
<br /> location / {
<br /> proxy\_pass http://web:80;
<br /> }
<br />}
<br /></p>

In the above configuration, we are configuring Nginx to listen on port 443 for SSL connections. We are also specifying the SSL cert and key locations using the ssl\_certificate and ssl\_certificate\_key directives. Finally, we are configuring Nginx to proxy requests to another web server running on port 80 in the Podman container.

• Accessing SSL cert key in a rootless Podman container on a Fedora CoreOS machine with SELinux active requires creating a directory to store the SSL cert and key in the host machine, copying the SSL cert and key to the directory, creating a Podman container with the necessary software, mounting the directory to the Podman container, and configuring the software in the Podman container to use the SSL cert and key.

References

• Podman documentation: https://podman.io/
• Fedora CoreOS documentation: https://docs.fedoraproject.org/en-US/fedora-coreos/
• Nginx documentation: https://nginx.org/en/docs/
• Certbot documentation: https://certbot.eff.org/