automatic login to registry before pull

[hmoffatt]

I'm storing my production images in AWS ECR in a private registry. Using the registry requires fetching a token (via the awscli) and passing it to podman. The token is only valid for 12 hours.

What's the best way to ensure the token is valid whenever podman needs it?

Right now I use ansible to update my running containers and I have it login, pull the image and then restart the container.

I'm currently using hand-written hand-written systemd units, so I could add the login step to ExecStartPre=.

I'd like to use Quadlet, and I don't see mention of ExecStartPre= in the documentation, though I guess one could add that to a separate one-shot service and depend on that(?).

What if I wanted to enable automatic updates? Should I just renew the token regularly through cron?

[hmoffatt]

Would anyone have any ideas to share?

[rhatdan]

You can use ExecStartPre=. in quadlets, and this is what I would recommend.

[hmoffatt]

I'd like to use Quadlet, and I don't see mention of ExecStartPre= in the documentation

Just noticed that the man page mentions everything outside of [Container] is passed through to the systemd unit, so ExecStartPre just works without needing any special code in quadlet.