Procedure

1. Install RHEL.

2. Register RHEL: Enter your user name and password. The user name and password are the same as your login credentials for Red Hat Customer Portal:

   # subscription-manager register
   Registering to: subscription.rhsm.redhat.com:443/subscription
   Username: <username>
   Password: <password>

3. Subscribe to RHEL.

   • To auto-subscribe to RHEL:

     # subscription-manager attach --auto

   • To subscribe to RHEL by Pool ID:

     # subscription-manager attach --pool PoolID

4. Install the container-tools module:

   # yum module install -y container-tools

   The container-tools module includes the podman-docker package.

   The podman-docker package replaces the Docker command-line interface and docker-api with the matching Podman commands instead.

Procedure

1. Install RHEL.

2. Install the podman package:

   # yum install podman -y

3. Create a new user account:

   # useradd -c "Joe Jones" joe
   # passwd joe

   • The user is automatically configured to be able to use rootless Podman.
   • The useradd command automatically sets the range of accessible user and group IDs automatically in the /etc/subuid and /etc/subgid files.
   • If you change the /etc/subuid or /etc/subgid manually, you have to run the podman system migrate command to allow the new changes to be applied.

4. Connect to the user:

   $ ssh joe@server.example.com

   Note

   Do not use su or su - commands because these commands do not set the correct environment variables.

5. Pull the registry.access.redhat.com/ubi8/ubi container image:

   $ podman pull registry.access.redhat.com/ubi8/ubi

6. Run the container named myubi and display the OS version:

   $ podman run --rm --name=myubi registry.access.redhat.com/ubi8/ubi \ cat /etc/os-release
   NAME="Red Hat Enterprise Linux"
   VERSION="8 (Plow)"

Procedure

1. Authenticate to the registry:

   # podman login quay.io

2. Search for the image:

   • To search for a particular image on a specific registry, enter:

     # podman search quay.io/postgresql-10
     INDEX       NAME                                           DESCRIPTION           STARS   OFFICIAL   AUTOMATED
     redhat.io   registry.redhat.io/rhel8/postgresql-10         This container image ...  0
     redhat.io   registry.redhat.io/rhscl/postgresql-10-rhel7   PostgreSQL is an  ...     0

   • Alternatively, to display all images provided by a particular registry, enter:

     # podman search quay.io/

   • To search for the image name in all registries, enter:

     # podman search postgresql-10

     To display the full descriptions, pass the --no-trunc option to the command.

Procedure

1. Log in to the registry.redhat.io registry:

   $ podman login registry.redhat.io
   Username: <username>
   Password: <password>
   Login Succeeded!

2. Pull the registry.redhat.io/ubi8/ubi container image:

   $ podman pull registry.redhat.io/ubi8/ubi

Procedure

1. Create the /var/lib/images/nginx directory:

   $ mkdir -p /var/lib/images/nginx

2. Copy the layers of the docker://docker.io/nginx:latest image to the newly created directory:

   $ skopeo copy docker://docker.io/nginx:latest dir:/var/lib/images/nginx

Procedure

1. List all images:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED      SIZE
   registry.redhat.io/ubi8/ubi          latest  3269c37eae33  7 weeks ago  208 MB

2. Assign the myubi name to the registry.redhat.io/ubi8/ubi image using either:

   • The image name:

     $ podman tag registry.redhat.io/ubi8/ubi myubi

   • The image ID:

     $ podman tag 3269c37eae33 myubi

     Both commands give you the same result.

3. List all images:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED       SIZE
   registry.redhat.io/ubi8/ubi          latest  3269c37eae33  2 months ago  208 MB
   localhost/myubi                      latest  3269c37eae33  2 months ago  208 MB

   Notice that the default tag is latest for both images. You can see all the image names are assigned to the single image ID 3269c37eae33.

4. Add the 8 tag to the registry.redhat.io/ubi8/ubi image using either:

   • The image name:

     $ podman tag registry.redhat.io/ubi8/ubi myubi:8

   • The image ID:

     $ podman tag 3269c37eae33 myubi:8

     Both commands give you the same result.

5. List all images:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED       SIZE
   registry.redhat.io/ubi8/ubi          latest  3269c37eae33  2 months ago  208 MB
   localhost/myubi                      latest  3269c37eae33  2 months ago  208 MB
   localhost/myubi                      8     3269c37eae33  2 months ago  208 MB

   Notice that the default tag is latest for both images. You can see all the image names are assigned to the single image ID 3269c37eae33.

Procedure

1. Save the registry.redhat.io/rhel8/rsyslog image as a tarball:

   • In the default docker-dir format:

     $ podman save -o myrsyslog.tar registry.redhat.io/rhel8/rsyslog:latest

   • In the oci-archive format, using the --format option:

     $ podman save -o myrsyslog-oci.tar --format=oci-archive registry.redhat.io/rhel8/rsyslog

     The myrsyslog.tar and myrsyslog-oci.tar archives are stored in your current directory. The next steps are performed with the myrsyslog.tar tarball.

2. Check the file type of myrsyslog.tar:

   $ file myrsyslog.tar
   myrsyslog.tar: POSIX tar archive

3. To load the registry.redhat.io/rhel8/rsyslog:latest image from the myrsyslog.tar:

   $ podman load -i myrsyslog.tar
   ...
   Loaded image(s): registry.redhat.io/rhel8/rsyslog:latest

Procedure

1. Optional: Add an additional name to the ubi image:

   # podman tag registry.redhat.io/ubi8/ubi registry.example.com:5000/ubi8/ubi

2. Push the registry.example.com:5000/ubi8/ubi image from your local storage to a registry:

   # podman push registry.example.com:5000/ubi8/ubi

   IMPORTANT

   While there are few restrictions on how you use these images, there are some restrictions about how you can refer to them. For example, you cannot call those images Red Hat certified or Red Hat supported unless you certify it through the Red Hat Partner Connect Program, either with Red Hat Container Certification or Red Hat OpenShift Operator Certification.

Procedure

1. List all images on your local system:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED      SIZE
   registry.redhat.io/rhel8/rsyslog     latest  4b32d14201de  7 weeks ago  228 MB
   registry.redhat.io/ubi8/ubi          latest  3269c37eae33  7 weeks ago  208 MB
   localhost/myubi                      X.Y     3269c37eae33  7 weeks ago  208 MB

2. List all containers:

   $ podman ps -a
   CONTAINER ID  IMAGE                                    COMMAND          CREATED        STATUS            PORTS   NAMES
   7ccd6001166e  registry.redhat.io/rhel8/rsyslog:latest  /bin/rsyslog.sh  6 seconds ago  Up 5 seconds ago          mysyslog

   To remove the registry.redhat.io/rhel8/rsyslog image, you have to stop all containers running from this image using the podman stop command. You can stop a container by its ID or name.

3. Stop the mysyslog container:

   $ podman stop mysyslog
   7ccd6001166e9720c47fbeb077e0afd0bb635e74a1b0ede3fd34d09eaf5a52e9

4. Remove the registry.redhat.io/rhel8/rsyslog image:

   $ podman rmi registry.redhat.io/rhel8/rsyslog

   • To remove multiple images:

     $ podman rmi registry.redhat.io/rhel8/rsyslog registry.redhat.io/ubi8/ubi

   • To remove all images from your system:

     $ podman rmi -a

   • To remove images that have multiple names (tags) associated with them, add the -f option to remove them:

     $ podman rmi -f 1de7d7b3f531
     1de7d7b3f531...

Procedure

1. Generate a GPG key:

   # gpg --full-gen-key

2. Export the public key:

   # gpg --output <path>/key.gpg --armor --export <username>@redhat.com

3. Build the container image using Containerfile in the current directory:

   $ podman build -t <registry>/<namespace>/<image>

   Replace <registry>, <namespace>, and <image> with the container image identifiers. For more details, see Container registries.

4. Sign the image and push it to the registry:

    $  podman push \
       --sign-by <username>@redhat.com \
       <registry>/<namespace>/<image>

   Note

   If you need to sign existing images while moving them across container registries, you can use the skopeo copy command.

