vcontainer: fix registry login and TLS certificate chain

vcontainer-common.sh:
- Fix docker/podman login hanging silently in daemon mode. The login
  command requires interactive stdin for the password prompt, which
  the non-interactive daemon-send channel cannot provide. Use
  daemon-interactive mode (same as vshell/exec -it) which provides
  TTY passthrough via the virtio-serial + socat + expect channel.

ca-certificates bbappend:
- Add Let's Encrypt E8 (ECDSA) and R11 (RSA) intermediate certificates
  via a ca-certificates bbappend. Certs are fetched at build time from
  letsencrypt.org and installed into the standard CA certificate path.
  update-ca-certificates incorporates them into the system CA bundle.
- Some registries (e.g., registry.yocto.io) don't send the full
  certificate chain, causing TLS verification to fail with Go programs
  (Docker, skopeo, podman) even though the root CAs are present.

vdkr-rootfs-image.bb:
- Add ca-certificates to IMAGE_INSTALL

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

1 files changed, 49 insertions, 0 deletions

diff --git a/recipes-containers/vcontainer/README.md b/recipes-containers/vcontainer/README.md
index 76d54d18..657dd02e 100644
--- a/recipes-containers/vcontainer/README.md
+++ b/recipes-containers/vcontainer/README.md
@@ -268,6 +268,55 @@ vdkr pull alpine:latest
 vdkr images   # Shows alpine:latest
 ```
 
+## Registry Login and Configuration
+
+For authenticated registries:
+
+```bash
+# Login (interactive password prompt)
+vdkr login --username myuser https://registry.example.com/
+
+# Pull from the registry
+vdkr pull registry.example.com/myimage:latest
+```
+
+Set a default registry so you don't need to specify the full URL each time:
+
+```bash
+# Set default registry (persisted across sessions)
+vdkr vconfig registry registry.example.com
+
+# Now pulls try the default registry first, then Docker Hub
+vdkr pull myimage:latest
+
+# One-off override without changing the default
+vdkr --registry other.registry.com pull myimage:latest
+
+# Clear default registry
+vdkr vconfig registry --reset
+```
+
+**Note:** The `--registry` flag is a vdkr option that sets the default
+registry for pulls. For `login`, pass the registry URL as a positional
+argument after the login flags:
+
+```bash
+# Correct:
+vdkr login --username myuser https://registry.example.com/
+
+# Wrong (--registry is consumed by vdkr, login gets no URL):
+vdkr --registry https://registry.example.com/ login --username myuser
+```
+
+**TLS certificates:** The vdkr/vpdmn rootfs images include common
+intermediate certificates (Let's Encrypt E8/R11) to handle registries
+that don't send the full certificate chain. For self-signed registries,
+use `--secure-registry --ca-cert`:
+
+```bash
+vdkr --secure-registry --ca-cert /path/to/ca.crt pull myimage
+```
+
 ## Volume Mounts
 
 Mount host directories into containers using `-v` (requires memory resident mode):