|
<< Click to Display Table of Contents >> Raynet One > 2026.4 > User Guide > Workspaces in the sidebar menu > Asset Management > Containers Migration guide: Rootless containers |
Raynet One has moved to rootless containers for improved security. This guide assists customers who previously used root containers to install additional certificates and need to complete the transition to the rootless container setup.
Rootless containers run without root privileges, reducing the attack surface and following security best practices. The underlying container runtime no longer requires root access, which limits the potential impact of a compromised container on the host system. This change aligns Raynet One with modern container security standards and simplifies compliance in security-sensitive environments.
In the previous root container setup, additional CA certificates could be installed directly into the container's system certificate store at runtime. In the rootless setup, the container process no longer has write access to system certificate directories, so certificate installation follows a different approach.
Contact your Raynet administrator or refer to your container platform documentation for the updated certificate installation procedure applicable to your environment. For the Docker-based Linux runner, see the section on adding transport encryption security certificate authorities in the Add a Linux runner via Runners chapter.
Complete the following steps to migrate from root containers to rootless containers:
1.Back up your current certificate configuration, including any CA certificate files used in the existing containers.
2.Review your container startup configuration for any root-specific settings, such as custom entrypoints or runtime commands that install certificates into system directories.
3.Move your certificate files to the designated certificate mount path for your container runtime. For the Docker-based runner, mount the certificate directory as a read-only volume and configure the appropriate OpenSSL environment variable to point to it.
4.Restart the affected containers to apply the new certificate configuration.
5.Verify that certificate-dependent connections — such as integrations or scan targets that use custom CA certificates — continue to work correctly after the restart.
If you encounter issues during migration, contact Raynet support and reference this migration guide. Provide details about your container platform, the certificate types in use, and any error messages observed during or after the migration.