5. Optional. Display the new image signature:

   # (cd /var/lib/containers/sigstore/; find . -type f)
   ./<image>@sha256=<digest>/signature-1

6. Copy your local signatures to the lookaside web server:

   # rsync -a /var/lib/containers/sigstore user@registry-lookaside.example.com:/registry-lookaside/webroot/sigstore

Procedure

1. Update a trust scope for the <registry>:

   $ podman image trust set -f <path>/key.gpg <registry>/<namespace>

2. Optional. Verify the trust policy configuration by displaying the /etc/containers/policy.json file:

   $ cat /etc/containers/policy.json
   {
     ...
     "transports": {
       "docker": {
         "<registry>/<namespace>": [
           {
             "type": "signedBy",
             "keyType": "GPGKeys",
             "keyPath": "<path>/key.gpg"
           }
         ]
       }
     }
   }

   Note

   Typically, the /etc/containers.policy.json file is configured at a level of organization where the same keys are used. For example, <registry>/<namespace> for a public registry, or just a <registry> for a single-company dedicated registry.

3. Pull the image:

   # podman pull <registry>/<namespace>/<image>
   ...
   Storing signatures
   e7d92cdc71feacf90708cb59182d0df1b911f8ae022d29e8e95d75ca6a99776a

   The podman pull command enforces signature presence as configured, no extra options are required.

1. Install the cosign tool:

   $ git clone https://github.com/sigstore/cosign
   $ cd cosign
   $ make ./cosign

2. Generate a public and private key pair:

   $ ./cosign generate-key-pair
   ...
   Private key written to cosign.key
   Public key written to cosign.pub

Procedure

1. Add the following content to the /etc/containers/registries.d/default.yaml file:

   docker:
       <registry>:
           use-sigstore-attachments: true

   By setting the use-sigstore-attachments option, Podman and Skopeo can read and write the container sigstore signatures together with the image and save them in the same repository as the signed image.

   Note

   You can edit the system-wide registry configuration in the /etc/containers/registries.d/default.yaml file. You can also edit the registry or repository configuration section in any YAML file in the /etc/containers/registries.d directory. All YAML files are read and the filename can be arbitrary. A single scope (default-docker, registry, or namespace) can only exist in one file within the /etc/containers/registries.d directory.

2. Build the container image using Containerfile in the current directory:

   $ podman build -t <registry>/<namespace>/<image>

3. Sign the image and push it to the registry:

   $ podman push --sign-by-sigstore-private-key ./cosign.key <registry>/<namespace>/image>

   The podman push command pushes the <registry>/<namespace>/<image> local image to the remote registry as <registry>/<namespace>/<image>. The --sign-by-sigstore-private-key option adds a sigstore signature using the cosign.key private key to the <registry>/<namespace>/<image> image. The image and the sigstore signature are uploaded to the remote registry.

Procedure

1. Add the following content to the /etc/containers/registries.d/default.yaml file:

   docker:
       <registry>:
           use-sigstore-attachments: true

   By setting the use-sigstore-attachments option, Podman and Skopeo can read and write the container sigstore signatures together with the image and save them in the same repository as the signed image.

   Note

   You can edit the system-wide registry configuration in the /etc/containers/registries.d/default.yaml file. You can also edit the registry or repository configuration section in any YAML file in the /etc/containers/registries.d directory. All YAML files are read and the filename can be arbitrary. A single scope (default-docker, registry, or namespace) can only exist in one file within the /etc/containers/registries.d directory.

2. Edit the /etc/containers/policy.json file to enforce sigstore signature presence:

   ...
   "transports": {
               "docker": {
                   "<registry>/<namespace>": [
                       {
                           "type": "sigstoreSigned",
                           "keyPath": "/some/path/to/cosign.pub"
                       }
                   ]
               }
           }
   ...

   By modifying the /etc/containers/policy.json configuration file, you change the trust policy configuration. Podman, Buildah, and Skopeo enforce the existence of the container image signatures.

3. Pull the image:

   $ podman pull <registry>/<namespace>/<image>

Procedure

1. Display the type of operating system of the container based on the registry.access.redhat.com/ubi8/ubi container image using the cat /etc/os-release command:

   $ podman run --rm registry.access.redhat.com/ubi8/ubi cat /etc/os-release
   NAME="Red Hat Enterprise Linux"
   ...
   ID="rhel"
   ...
   HOME_URL="https://www.redhat.com/"
   BUG_REPORT_URL="https://bugzilla.redhat.com/"
   
   REDHAT_BUGZILLA_PRODUCT=" Red Hat Enterprise Linux 8"
   ...

2. Optional: List all containers.

   $ podman ps
   CONTAINER ID  IMAGE   COMMAND  CREATED  STATUS  PORTS   NAMES

   Because of the --rm option you should not see any container. The container was removed.

Procedure

1. Run the container named myubi based on the registry.redhat.io/ubi8/ubi image:

   $ podman run --name=myubi -it registry.access.redhat.com/ubi8/ubi /bin/bash
   [root@6ccffd0f6421 /]#

   • The -i option creates an interactive session. Without the -t option, the shell stays open, but you cannot type anything to the shell.
   • The -t option opens a terminal session. Without the -i option, the shell opens and then exits.

2. Install the procps-ng package containing a set of system utilities (for example ps, top, uptime, and so on):

   [root@6ccffd0f6421 /]# yum install procps-ng

3. Use the ps -ef command to list current processes:

   # ps -ef
   UID          PID    PPID  C STIME TTY          TIME CMD
   root           1       0  0 12:55 pts/0    00:00:00 /bin/bash
   root          31       1  0 13:07 pts/0    00:00:00 ps -ef

4. Enter exit to exit the container and return to the host:

   # exit

5. Optional: List all containers:

   $ podman ps
   CONTAINER ID  IMAGE                               COMMAND    CREATED         STATUS                     PORTS   NAMES
   1984555a2c27  registry.redhat.io/ubi8/ubi:latest  /bin/bash  21 minutes ago  Exited (0) 21 minutes ago          myubi

   You can see that the container is in Exited status.

Procedure

1. Run the container based on registry.redhat.io/rhel8/rsyslog image:

   $ podman run -d registry.redhat.io/rhel8/rsyslog

2. List all containers:

   • To list all running containers:

     $ podman ps
     CONTAINER ID IMAGE              COMMAND         CREATED       STATUS            PORTS NAMES
     74b1da000a11 rhel8/rsyslog /bin/rsyslog.sh 2 minutes ago Up About a minute       musing_brown

   • To list all containers, running or stopped:

     $ podman ps -a
     CONTAINER ID IMAGE         COMMAND    CREATED    STATUS                PORTS NAMES     IS INFRA
     d65aecc325a4 ubi8/ubi      /bin/bash  3 secs ago Exited (0) 5 secs ago peaceful_hopper false
     74b1da000a11 rhel8/rsyslog rsyslog.sh 2 mins ago Up About a minute     musing_brown    false

Procedure

1. Start the myubi container:

   • In the non interactive mode:

     $ podman start myubi

     Alternatively, you can use podman start 1984555a2c27.

   • In the interactive mode, use -a (--attach) and -t (--interactive) options to work with container bash shell:

     $ podman start -a -i myubi

     Alternatively, you can use podman start -a -i 1984555a2c27.

2. Enter exit to exit the container and return to the host:

   [root@6ccffd0f6421 /]# exit

Procedure

1. Run the container named log_test and mount the host /dev/log device inside the container:

   # podman run --name="log_test" -v /dev/log:/dev/log --rm \
     registry.redhat.io/ubi8/ubi logger "Testing logging to the host"

2. Use the journalctl utility to display logs:

   # journalctl -b | grep Testing
   Dec 09 16:55:00 localhost.localdomain root[14634]: Testing logging to the host

   The --rm option removes the container when it exits.

Procedure

1. Run the container named mysyslog:

   # podman run -d --name=mysyslog registry.redhat.io/rhel8/rsyslog

2. Optional: List all containers:

   # podman ps -a
   CONTAINER ID  IMAGE                                    COMMAND          CREATED         STATUS                     PORTS   NAMES
   c56ef6a256f8  registry.redhat.io/rhel8/rsyslog:latest  /bin/rsyslog.sh  20 minutes ago  Up 20 minutes ago                  mysyslog

3. Mount the mysyslog container:

   # podman mount mysyslog
   /var/lib/containers/storage/overlay/990b5c6ddcdeed4bde7b245885ce4544c553d108310e2b797d7be46750894719/merged

4. Display the content of the mount point using ls command:

   # ls /var/lib/containers/storage/overlay/990b5c6ddcdeed4bde7b245885ce4544c553d108310e2b797d7be46750894719/merged
   bin  boot  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

5. Display the OS version:

   # cat /var/lib/containers/storage/overlay/990b5c6ddcdeed4bde7b245885ce4544c553d108310e2b797d7be46750894719/merged/etc/os-release
   NAME="Red Hat Enterprise Linux"
   VERSION="8 (Ootpa)"
   ID="rhel"
   ID_LIKE="fedora"
   ...

