KeyStore YUM Nexus Docker

Sonatype Nexus Repository
, ,
1

Hello together,

in following, I refer to Proxying RHEL Yum Repositories .

A few days ago, I moved our Nexus Repository Manager from a local install, to a docker install as container.

To ensure, our RHEL servers can get this software packages by the Nexus Repository Manager, I followed the Doku, I printed at the beginn. And while the Nexus Repository Manager run as local install, it also workd very well. After I moved to a docker install, it dont.

nexus:
  image: sonatype/nexus3
  volumes:
    - ./rundir:/nexus-data:rw
    - ./nexus.vmoptions:/opt/sonatype/nexus/bin/nexus.vmoptions:ro
    - ./keystore.yum.p12:/opt/keystore.yum.p12:ro
  restart: always

-Djavax.net.ssl.keyStore=/opt/keystore.yum.p12
-Djavax.net.ssl.keyStorePassword=iKeepMySecreats

The keystoreFile is mounted as /opt/keystore.yum.p12. The nexusVmoptions mounted in ($app-dir/bin/nexus.vmoptions) /opt/sonatype/nexus/bin/nexus.vmoptions. Both got the premissions owner id 200:200 (nexus), premissions 0400 and 0466.

Inside the container the look like following:

grafik

Have someone got this problem once and know how to solve?

Best regards
Christopher Hofmann

2

Hi Christopher,

From your description I’m not really sure what issue you’re experiencing with Nexus?

3

Hello Matthew,

sorry, I forget to tell.

While I used the (local installed) Nexus instance, I could receive the rpm packages from RedHat official package source, for and on RHEL. In afterwards, using the (docker installed) Nexus, the packages aren’t accessable anymore. I just got the Error 404, not found.

It’s important to say, that I didn’t change any settings. I moved the config files from the old instance to the new one. Anything else works perfect. Exact the RedHat source.

Best regards
Christopher Hofmann

4

That doc is for RHEL 7 and is out of date. I have tried with 10 and did not have any luck, what version are you trying? I also use a container for this

5

I use RHEL 9 and 10. And while I used the local (baremetal) installation, it works well.

6

well i’ll be dammed then, I wonder if it was running thru a container thats causing the problem. I gave it root privs too

7

I can’t see how running Nexus in a container would make a difference.

You might try reading this thread also - Adding RHEL9 repos to Nexus

Aside from that and the help documentation, I would suggest looking at the client logs, the request log, the nexus log and interacting with the repository manually to see if you can identify a misconfiguration.

We also offer support as part of Nexus Repository PRO.

8

Hi Christopher,

As you can see from Matthew’s reply, I’ve had similar issue to yours. However, we run Nexus on Alma linux (not dockerized).

Have you tried changing permissions to 0644? I have to update my p12 every couple of months and if the permissions aren’t right then it gives us 404 error.

9

All this link talks about is the deprecated SHA1, which is already mentioned in the proxying-rhel-yum-repositories page. FYI: Proxy repo for rhn anyone?

The logs… you mean I have to look at them?

10

Hello together,

thanks for your help, but I still couldn’t solve the problem.

First of, the logs. They show, how the request reaches, but gets deny: HTTP code 403.

[13/May/2026:10:11:14 +0200] - "GET https://cdn.redhat.com:443/ HTTP/1.1" 403 368 434
[13/May/2026:10:11:54 +0200] - "GET https://cdn.redhat.com/content/dist/rhel10/10/x86_64/baseos/os/repodata/repomd.xml HTTP/1.1" 403 467 233
[13/May/2026:10:12:11 +0200] - "GET https://cdn.redhat.com:443/ HTTP/1.1" 403 364 172
[13/May/2026:10:12:15 +0200] - "GET https://cdn.redhat.com:443/ HTTP/1.1" 403 368 295 
[13/May/2026:10:12:19 +0200] - "GET https://cdn.redhat.com/content/dist/rhel10/10/x86_64/baseos/os/repodata/repomd.xml HTTP/1.1" 403 467 18 
[13/May/2026:10:12:58 +0200] - "GET https://cdn.redhat.com:443/ HTTP/1.1" 403 364 330 
[13/May/2026:10:13:08 +0200] - "GET https://cdn.redhat.com/content/dist/rhel10/10/x86_64/baseos/os/repodata/repomd.xml HTTP/1.1" 403 467 209 
[13/May/2026:10:13:19 +0200] - "GET https://cdn.redhat.com/content/dist/rhel10/10/x86_64/baseos/os/Packages/k/kernel-core-6.12.0-124.52.1.el10_1.x86_64.rpm HTTP/1.1" 403 552 21 
[13/May/2026:10:13:19 +0200] - "GET https://cdn.redhat.com/content/dist/rhel10/10/x86_64/baseos/os/Packages/k/kernel-modules-6.12.0-124.52.1.el10_1.x86_64.rpm HTTP/1.1" 403 555 224 
[13/May/2026:10:13:19 +0200] - "GET https://cdn.redhat.com/content/dist/rhel10/10/x86_64/baseos/os/Packages/k/kernel-6.12.0-124.52.1.el10_1.x86_64.rpm HTTP/1.1" 403 543 240 
[13/May/2026:10:14:32 +0200] - "GET https://cdn.redhat.com/content/dist/rhel10/x86_64/baseos/os/repodata/repomd.xml HTTP/1.1" 403 460 434

In addition, I tryd to run the nexus with diffrent premissions settings. Neither to run the container with root solve the problem, nor to change the premissions of the files to 0644. Also not a combination of boths.

admin@nexus:/opt/nexus/compose$ ll keystore.yum.p12
-rw-r--r-- 1 root root 4658 May 13 10:02 keystore.yum.p12

  nexus:
    image: sonatype/nexus3
    user: "root:root"
    volumes:

Last but not least where the thing with the SHA1. See article by Sonatype. I tryd to solve the problem, by ensure, to use a container image based of AlpineLinux. But that didnt change the situation. I got still the same problems as before. Anything works nice, niether the access to the officel RHEL repos.

  nexus:
    image: sonatype/nexus3:3.92.1-alpine
    volumes:
      - /opt/nexus/rundir:/nexus-data:rw
      # mount yum keystore file for RHEL repo
      # see also https://help.sonatype.com/en/proxying-rhel-yum-repositories.html
      - /opt/nexus/compose/config/nexus.vmoptions:/opt/sonatype/nexus/bin/nexus.vmoptions:ro
      - /opt/nexus/compose/certs/keystore.yum.p12:/opt/keystore.yum.p12:ro

Accidentally, does I updated on that way my nexus repository. The new version allow me the see the files via the webinterface. Both exists, been accessable and readable.

grafik
grafik536×396 10.8 KB

(Have to say, the seound file does also exists, but I can upload only one images. Policies of the forum. Cant post two images.)

When someone is being intressted to know, how I create my keystore file - I write once something for: https://github.com/Alphabeit/Costum-Ansible-Modules/tree/main/keystore_for_nexus