Accessing a QNX Container application image

An image created using the docker save command and copied to the target can be imported using qcmctl. If the file has been copied to the /data/home/root directory, import the image using:

qcmctl image import /data/home/root/hello-container-x86_64-qnx800.tar -n local/hello-container-x86_64-qnx800:v0

To authenticate and pull the hello-container-x86_64-qnx800 from <somedockeruser>'s registry on Docker Hub:

#!/bin/bash
#
# Generate authentication token for Docker Hub
#
# requires jq for JSON parsing

# Exit on error
set -e

#optional if pulling a public repository
USER=
PASSWD=

DOCKER_REGISTRY=<somedockeruser>
REPOSITORY=hello-container-x86_64-qnx800

ROOT_PATH=$(mktemp -d ${TMPDIR:-/var/tmp}/docker-authXXXXXXXX)
TOKEN_FILE="$ROOT_PATH/docker.token"

if [ "$USER" != "" ] & [ "$PASSWD" != "" ]; then
  AUTH=(-H "Authorization: Basic $(echo -n $USER:$PASSWD | base64)")
fi

# NOTE: change the following TARGET_IP variable to your QNX target's IP.
TARGET_IP=192.168.122.173
TARGET_DEST=/tmp/

AUTH_RESPONSE=$(curl "${AUTH[@]}" "https://auth.docker.io/token?service=registry.docker.io&scope=repository:$DOCKER_REGISTRY/$REPOSITORY:pull")

if [[ $AUTH_RESPONSE != *"token"* ]]; then
  echo "Authentication failed:"
  echo "$AUTH_RESPONSE"
  exit 1
fi


TOKEN=$(echo -n $AUTH_RESPONSE |jq -r .token)

echo -n $TOKEN > $TOKEN_FILE

scp $TOKEN_FILE root@$TARGET_IP:$TARGET_DEST
rm $TOKEN_FILE

You're now ready to pull the container images onto your QNX target. To do so, you grab the image URI, as well as its tag (v0) and then invoke the qcmctl utility as follows:

# TOKEN=$(cat /tmp/docker.token)
# 
# qcmctl image pull https://registry-1.docker.io/<somedockeruser>/hello-container-x86_64-qnx800:v0 --token $TOKEN
sha256:cab3e5f365175ce5057ae80fcffe0673941af61f93099e9f519c79d4b96c4572

The Image ID is returned on the output. The above was pulling the image that was built for x86_64, but the same steps can be used for the aarch64 image with its respective image URI.

The same image may also be pulled by its digest ID rather than the tag as follows:

# qcmctl image pull https://registry-1.docker.io/<somedockeruser>/hello-container-x86_64-qnx800@sha256:01a24dc015b2929f8a258636d7b546021507799fdeb964fa05750829131e80cf --token $TOKEN
sha256:cab3e5f365175ce5057ae80fcffe0673941af61f93099e9f519c79d4b96c4572

Once downloaded, the image is then cached to the local image store on the QNX target.

To check the contents of the local image store, run:

# qcmctl image list

The output may look like the following example:

REPOSITORY                                                                  TAG   IMAGE ID       CREATED               SIZE
registry-1.docker.io/<somedockeruser>/hello-container-x86_64-qnx800         v0    cab3e5f36517   2025-03-11T15:56:55   1.76MB

You start by generating a username and password combination for authenticating with AWS ECR. This can be done on the host and then transferred to the QNX target. Below is an example script to perform this operation:

#!/bin/bash
#
# Generate username/password pair from token for authentication with AWS ECR
# private repo.
#
# requires aws CLI

# Exit on error
set -e

ROOT_PATH=$(mktemp -d ${TMPDIR:-/var/tmp}/aws-private-auth-XXXXXXXXXX)
USER_FILE="$ROOT_PATH/aws-user.out"
PASS_FILE="$ROOT_PATH/aws-pass.out"

# NOTE: change the following TARGET_IP variable to your QNX target's IP.
TARGET_IP=192.168.122.77
TARGET_DEST=/tmp/

token=$(aws ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken' | base64 -d)
name=${token%%:*}
pass=${token#*:}

echo -n $name > $USER_FILE
echo -n $pass > $PASS_FILE

scp $USER_FILE $PASS_FILE root@$TARGET_IP:$TARGET_DEST

You should be ready to pull the container images onto your QNX target. To do so, grab the image URI, as well as its tag - v0 in this case, from AWS ECR and then invoke the qcmctl utility as follows:

# USER=$(cat /tmp/aws-user.out)
# PASS=$(cat /tmp/aws-pass.out)
#
# qcmctl image pull <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/hello-container-x86_64-qnx800:v0 --user $USER --passwd $PASS
	sha256:cab3e5f365175ce5057ae80fcffe0673941af61f93099e9f519c79d4b96c4572

The Image ID is returned on the output. The above was pulling the image that was built for x86_64, but the same steps can be used for the aarch64 image with its respective image URI.

The same image may also be pulled by its digest ID rather than the tag as follows:

# qcmctl image pull <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/hello-container-x86_64-qnx800@sha256:01a24dc015b2929f8a258636d7b546021507799fdeb964fa05750829131e80cf --user $USER --passwd $PASS 
sha256:cab3e5f365175ce5057ae80fcffe0673941af61f93099e9f519c79d4b96c4572

Once downloaded, the image is then cached to the local image store on the QNX target.

To check the contents of the local image store, run:

# qcmctl image list
REPOSITORY                                                                       TAG   IMAGE ID       CREATED               SIZE
<aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/hello-container-x86_64-qnx800   v0    cab3e5f36517   2025-03-11T15:56:55   1.76MB