Procedure

1. Set the container network interface to the IP address 10.88.0.44:

   # podman run -d --ip=10.88.0.44 registry.access.redhat.com/rhel8/rsyslog
   efde5f0a8c723f70dd5cb5dc3d5039df3b962fae65575b08662e0d5b5f9fbe85

2. Check that the IP address is set properly:

   # podman inspect efde5f0a8c723 | grep 10.88.0.44
   "IPAddress": "10.88.0.44",

Procedure

1. Execute the rpm -qa command inside the myrsyslog container to list all installed packages:

   $ podman exec -it myrsyslog rpm -qa
   tzdata-2020d-1.el8.noarch
   python3-pip-wheel-9.0.3-18.el8.noarch
   redhat-release-8.3-1.0.el8.x86_64
   filesystem-3.8-3.el8.x86_64
   ...

2. Execute a /bin/bash command in the myrsyslog container:

   $ podman exec -it myrsyslog /bin/bash

3. Install the procps-ng package containing a set of system utilities (for example ps, top, uptime, and so on):

   # yum install procps-ng

4. Inspect the container:

   • To list every process on the system:

     # ps -ef
     UID          PID    PPID  C STIME TTY          TIME CMD
     root           1       0  0 10:23 ?        00:00:01 /usr/sbin/rsyslogd -n
     root           8       0  0 11:07 pts/0    00:00:00 /bin/bash
     root          47       8  0 11:13 pts/0    00:00:00 ps -ef

   • To display file system disk space usage:

     # df -h
     Filesystem      Size  Used Avail Use% Mounted on
     fuse-overlayfs   27G  7.1G   20G  27% /
     tmpfs            64M     0   64M   0% /dev
     tmpfs           269M  936K  268M   1% /etc/hosts
     shm              63M     0   63M   0% /dev/shm
     ...

   • To display system information:

     # uname -r
     4.18.0-240.10.1.el8_3.x86_64

   • To display amount of free and used memory in megabytes:

     # free --mega
     total        used        free      shared  buff/cache   available
     Mem:       2818         615        1183          12         1020        1957
     Swap:      3124           0        3124

Procedure

1. Create a volume:

   $ podman volume create hostvolume

2. Display information about the volume:

   $ podman volume inspect hostvolume
   [
       {
           "name": "hostvolume",
           "labels": {},
           "mountpoint": "/home/username/.local/share/containers/storage/volumes/hostvolume/_data",
           "driver": "local",
           "options": {},
           "scope": "local"
       }
   ]

   Notice that it creates a volume in the volumes directory. You can save the mount point path to the variable for easier manipulation: $ mntPoint=$(podman volume inspect hostvolume --format {{.Mountpoint}}).

   Notice that if you run sudo podman volume create hostvolume, then the mount point changes to /var/lib/containers/storage/volumes/hostvolume/_data.

3. Create a text file inside the directory using the path that is stored in the mntPoint variable:

   $ echo "Hello from host" >> $mntPoint/host.txt

4. List all files in the directory defined by the mntPoint variable:

   $ ls $mntPoint/
   host.txt

5. Run the container named myubi1 and map the directory defined by the hostvolume volume name on the host to the /containervolume1 directory on the container:

   $ podman run -it --name myubi1 -v hostvolume:/containervolume1 registry.access.redhat.com/ubi8/ubi /bin/bash

   Note that if you use the volume path defined by the mntPoint variable (-v $mntPoint:/containervolume1), data can be lost when running podman volume prune command, which removes unused volumes. Always use -v hostvolume_name:/containervolume_name.

6. List the files in the shared volume on the container:

   # ls /containervolume1
   host.txt

   You can see the host.txt file which you created on the host.

7. Create a text file inside the /containervolume1 directory:

   # echo "Hello from container 1" >> /containervolume1/container1.txt

8. Detach from the container with CTRL+p and CTRL+q.

9. List the files in the shared volume on the host, you should see two files:

   $ ls $mntPoint
   container1.rxt  host.txt

   At this point, you are sharing files between the container and host. To share files between two containers, run another container named myubi2.

10. Run the container named myubi2 and map the directory defined by the hostvolume volume name on the host to the /containervolume2 directory on the container:

    $ podman run -it --name myubi2 -v hostvolume:/containervolume2 registry.access.redhat.com/ubi8/ubi /bin/bash

11. List the files in the shared volume on the container:

    # ls /containervolume2
    container1.txt host.txt

    You can see the host.txt file which you created on the host and container1.txt which you created inside the myubi1 container.

12. Create a text file inside the /containervolume2 directory:

    # echo "Hello from container 2" >> /containervolume2/container2.txt

13. Detach from the container with CTRL+p and CTRL+q.

14. List the files in the shared volume on the host, you should see three files:

    $ ls $mntPoint
    container1.rxt  container2.txt host.txt

Procedure

1. Run the myubi container based on the registry.access.redhat.com/ubi8/ubi image:

   $ podman run -dt --name=myubi registry.access.redhat.com/8/ubi

2. Optional: List all containers:

   $ podman ps -a
   CONTAINER ID  IMAGE                                    COMMAND          CREATED     STATUS         PORTS   NAMES
   a6a6d4896142  registry.access.redhat.com/8:latest   /bin/bash        7 seconds ago  Up 7 seconds ago          myubi

3. Attach to the myubi container:

   $ podman attach myubi

4. Create a file named testfile:

   [root@a6a6d4896142 /]# echo "hello" > testfile

5. Detach from the container with CTRL+p and CTRL+q.

6. Export the file system of the myubi as a myubi-container.tar on the local machine:

   $ podman export -o myubi.tar a6a6d4896142

7. Optional: List the current directory content:

   $ ls -l
   -rw-r--r--. 1 user user 210885120 Apr  6 10:50 myubi-container.tar
   ...

8. Optional: Create a myubi-container directory, extract all files from the myubi-container.tar archive. List a content of the myubi-directory in a tree-like format:

   $ mkdir myubi-container
   $ tar -xf myubi-container.tar -C myubi-container
   $ tree -L 1 myubi-container
   ├── bin -> usr/bin
   ├── boot
   ├── dev
   ├── etc
   ├── home
   ├── lib -> usr/lib
   ├── lib64 -> usr/lib64
   ├── lost+found
   ├── media
   ├── mnt
   ├── opt
   ├── proc
   ├── root
   ├── run
   ├── sbin -> usr/sbin
   ├── srv
   ├── sys
   ├── testfile
   ├── tmp
   ├── usr
   └── var
   
   20 directories, 1 file

   You can see that the myubi-container.tar contains the container file system.

9. Import the myubi.tar and saves it as a filesystem image:

   $ podman import myubi.tar myubi-imported
   Getting image source signatures
   Copying blob 277cab30fe96 done
   Copying config c296689a17 done
   Writing manifest to image destination
   Storing signatures
   c296689a17da2f33bf9d16071911636d7ce4d63f329741db679c3f41537e7cbf

10. List all images:

    $ podman images
    REPOSITORY                              TAG     IMAGE ID      CREATED         SIZE
    docker.io/library/myubi-imported       latest  c296689a17da  51 seconds ago  211 MB

11. Display the content of the testfile file:

    $ podman run -it --name=myubi-imported docker.io/library/myubi-imported cat testfile
    hello

Procedure

1. List all containers, running or stopped:

   $ podman ps -a
   CONTAINER ID IMAGE         COMMAND    CREATED    STATUS                PORTS NAMES     IS INFRA
   d65aecc325a4 ubi8/ubi      /bin/bash  3 secs ago Exited (0) 5 secs ago peaceful_hopper false
   74b1da000a11 rhel8/rsyslog rsyslog.sh 2 mins ago Up About a minute     musing_brown    false

2. Remove the containers:

   • To remove the peaceful_hopper container:

     $ podman rm peaceful_hopper

     Notice that the peaceful_hopper container was in Exited status, which means it was stopped and it can be removed immediately.

   • To remove the musing_brown container, first stop the container and then remove it:

     $ podman stop musing_brown
     $ podman rm musing_brown

     NOTE

     • To remove multiple containers:

       $ podman rm clever_yonath furious_shockley

     • To remove all containers from your local system:

       $ podman rm -a

Procedure

1. Pull the registry.access.redhat.com/ubi8/ubi container image:

   # podman pull registry.access.redhat.com/ubi8/ubi

2. Export the registry.access.redhat.com/ubi8/ubi image to the rhel.tar archive:

   # podman export $(podman create registry.access.redhat.com/ubi8/ubi) > rhel.tar

3. Create the bundle/rootfs directory:

   # mkdir -p bundle/rootfs

4. Extract the rhel.tar archive into the bundle/rootfs directory:

   # tar -C bundle/rootfs -xf rhel.tar

5. Create a new specification file named config.json for the bundle:

   # <runtime> spec -b bundle

   • The -b option specifies the bundle directory. The default value is the current directory.

