Podman Auto-Update with a Private Registry on RHEL

When running containers on RHEL with Podman's built-in auto-update mechanism, images pulled from a private registry need credentials available system-wide (or per-user) so that podman auto-update can authenticate without any interactive input. This guide covers setting up the auth file and validating that auto-update can see and pull new images.

1. Create the containers config directory

If it doesn't already exist, create the Podman config directory for the user that will run the auto-update (root in this example):

[root@unixworld ~]# mkdir $HOME/.config/containers

2. Log in to the private registry

Authenticate against the private registry and store the credentials in an auth file scoped to this directory:

[root@unixworld ~]# podman login --authfile $HOME/.config/containers/auth.json git.unixworld.org -u unixworld -p<TOKEN>

Replace <TOKEN> with the actual access token or password for the unixworld registry account. Using an authfile (rather than the default system-wide credential store) keeps these credentials isolated and makes it clear which file Podman will reference for this registry.

Breaking down the command

• login — the Podman subcommand that authenticates against a container registry and saves the resulting credentials so subsequent podman pull, podman push, and podman auto-update operations against that registry don't prompt for a username or password.
• git.unixworld.org — the registry hostname to authenticate against. This is a positional argument, not a flag; Podman stores the credentials keyed to this hostname inside the auth file.
• -u unixworld — short form of --username. Specifies the registry account username to authenticate as.
• -p<TOKEN> — short form of --password. Supplies the password or access token for that account. Note there's no space between -p and the value (-p<TOKEN>), which is valid shorthand for combining a single-letter flag with its argument; -p <TOKEN> with a space also works. For non-interactive/scripted logins like this, using an access token instead of an account password is recommended, and omitting -p entirely will make Podman prompt for the password interactively instead.
• —-authfile=path — path of the authentication file. Default is ${XDG_RUNTIME_DIR}/containers/auth.json on Linux, and $HOME/.config/containers/auth.json otherwise. You can override it per-command with --authfile as shown above, or set the REGISTRY_AUTH_FILE environment variable to point Podman (and podman auto-update) at a specific file without passing the flag every time.

3. Validate with a dry run

Once logged in, confirm that Podman can see the auto-update-labeled containers and check for new images without actually performing the update:

[root@unixworld ~]# podman auto-update --dry-run

This should list the containers eligible for auto-update along with whether a newer image is available on the private registry. If authentication is working correctly, there should be no permission or login errors in the output.

Notes

• Containers must be run with --label "io.containers.autoupdate=registry" (or the equivalent in a systemd Quadlet/unit file) for podman auto-update to consider them.
• For rootless containers, run the same steps as the unprivileged user rather than root, since each user has its own $HOME/.config/containers directory and auth file.
• The systemd timer podman-auto-update.timer (enabled via systemctl enable --now podman-auto-update.timer) is what triggers this on a schedule in production.