[Podman] Re: rootless container needs to access private key stored on host

One can use letsencypt post-renewal hooks as such and probably copy the certs to a folder with permissions for the users. ------------------------------------------- This is the hook file cat /etc/letsencrypt/renewal-hooks/post/renew-ssl.sh Hook file content cat "/etc/letsencrypt/live/domainfullchain.pem" "/etc/letsencrypt/live/domain/privkey.pem" | sudo -u leon tee /home/leon/containers/portfolio/haproxy/sslcerts/domain > /dev/null ------------------------------------------- I also add a systemctl reload so that the container can reread the SSL. Not sure if this is what you're looking for. On Thu, Sep 15, 2022 at 3:18 PM Daniel Walsh <dwalsh(a)redhat.com <mailto:dwalsh@redhat.com>> wrote: > On 9/14/22 17:24, Mikhaël MYARA wrote: >> dear all, >> >> I work on a podman container for postfix + dovecot. On my host, >> the encrypt keys (including the private key) are stored in >> /etc/letsencrypt/live/xxxxx.xxx/, and these keys have to be used by >> both postfix and dovecot. >> >> However the "/etc/letsencrypt/live" folder is only accessible by >> root, so that when I share the /etc/letsencrypt folder using the -v >> option, the container has no access to the live folder. Of course, >> if I do awful things like chmod 777 on the /etc/letsencrypt/live >> folder everything is ok. But of course it is not a good way for >> that. >> >> I wanted to know what I should do to avoid this chmod 777 while >> working with a rootless container. Can I map the volume using root >> ? (and if so is it a good idea ?) Should I play with groups on the >> host (= a group called like "encrypters", that may contain only >> root and the user that runs the container ?) Or a root process that >> performs copies of the keys ? >> I also have seen the "--secret" option for podman I did not >> understad If it would solve my problem. Please also notice that the >> "let's encrypt" keys are re-generated sometimes because they have a >> 1 month lifetime. >> >> If there is some guideline somewhere about this topic please show >> me. >> >> My host is ubuntu 22.04, and the podman version is 3.4.4. I don't >> use SE linux for now. >> >> Thanks a lot, >> Mike >> >> _______________________________________________ >> Podman mailing list -- podman(a)lists.podman.io >> <mailto:podman@lists.podman.io> >> To unsubscribe send an email to podman-leave(a)lists.podman.io >> <mailto:podman-leave@lists.podman.io> > I guess if the goal is to change the /etc/letsencrypt/live on the > host via a container, then you will have to make the directory > writable by the non root user running the container. > > This can be done using group access or ACLs. Inside of the container > the files will look like they are owned by the nobody user. > > If you want the files read from the host but only writeable from > within the container, IE they don't effect the host at all, you > could try to mount the volume as an Overlay volume. > > -v /etc/letsencrypt/live:/etc/letsencrypt/live:O > > Note the values here will be private to the container and will be > removed when the container is destroyed. > > If you don't want values read from the host at all, but just the > container to use secrets, then you could use secrets > > _______________________________________________ > Podman mailing list -- podman(a)lists.podman.io > <mailto:podman@lists.podman.io> > To unsubscribe send an email to podman-leave(a)lists.podman.io > <mailto:podman-leave@lists.podman.io>