6. Optional. Change the settings:

   # vi bundle/config.json

7. Create an instance of a container named myubi for a bundle:

   # <runtime> create -b bundle/ myubi

8. Start a myubi container:

   # <runtime> start myubi

Procedure

1. Create a Containerfile with the following contents to a new directory:

   FROM registry.access.redhat.com/ubi8/ubi-init
   RUN yum -y install httpd; yum clean all; systemctl enable httpd;
   RUN echo "Successful Web Server Test" > /var/www/html/index.html
   RUN mkdir /etc/systemd/system/httpd.service.d/; echo -e '[Service]\nRestart=always' > /etc/systemd/system/httpd.service.d/httpd.conf
   EXPOSE 80
   CMD [ "/sbin/init" ]

   The Containerfile installs the httpd package, enables the httpd service to start at boot time, creates a test file (index.html), exposes the Web server to the host (port 80), and starts the systemd init service (/sbin/init) when the container starts.

2. Build the container:

   # podman build --format=docker -t mysysd .

3. Optional. If you want to run containers with systemd and SELinux is enabled on your system, you must set the container_manage_cgroup boolean variable:

   # setsebool -P container_manage_cgroup 1

4. Run the container named mysysd_run:

   # podman run -d --name=mysysd_run -p 80:80 mysysd

   The mysysd image runs as the mysysd_run container as a daemon process, with port 80 from the container exposed to port 80 on the host system.

   NOTE

   In rootless mode, you have to choose host port number >= 1024. For example:

   $ podman run -d --name=mysysd -p 8081:80 mysysd

   To use port numbers < 1024, you have to modify the net.ipv4.ip_unprivileged_port_start variable:

   # sysctl net.ipv4.ip_unprivileged_port_start=80

5. Check that the container is running:

   # podman ps
   a282b0c2ad3d  localhost/mysysd:latest  /sbin/init  15 seconds ago  Up 14 seconds ago  0.0.0.0:80->80/tcp  mysysd_run

6. Test the web server:

   # curl localhost/index.html
   Successful Web Server Test

Procedure

1. Pull and build the registry.access.redhat.com/ubi8/ubi-micro image:

   # microcontainer=$(buildah from registry.access.redhat.com/ubi8/ubi-micro)

2. Mount a working container root filesystem:

   # micromount=$(buildah mount $microcontainer)

3. Install the httpd service to the micromount directory:

   # yum install \
       --installroot $micromount \
       --releasever 8 \
       --setopt install_weak_deps=false \
       --nodocs -y \
       httpd
   # yum clean all \
       --installroot $micromount

4. Unmount the root file system on the working container:

   # buildah umount $microcontainer

5. Create the ubi-micro-httpd image from a working container:

   # buildah commit $microcontainer ubi-micro-httpd

Verification steps

1. Display details about the ubi-micro-httpd image:

   # podman images ubi-micro-httpd
   localhost/ubi-micro-httpd latest 7c557e7fbe9f  22 minutes ago  151 MB

Procedure

1. Pull and run the registry.access.redhat.com/ubi8/ubi image:

   $ podman run -it --name myubi registry.access.redhat.com/ubi8/ubi

2. Add a package to the myubi container.

   • To add a package that is in the UBI repository, disable all yum repositories except for UBI repositories. For example, to add the bzip2 package:

     # yum install --disablerepo= --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms bzip2*

   • To add a package that is not in the UBI repository, do not disable any repositories. For example, to add the zsh package:

     # yum install zsh

   • To add a package that is in a different host repository, explicitly enable the repository you need. For example, to install the python38-devel package from the codeready-builder-for-rhel-8-x86_64-rpms repository:

     # yum install --enablerepo=codeready-builder-for-rhel-8-x86_64-rpms python38-devel

Verification steps

1. List all enabled repositories inside the container:

   # yum repolist

2. Ensure that the required repositories are listed.

3. List all installed packages:

   # rpm -qa

4. Ensure that the required packages are listed.

Procedure

1. Pull and run the registry.access.redhat.com/ubi8/ubi-minimal image:

   $ podman run -it --name myubimin registry.access.redhat.com/ubi8/ubi-minimal

2. Add a package to the myubimin container:

   • To add a package that is in the UBI repository, do not disable any repositories. For example, to add the bzip2 package:

     # microdnf install bzip2

   • To add a package that is in a different host repository, explicitly enable the repository you need. For example, to install the python38-devel package from the codeready-builder-for-rhel-8-x86_64-rpms repository:

     # microdnf install --enablerepo=codeready-builder-for-rhel-8-x86_64-rpms python38-devel

Verification steps

1. List all enabled repositories inside the container:

   # microdnf repolist

2. Ensure that the required repositories are listed.

3. List all installed packages:

   # rpm -qa

4. Ensure that the required packages are listed.

Verification steps

1. List all enabled repositories:

   • To list all enabled repositories inside the containers based on UBI standard or UBI init images:

     #  yum repolist

   • To list all enabled repositories inside the containers based on UBI minimal containers:

     # microdnf repolist

2. Ensure that the required repositories are listed.

3. List all installed packages:

   # rpm -qa

4. Ensure that the required packages are listed.

Procedure

1. Create a Containerfile:

   FROM registry.access.redhat.com/ubi8/ubi
   USER root
   LABEL maintainer="John Doe"
   # Update image
   RUN yum update --disablerepo=* --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms -y && rm -rf /var/cache/yum
   RUN yum install --disablerepo=* --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms httpd -y && rm -rf /var/cache/yum
   # Add default Web page and expose port
   RUN echo "The Web Server is Running" > /var/www/html/index.html
   EXPOSE 80
   # Start the service
   CMD ["-D", "FOREGROUND"]
   ENTRYPOINT ["/usr/sbin/httpd"]

2. Build the container image:

   # buildah bud -t johndoe/webserver .
   STEP 1: FROM registry.access.redhat.com/ubi8/ubi:latest
   STEP 2: USER root
   STEP 3: LABEL maintainer="John Doe"
   STEP 4: RUN yum update --disablerepo=* --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms -y
   ...
   Writing manifest to image destination
   Storing signatures
   --> f9874f27050
   f9874f270500c255b950e751e53d37c6f8f6dba13425d42f30c2a8ef26b769f2

Verification steps

1. Run the web server:

   # podman run -d --name=myweb -p 80:80 johndoe/webserver
   bbe98c71d18720d966e4567949888dc4fb86eec7d304e785d5177168a5965f64

2. Test the web server:

   # curl http://localhost/index.html
   The Web Server is Running

Procedure

1. Use the skopeo copy command to copy the source container image to a local directory:

   $ skopeo copy \
   docker://registry.access.redhat.com/ubi8:8.1-397-source \
   dir:$HOME/TEST
   ...
   Copying blob 477bc8106765 done
   Copying blob c438818481d3 done
   ...
   Writing manifest to image destination
   Storing signatures

2. Use the skopeo inspect command to inspect the source container image:

   $ skopeo inspect dir:$HOME/TEST
   {
       "Digest": "sha256:7ab721ef3305271bbb629a6db065c59bbeb87bc53e7cbf88e2953a1217ba7322",
       "RepoTags": [],
       "Created": "2020-02-11T12:14:18.612461174Z",
       "DockerVersion": "",
       "Labels": null,
       "Architecture": "amd64",
       "Os": "linux",
       "Layers": [
           "sha256:1ae73d938ab9f11718d0f6a4148eb07d38ac1c0a70b1d03e751de8bf3c2c87fa",
           "sha256:9fe966885cb8712c47efe5ecc2eaa0797a0d5ffb8b119c4bd4b400cc9e255421",
           "sha256:61b2527a4b836a4efbb82dfd449c0556c0f769570a6c02e112f88f8bbcd90166",
           ...
           "sha256:cc56c782b513e2bdd2cc2af77b69e13df4ab624ddb856c4d086206b46b9b9e5f",
           "sha256:dcf9396fdada4e6c1ce667b306b7f08a83c9e6b39d0955c481b8ea5b2a465b32",
           "sha256:feb6d2ae252402ea6a6fca8a158a7d32c7e4572db0e6e5a5eab15d4e0777951e"
       ],
       "Env": null
   }

3. Unpack all the content:

   $ cd $HOME/TEST
   $ for f in $(ls); do tar xvf $f; done

4. Check the results:

   $ find blobs/ rpm_dir/
   blobs/
   blobs/sha256
   blobs/sha256/10914f1fff060ce31388f5ab963871870535aaaa551629f5ad182384d60fdf82
   rpm_dir/
   rpm_dir/gzip-1.9-4.el8.src.rpm

   If the results are correct, the image is ready to be used.

