Configure the image builder worker in disconnected environments

On standalone Red Hat Enterprise Linux, configure the image builder worker to use a local registry for base images and an offline RPM repository for air-gapped operating system image builds.

Before you begin

  • Base images (rhel-bootc, bootc-image-builder, podman, syft, and related images) mirrored to <local-registry>
  • An offline .repo file with baseurl pointing at a file:// path or internal HTTP mirror, not cdn.redhat.com
  • Red Hat Edge Manager services installed and running on the management host
  • Podman configuration background as described in Configuring the image builder worker for subscription-managed RPM content

For image builder workers on Red Hat OpenShift Container Platform, see Configure the image builder worker in disconnected environments.

Procedure

  1. Override worker images and the RPM repository URL in /etc/flightctl/service-config.yaml: 
    imagebuilderWorker:
  rpmRepoUrl: "http://<rpm-mirror-host>:<port>/rhem-offline.repo"
  serviceImages:
    podman:
      image: "<local-registry>/podman/stable:<version>"
    bootcImageBuilder:
      image: "<local-registry>/bootc-image-builder:<tag>"
    syft:
      image: "<local-registry>/anchore/syft:<version>"

    Publish the .repo file from the same HTTP server that serves your offline RPM tree. The rpmRepoUrl must resolve to a file the worker can fetch. Replace image paths with the locations where you mirrored the containers.

  2. When <local-registry> requires authentication for builder service images, mount registry credentials into the image builder worker. See Configuring registry authentication for builder service images.
  3. Restart the image builder services: 
    sudo systemctl restart flightctl-imagebuilder-api.service \
                       flightctl-imagebuilder-worker.service

    For connected Quadlet configuration with host subscription mounts, see Configuring on Red Hat Enterprise Linux with Podman Quadlets in Configuring the image builder worker for subscription-managed RPM content.

Results

  • sudo systemctl status flightctl-imagebuilder-worker.service reports active (running).
  • sudo journalctl -u flightctl-imagebuilder-worker.service --no-pager -n 50 does not show image pull or RPM repository errors.
  • When your mirror registry requires authentication, worker logs do not report unauthorized or authentication required errors for podman, bootc-image-builder, or syft image pulls.