Procedure

1. Create an empty pod:

   $ podman pod create --name mypod
   223df6b390b4ea87a090a4b5207f7b9b003187a6960bd37631ae9bc12c433aff
   The pod is in the initial state Created.

   The pod is in the initial state Created.

2. Optional: List all pods:

   $ podman pod ps
   POD ID         NAME    STATUS    CREATED                  # OF CONTAINERS   INFRA ID
   223df6b390b4   mypod   Created   Less than a second ago   1                 3afdcd93de3e

   Notice that the pod has one container in it.

3. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                 COMMAND  CREATED                 STATUS   PORTS  NAMES               POD
   3afdcd93de3e  registry.access.redhat.com/ubi8/pause            Less than a second ago  Created         223df6b390b4-infra  223df6b390b4

   You can see that the pod ID from podman ps command matches the pod ID in the podman pod ps command. The default infra container is based on the registry.access.redhat.com/ubi8/pause image.

4. Run a container named myubi in the existing pod named mypod:

   $ podman run -dt --name myubi --pod mypod registry.access.redhat.com/ubi8/ubi /bin/bash
   5df5c48fea87860cf75822ceab8370548b04c78be9fc156570949013863ccf71

5. Optional: List all pods:

   $ podman pod ps
   POD ID         NAME    STATUS    CREATED                  # OF CONTAINERS   INFRA ID
   223df6b390b4   mypod   Running   Less than a second ago   2                 3afdcd93de3e

   You can see that the pod has two containers in it.

6. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                       COMMAND    CREATED                 STATUS                     PORTS  NAMES               POD
   5df5c48fea87  registry.access.redhat.com/ubi8/ubi:latest  /bin/bash  Less than a second ago  Up Less than a second ago         myubi               223df6b390b4
   3afdcd93de3e  registry.access.redhat.com/ubi8/pause                                   Less than a second ago  Up Less than a second ago         223df6b390b4-infra  223df6b390b4

Procedure

1. Stop the pod mypod:

   $ podman pod stop mypod

2. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                               COMMAND    CREATED             STATUS                    PORTS   NAMES               POD ID        PODNAME
   5df5c48fea87  registry.redhat.io/ubi8/ubi:latest  /bin/bash  About a minute ago  Exited (0) 7 seconds ago          myubi               223df6b390b4  mypod
   
   3afdcd93de3e  registry.access.redhat.com/8/pause                           About a minute ago  Exited (0) 7 seconds ago          8a4e6527ac9d-infra  223df6b390b4  mypod

   You can see that the pod mypod and container myubi are in "Exited" status.

Procedure

1. Remove the pod mypod, type:

   $ podman pod rm mypod
   223df6b390b4ea87a090a4b5207f7b9b003187a6960bd37631ae9bc12c433aff

   Note that removing the pod automatically removes all containers inside it.

2. Optional: Check that all containers and pods were removed:

   $ podman ps
   $ podman pod ps

Procedure

1. List all networks:

   # podman network ls
   NETWORK ID    NAME        VERSION     PLUGINS
   2f259bab93aa  podman      0.4.0       bridge,portmap,firewall,tuning
   11c844f95e28  mynet       0.4.0       bridge,portmap,firewall,tuning,dnsname

2. Remove the mynet network:

   # podman network rm mynet
   mynet

Procedure

1. Display the IP address of a container:

   # podman inspect --format='{{.NetworkSettings.IPAddress}}' containerName

2. Display all networks to which container is connected:

   # podman inspect --format='{{.NetworkSettings.Networks}}' containerName

3. Display port mappings:

   # podman inspect --format='{{.NetworkSettings.Ports}}' containerName

Procedure

1. Start the container named web-container:

   # podman run -dt --name=web-container docker.io/library/httpd

2. List all containers:

   # podman ps -a
   
   CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES
   b8c057333513  docker.io/library/httpd:latest  httpd-foreground  4 seconds ago  Up 5 seconds ago              web-container

3. Inspect the container and display the IP address:

   # podman inspect --format='{{.NetworkSettings.IPAddress}}' web-container
   
   10.88.0.2

4. Run the myubi container and verify that web server is running:

   # podman run -it --name=myubi ubi8/ubi curl 10.88.0.2:80
   
   <html><body><h1>It works!</h1></body></html>

Procedure

1. Verify that the bridge is configured:

   # podman network inspect podman | grep bridge
   
       "bridge": "cni-podman0",
       "type": "bridge"

2. Display the host network configuration:

   # ip addr show cni-podman0
   
   6: cni-podman0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
       link/ether 62:af:a1:0a:ca:2e brd ff:ff:ff:ff:ff:ff
       inet 10.88.0.1/16 brd 10.88.255.255 scope global cni-podman0
          valid_lft forever preferred_lft forever
       inet6 fe80::60af:a1ff:fe0a:ca2e/64 scope link
          valid_lft forever preferred_lft forever

   You can see that the web-container has an IP of the cni-podman0 network and the network is bridged to the host.

3. Inspect the web-container and display its IP address:

   # podman inspect --format='{{.NetworkSettings.IPAddress}}' web-container
   
   10.88.0.2

4. Access the web-container directly from the host:

   $ curl 10.88.0.2:80
   
   <html><body><h1>It works!</h1></body></html>

Procedure

1. Run the unpublished container:

   # podman run -dt --name=web1 ubi8/httpd-24

2. Run the automatically published container:

   # podman run -dt --name=web2 -P ubi8/httpd-24

3. Run the manually published container and publish container port 80:

   # podman run -dt --name=web3 -p 9090:80 ubi8/httpd-24

4. List all containers:

   # podman ps
   
   CONTAINER ID  IMAGE                                            COMMAND               CREATED         STATUS             PORTS                                             NAMES
   f12fa79b8b39  registry.access.redhat.com/ubi8/httpd-24:latest  /usr/bin/run-http...  23 seconds ago  Up 24 seconds ago                                                    web1
   9024d9e815e2  registry.access.redhat.com/ubi8/httpd-24:latest  /usr/bin/run-http...  13 seconds ago  Up 13 seconds ago  0.0.0.0:43595->8080/tcp, 0.0.0.0:42423->8443/tcp  web2
   03bc2a019f1b  registry.access.redhat.com/ubi8/httpd-24:latest  /usr/bin/run-http...  2 seconds ago   Up 2 seconds ago   0.0.0.0:9090->80/tcp                              web3

   You can see that:

   • Container web1 has no published ports and can be reached only by container network or a bridge.

   • Container web2 has automatically mapped ports 43595 and 42423 to publish the application ports 8080 and 8443, respectively.

     Note

     The automatic port mapping is possible because the registry.access.redhat.com/8/httpd-24 image has the EXPOSE 8080 and EXPOSE 8443 commands in the Containerfile.

   • Container web3 has a manually published port. The host port 9090 is mapped to the container port 80.

5. Display the IP addresses of web1 and web3 containers:

   # podman inspect --format='{{.NetworkSettings.IPAddress}}' web1
   # podman inspect --format='{{.NetworkSettings.IPAddress}}' web3

6. Reach web1 container using <IP>:<port> notation:

   # curl 10.88.0.14:8080
   ...
   <title>Test Page for the HTTP Server on Red Hat Enterprise Linux</title>
   ...

7. Reach web2 container using localhost:<port> notation:

   # curl localhost:43595
   ...
   <title>Test Page for the HTTP Server on Red Hat Enterprise Linux</title>
   ...

8. Reach web3 container using <IP>:<port> notation:

   # curl 10.88.0.14:9090
   ...
   <title>Test Page for the HTTP Server on Red Hat Enterprise Linux</title>
   ...

Procedure

1. Run a receiver container attached to the mynet network:

   # podman run -d --net mynet --name receiver ubi8 sleep 3000

2. Run a sender container and reach the receiver container by its name:

   # podman run -it --rm --net mynet --name sender alpine ping receiver
   
   PING rcv01 (10.89.0.2): 56 data bytes
   64 bytes from 10.89.0.2: seq=0 ttl=42 time=0.041 ms
   64 bytes from 10.89.0.2: seq=1 ttl=42 time=0.125 ms
   64 bytes from 10.89.0.2: seq=2 ttl=42 time=0.109 ms

   Exit using the CTRL+C.

Procedure

1. Create a pod named web-pod:

   $ podman pod create --name=web-pod

2. Run the web container named web-container in the pod:

   $ podman container run -d --pod web-pod --name=web-container docker.io/library/httpd

3. List all pods and containers associated with them:

   $ podman ps --pod
   
   CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES               POD ID        PODNAME
   58653cf0cf09  k8s.gcr.io/pause:3.5                              4 minutes ago  Up 3 minutes ago              4e61a300c194-infra  4e61a300c194  web-pod
   b3f4255afdb3  docker.io/library/httpd:latest  httpd-foreground  3 minutes ago  Up 3 minutes ago              web-container  4e61a300c194  web-pod

4. Run the container in the web-pod based on the docker.io/library/fedora image:

   $ podman container run -it --rm --pod web-pod docker.io/library/fedora curl localhost
   
   <html><body><h1>It works!</h1></body></html>

   You can see that the container can reach the web-container.

Procedure

1. Create a pod named web-pod:

   # podman pod create --name=web-pod-publish -p 80:80

2. List all pods:

   # podman pod ls
   
   POD ID        NAME         STATUS   CREATED        INFRA ID      # OF CONTAINERS
   26fe5de43ab3  publish-pod  Created  5 seconds ago  7de09076d2b3  1

3. Run the web container named web-container inside the web-pod:

   # podman container run -d --pod web-pod-publish --name=web-container docker.io/library/httpd

4. List containers

   # podman ps
   
   CONTAINER ID  IMAGE                    COMMAND           CREATED             STATUS             PORTS               NAMES
   7de09076d2b3  k8s.gcr.io/pause:3.5                       About a minute ago  Up 23 seconds ago  0.0.0.0:80->80/tcp  26fe5de43ab3-infra
   088befb90e59  docker.io/library/httpd  httpd-foreground  23 seconds ago      Up 23 seconds ago  0.0.0.0:80->80/tcp  web-container

5. Verify that the web-container can be reached:

   $ curl localhost:80
   
   <html><body><h1>It works!</h1></body></html>

Procedure

1. Create a network named pod-net:

   # podman network create pod-net
   
   /etc/cni/net.d/pod-net.conflist

2. Create a pod web-pod:

   # podman pod create --net pod-net --name web-pod

3. Run a container named web-container inside the web-pod:

   # podman run -d --pod webt-pod --name=web-container docker.io/library/httpd

4. Optional. Display the pods the containers are associated with:

   # podman ps -p
   
   CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES               POD ID        PODNAME
   b7d6871d018c   registry.access.redhat.com/ubi8/pause:latest                             9 minutes ago  Up 6 minutes ago              a8e7360326ba-infra  a8e7360326ba  web-pod
   645835585e24  docker.io/library/httpd:latest  httpd-foreground  6 minutes ago  Up 6 minutes ago              web-container    a8e7360326ba  web-pod

Procedure

1. Manually run the dhcp plugin:

   # /usr/libexec/cni/dhcp daemon &
   
   [1] 4966

2. Check that the dhcp plugin is running:

   # ps -a | grep dhcp
   
   4966 pts/1    00:00:00 dhcp

3. Run the alpine container:

   # podman run -it --rm --network=example alpine ip addr show enp1s0
   
   Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
   Trying to pull docker.io/library/alpine:latest...
   ...
   Storing signatures
   
   2: eth0@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
       link/ether f6:dd:1b:a7:9b:92 brd ff:ff:ff:ff:ff:ff
       inet 192.168.1.22/24 brd 192.168.1.255 scope global eth0
       ...

   In this example:

   • The --network=example option specifies the network named example to connect.
   • The ip addr show enp1s0 command inside the alpine container checks the IP address of the network interface enp1s0.
   • The host network is 192.168.1.0/24
   • The eth0 interface leases an IP address of 192.168.1.122 for the alpine container.

Procedure

1. Create the socket unit file:

   # cat /usr/lib/systemd/system/io.podman.dhcp.socket
   [Unit]
   Description=DHCP Client for CNI
   
   [Socket]
   ListenStream=%t/cni/dhcp.sock
   SocketMode=0600
   
   [Install]
   WantedBy=sockets.target

2. Create the service unit file:

   # cat /usr/lib/systemd/system/io.podman.dhcp.service
   [Unit]
   Description=DHCP Client CNI Service
   Requires=io.podman.dhcp.socket
   After=io.podman.dhcp.socket
   
   [Service]
   Type=simple
   ExecStart=/usr/libexec/cni/dhcp daemon
   TimeoutStopSec=30
   KillMode=process
   
   
   [Install]
   WantedBy=multi-user.target
   Also=io.podman.dhcp.socket

3. Start the service immediately:

   # systemctl --now enable io.podman.dhcp.socket

Procedure

1. If the /etc/containers/container.conf file does not exist, copy the /usr/share/containers/containers.conf file to the /etc/containers/ directory:

   # cp /usr/share/containers/containers.conf /etc/containers/

2. Edit the /etc/containers/container.conf file, and add the following content to the [network] section:

   network_backend="netavark"

3. If you have any containers or pods, reset the storage back to the initial state:

   # podman system reset

4. Reboot the system:

   # reboot

Procedure

1. If the /etc/containers/container.conf file does not exist, copy the /usr/share/containers/containers.conf file to the /etc/containers/ directory:

   # cp /usr/share/containers/containers.conf /etc/containers/

2. Edit the /etc/containers/container.conf file, and add the following content to the [network] section:

   network_backend="cni"

3. If you have any containers or pods, reset the storage back to the initial state:

   # podman system reset

4. Reboot the system:

   # reboot

Procedure

1. List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                       COMMAND    CREATED                 STATUS                     PORTS  NAMES               POD
   5df5c48fea87  registry.access.redhat.com/ubi8/ubi:latest  /bin/bash  Less than a second ago  Up Less than a second ago         myubi               223df6b390b4
   3afdcd93de3e  k8s.gcr.io/pause:3.1                                   Less than a second ago  Up Less than a second ago         223df6b390b4-infra  223df6b390b4

2. Use the pod name or ID to generate the Kubernetes YAML file:

   $ podman generate kube mypod > mypod.yaml

   Note that the podman generate command does not reflect any Logical Volume Manager (LVM) logical volumes or physical volumes that might be attached to the container.

3. Display the mypod.yaml file:

   $ cat mypod.yaml
   # Generation of Kubernetes YAML is still under development!
   #
   # Save the output of this file and use kubectl create -f to import
   # it into Kubernetes.
   #
   # Created with podman-1.6.4
   apiVersion: v1
   kind: Pod
   metadata:
     creationTimestamp: "2020-06-09T10:31:56Z"
     labels:
   app: mypod
     name: mypod
   spec:
     containers:
     - command:
           - /bin/bash
           env:
           - name: PATH
                 value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
           - name: TERM
                 value: xterm
           - name: HOSTNAME
           - name: container
                 value: oci
           image: registry.access.redhat.com/ubi8/ubi:latest
           name: myubi
           resources: {}
           securityContext:
                 allowPrivilegeEscalation: true
                 capabilities: {}
                 privileged: false
                 readOnlyRootFilesystem: false
           tty: true
           workingDir: /
   status: {}

Procedure

1. Create the pod and the container from the mypod.yaml file:

   $ podman play kube mypod.yaml
   Pod:
   b8c5b99ba846ccff76c3ef257e5761c2d8a5ca4d7ffa3880531aec79c0dacb22
   Container:
   848179395ebd33dd91d14ffbde7ae273158d9695a081468f487af4e356888ece

2. List all pods:

   $ podman pod ps
   POD ID         NAME    STATUS    CREATED          # OF CONTAINERS   INFRA ID
   b8c5b99ba846   mypod   Running   19 seconds ago   2                 aa4220eaf4bb

3. List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                       COMMAND    CREATED             STATUS                 PORTS  NAMES               POD
   848179395ebd  registry.access.redhat.com/ubi8/ubi:latest  /bin/bash  About a minute ago  Up About a minute ago         myubi               b8c5b99ba846
   aa4220eaf4bb  k8s.gcr.io/pause:3.1                                   About a minute ago  Up About a minute ago         b8c5b99ba846-infra  b8c5b99ba846

   The pod IDs from podman ps command matches the pod ID from the podman pod ps command.

Procedure

1. Display the mariadb-conf/Containerfile file:

   $ cat mariadb-conf/Containerfile
   FROM docker.io/library/mariadb
   COPY my.cnf /etc/mysql/my.cnf

2. Display the mariadb-conf/my.cnf file:

   [client-server]
   # Port or socket location where to connect
   port = 3306
   socket = /run/mysqld/mysqld.sock
   
   # Import all .cnf files from the configuration directory
   [mariadbd]
   skip-host-cache
   skip-name-resolve
   bind-address = 127.0.0.1
   
   !includedir /etc/mysql/mariadb.conf.d/
   !includedir /etc/mysql/conf.d/

3. Build the docker.io/library/mariadb image using mariadb-conf/Containerfile:

   $ cd mariadb-conf
   $ podman build -t mariadb-conf .
   $ cd ..
   STEP 1: FROM docker.io/library/mariadb
   Trying to pull docker.io/library/mariadb:latest...
   Getting image source signatures
   Copying blob 7b1a6ab2e44d done
   ...
   Storing signatures
   STEP 2: COPY my.cnf /etc/mysql/my.cnf
   STEP 3: COMMIT mariadb-conf
   --> ffae584aa6e
   Successfully tagged localhost/mariadb-conf:latest
   ffae584aa6e733ee1cdf89c053337502e1089d1620ff05680b6818a96eec3c17

4. Optional. List all images:

   $ podman images
   LIST IMAGES
   REPOSITORY                                                       TAG         IMAGE ID      CREATED             SIZE
   localhost/mariadb-conf                                           latest      b66fa0fa0ef2  57 seconds ago      416 MB

5. Create the pod named wordpresspod and configure port mappings between the container and the host system:

   $ podman pod create --name wordpresspod -p 8080:80

6. Create the mydb container inside the wordpresspod pod:

   $ podman run --detach --pod wordpresspod \ -e MYSQL_ROOT_PASSWORD=1234 \ -e MYSQL_DATABASE=mywpdb \ -e MYSQL_USER=mywpuser \ -e MYSQL_PASSWORD=1234 \ --name mydb localhost/mariadb-conf

7. Create the myweb container inside the wordpresspod pod:

   $ podman run --detach --pod wordpresspod \ -e WORDPRESS_DB_HOST=127.0.0.1 \ -e WORDPRESS_DB_NAME=mywpdb \ -e WORDPRESS_DB_USER=mywpuser \ -e WORDPRESS_DB_PASSWORD=1234 \ --name myweb docker.io/wordpress

8. Optional. List all pods and containers associated with them:

   $ podman ps --pod -a
   CONTAINER ID  IMAGE                               COMMAND               CREATED                 STATUS                     PORTS                 NAMES               POD ID        PODNAME
   9ea56f771915  k8s.gcr.io/pause:3.5                                      Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  4b7f054a6f01-infra  4b7f054a6f01  wordpresspod
   60e8dbbabac5  localhost/mariadb-conf:latest       mariadbd              Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  mydb                4b7f054a6f01  wordpresspod
   045d3d506e50  docker.io/library/wordpress:latest  apache2-foregroun...  Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  myweb               4b7f054a6f01  wordpresspod

Procedure

1. List all pods and containers associated with them:

   $ podman ps --pod -a
   CONTAINER ID  IMAGE                               COMMAND               CREATED                 STATUS                     PORTS                 NAMES               POD ID        PODNAME
   9ea56f771915  k8s.gcr.io/pause:3.5                                      Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  4b7f054a6f01-infra  4b7f054a6f01  wordpresspod
   60e8dbbabac5  localhost/mariadb-conf:latest       mariadbd              Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  mydb                4b7f054a6f01  wordpresspod
   045d3d506e50  docker.io/library/wordpress:latest  apache2-foregroun...  Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  myweb               4b7f054a6f01  wordpresspod

2. Use the pod name or ID to generate the Kubernetes YAML file:

   $ podman generate kube wordpresspod >> wordpresspod.yaml

1. a directory with the same name as the image used in YAML file exists
2. that directory contains a Containerfile

Procedure

1. Create the wordpress pod using the wordpress.yaml file:

   $ podman play kube wordpress.yaml
   STEP 1/2: FROM docker.io/library/mariadb
   STEP 2/2: COPY my.cnf /etc/mysql/my.cnf
   COMMIT localhost/mariadb-conf:latest
   --> 428832c45d0
   Successfully tagged localhost/mariadb-conf:latest
   428832c45d07d78bb9cb34e0296a7dc205026c2fe4d636c54912c3d6bab7f399
   Trying to pull docker.io/library/wordpress:latest...
   Getting image source signatures
   Copying blob 99c3c1c4d556 done
   ...
   Storing signatures
   Pod:
   3e391d091d190756e655219a34de55583eed3ef59470aadd214c1fc48cae92ac
   Containers:
   6c59ebe968467d7fdb961c74a175c88cb5257fed7fb3d375c002899ea855ae1f
   29717878452ff56299531f79832723d3a620a403f4a996090ea987233df0bc3d

   The podman play kube command:

   • Automatically build the localhost/mariadb-conf:latest image based on docker.io/library/mariadb image.
   • Pull the docker.io/library/wordpress:latest image.
   • Create a pod named wordpresspod with two containers named wordpresspod-mydb and wordpresspod-myweb.

2. List all containers and pods:

   $ podman ps --pod -a
   CONTAINER ID  IMAGE                               COMMAND               CREATED        STATUS                    PORTS                 NAMES               POD ID        PODNAME
   a1dbf7b5606c  k8s.gcr.io/pause:3.5                                      3 minutes ago  Up 2 minutes ago          0.0.0.0:8080->80/tcp  3e391d091d19-infra  3e391d091d19  wordpresspod
   6c59ebe96846  localhost/mariadb-conf:latest       mariadbd              2 minutes ago  Exited (1) 2 minutes ago  0.0.0.0:8080->80/tcp  wordpresspod-mydb   3e391d091d19  wordpresspod
   29717878452f  docker.io/library/wordpress:latest  apache2-foregroun...  2 minutes ago  Up 2 minutes ago          0.0.0.0:8080->80/tcp  wordpresspod-myweb  3e391d091d19  wordpresspod

Procedure

1. Create a container (for example myubi):

   $ podman create --name myubi registry.access.redhat.com/ubi8:latest sleep infinity
   0280afe98bb75a5c5e713b28de4b7c5cb49f156f1cce4a208f13fee2f75cb453

2. Use the container name or ID to generate the systemd unit file and direct it into the ~/.config/systemd/user/container-myubi.service file:

   $ podman generate systemd --name myubi > ~/.config/systemd/user/container-myubi.service

Procedure

1. Pull the image you want to use on your system. For example, to pull the httpd-24 image:

   # podman pull registry.access.redhat.com/ubi8/httpd-24

2. Optional. List all images available on your system:

   # podman images
   REPOSITORY                                TAG                  IMAGE ID      CREATED        SIZE
   registry.access.redhat.com/ubi8/httpd-24  latest               8594be0a0b57  2 weeks ago    462 MB

3. Create the httpd container:

   # podman create --name httpd -p 8080:8080 registry.access.redhat.com/ubi8/httpd-24
   cdb9f981cf143021b1679599d860026b13a77187f75e46cc0eac85293710a4b1

4. Optional. Verify the container has been created:

   # podman ps -a
   CONTAINER ID  IMAGE                                            COMMAND               CREATED        STATUS      PORTS                   NAMES
   cdb9f981cf14  registry.access.redhat.com/ubi8/httpd-24:latest  /usr/bin/run-http...  5 minutes ago  Created     0.0.0.0:8080->8080/tcp  httpd

5. Generate a systemd unit file for the httpd container:

   # podman generate systemd --new --files --name httpd
   /root/container-httpd.service

6. Display the content of the generated container-httpd.service systemd unit file:

   # cat /root/container-httpd.service
   # container-httpd.service
   # autogenerated by Podman 3.3.1
   # Wed Sep  8 20:41:44 CEST 2021
   
   [Unit]
   Description=Podman container-httpd.service
   Documentation=man:podman-generate-systemd(1)
   Wants=network-online.target
   After=network-online.target
   RequiresMountsFor=%t/containers
   
   [Service]
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Restart=on-failure
   TimeoutStopSec=70
   ExecStartPre=/bin/rm -f %t/%n.ctr-id
   ExecStart=/usr/bin/podman run --cidfile=%t/%n.ctr-id --sdnotify=conmon --cgroups=no-conmon --rm -d --replace --name httpd -p 8080:8080 registry.access.redhat.com/ubi8/httpd-24
   ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
   ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
   Type=notify
   NotifyAccess=all
   
   [Install]
   WantedBy=multi-user.target default.target

   NOTE

   Unit files generated using the --new option do not expect containers and pods to exist. Therefore, they perform the podman run command when starting the service (see the ExecStart line) instead of the podman start command. For example, see section Generating a systemd unit file using Podman.

   • The podman run command uses the following command-line options:

     • The --conmon-pidfile option points to a path to store the process ID for the conmon process running on the host. The conmon process terminates with the same exit status as the container, which allows systemd to report the correct service status and restart the container if needed.
     • The --cidfile option points to the path that stores the container ID.
     • The %t is the path to the run time directory root, for example /run/user/$UserID.
     • The %n is the full name of the service.

7. Copy unit files to /etc/systemd/system for installing them as a root user:

   # cp -Z container-httpd.service /etc/systemd/system

8. Enable and start the container-httpd.service:

   # systemctl daemon-reload
   # systemctl enable --now container-httpd.service
   Created symlink /etc/systemd/system/multi-user.target.wants/container-httpd.service → /etc/systemd/system/container-httpd.service.
   Created symlink /etc/systemd/system/default.target.wants/container-httpd.service → /etc/systemd/system/container-httpd.service.

Procedure

1. Reload systemd manager configuration:

   # systemctl --user daemon-reload

2. Enable the service container.service and start it at boot time:

   # systemctl --user enable container.service

3. Start the service immediately:

   # systemctl --user start container.service

4. Check the status of the service:

   $ systemctl --user status container.service
   ● container.service - Podman container.service
      Loaded: loaded (/home/user/.config/systemd/user/container.service; enabled; vendor preset: enabled)
      Active: active (running) since Wed 2020-09-16 11:56:57 CEST; 8s ago
        Docs: man:podman-generate-systemd(1)
     Process: 80602 ExecStart=/usr/bin/podman run --conmon-pidfile //run/user/1000/container.service-pid --cidfile //run/user/1000/container.service-cid -d ubi8-minimal:>
     Process: 80601 ExecStartPre=/usr/bin/rm -f //run/user/1000/container.service-pid //run/user/1000/container.service-cid (code=exited, status=0/SUCCESS)
    Main PID: 80617 (conmon)
      CGroup: /user.slice/user-1000.slice/user@1000.service/container.service
              ├─ 2870 /usr/bin/podman
              ├─80612 /usr/bin/slirp4netns --disable-host-loopback --mtu 65520 --enable-sandbox --enable-seccomp -c -e 3 -r 4 --netns-type=path /run/user/1000/netns/cni->
              ├─80614 /usr/bin/fuse-overlayfs -o lowerdir=/home/user/.local/share/containers/storage/overlay/l/YJSPGXM2OCDZPLMLXJOW3NRF6Q:/home/user/.local/share/contain>
              ├─80617 /usr/bin/conmon --api-version 1 -c cbc75d6031508dfd3d78a74a03e4ace1732b51223e72a2ce4aa3bfe10a78e4fa -u cbc75d6031508dfd3d78a74a03e4ace1732b51223e72>
              └─cbc75d6031508dfd3d78a74a03e4ace1732b51223e72a2ce4aa3bfe10a78e4fa
                └─80626 /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 1d

   You can check if the service is enabled using the systemctl is-enabled container.service command.

Procedure

1. Create an empty pod, for example named systemd-pod:

   $ podman pod create --name systemd-pod
   11d4646ba41b1fffa51c108cbdf97cfab3213f7bd9b3e1ca52fe81b90fed5577

2. Optional. List all pods:

   $ podman pod ps
   POD ID        NAME         STATUS   CREATED         # OF CONTAINERS  INFRA ID
   11d4646ba41b  systemd-pod  Created  40 seconds ago  1                8a428b257111
   11d4646ba41b1fffa51c108cbdf97cfab3213f7bd9b3e1ca52fe81b90fed5577

3. Create two containers in the empty pod. For example, to create container0 and container1 in systemd-pod:

   $ podman create --pod systemd-pod --name container0 registry.access.redhat.com/ubi8 top
   $ podman create --pod systemd-pod --name container1 registry.access.redhat.com/ubi8 top

4. Optional. List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                   COMMAND  CREATED        STATUS         PORTS   NAMES               POD ID        PODNAME
   24666f47d9b2  registry.access.redhat.com/ubi8:latest  top      3 minutes ago  Created                container0          3130f724e229  systemd-pod
   56eb1bf0cdfe  k8s.gcr.io/pause:3.2                             4 minutes ago  Created                3130f724e229-infra  3130f724e229  systemd-pod
   62118d170e43  registry.access.redhat.com/ubi8:latest  top      3 seconds ago  Created                container1          3130f724e229  systemd-pod

5. Generate the systemd unit file for the new pod:

   $ podman generate systemd --files --name systemd-pod
   /home/user1/pod-systemd-pod.service
   /home/user1/container-container0.service
   /home/user1/container-container1.service

   Note that three systemd unit files are generated, one for the systemd-pod pod and two for the containers container0 and container1.

6. Display pod-systemd-pod.service unit file:

   $ cat pod-systemd-pod.service
   # pod-systemd-pod.service
   # autogenerated by Podman 3.3.1
   # Wed Sep  8 20:49:17 CEST 2021
   
   [Unit]
   Description=Podman pod-systemd-pod.service
   Documentation=man:podman-generate-systemd(1)
   Wants=network-online.target
   After=network-online.target
   RequiresMountsFor=
   Requires=container-container0.service container-container1.service
   Before=container-container0.service container-container1.service
   
   [Service]
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Restart=on-failure
   TimeoutStopSec=70
   ExecStart=/usr/bin/podman start bcb128965b8e-infra
   ExecStop=/usr/bin/podman stop -t 10 bcb128965b8e-infra
   ExecStopPost=/usr/bin/podman stop -t 10 bcb128965b8e-infra
   PIDFile=/run/user/1000/containers/overlay-containers/1dfdcf20e35043939ea3f80f002c65c00d560e47223685dbc3230e26fe001b29/userdata/conmon.pid
   Type=forking
   
   [Install]
   WantedBy=multi-user.target default.target

   • The Requires line in the [Unit] section defines dependencies on container-container0.service and container-container1.service unit files. Both unit files will be activated.
   • The ExecStart and ExecStop lines in the [Service] section start and stop the infra-container, respectively.

7. Display container-container0.service unit file:

   $ cat container-container0.service
   # container-container0.service
   # autogenerated by Podman 3.3.1
   # Wed Sep  8 20:49:17 CEST 2021
   
   [Unit]
   Description=Podman container-container0.service
   Documentation=man:podman-generate-systemd(1)
   Wants=network-online.target
   After=network-online.target
   RequiresMountsFor=/run/user/1000/containers
   BindsTo=pod-systemd-pod.service
   After=pod-systemd-pod.service
   
   [Service]
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Restart=on-failure
   TimeoutStopSec=70
   ExecStart=/usr/bin/podman start container0
   ExecStop=/usr/bin/podman stop -t 10 container0
   ExecStopPost=/usr/bin/podman stop -t 10 container0
   PIDFile=/run/user/1000/containers/overlay-containers/4bccd7c8616ae5909b05317df4066fa90a64a067375af5996fdef9152f6d51f5/userdata/conmon.pid
   Type=forking
   
   [Install]
   WantedBy=multi-user.target default.target

   • The BindsTo line line in the [Unit] section defines the dependency on the pod-systemd-pod.service unit file
   • The ExecStart and ExecStop lines in the [Service] section start and stop the container0 respectively.

8. Display container-container1.service unit file:

   $ cat container-container1.service

9. Copy all the generated files to $HOME/.config/systemd/user for installing as a non-root user:

   $ cp pod-systemd-pod.service container-container0.service container-container1.service $HOME/.config/systemd/user

10. Enable the service and start at user login:

    $ systemctl enable --user pod-systemd-pod.service
    Created symlink /home/user1/.config/systemd/user/multi-user.target.wants/pod-systemd-pod.service → /home/user1/.config/systemd/user/pod-systemd-pod.service.
    Created symlink /home/user1/.config/systemd/user/default.target.wants/pod-systemd-pod.service → /home/user1/.config/systemd/user/pod-systemd-pod.service.

    Note that the service stops at user logout.

Procedure

1. Start a myubi container based on the registry.access.redhat.com/ubi8/ubi-init image:

   # podman run --label "io.containers.autoupdate=image" \ --name myubi -dt registry.access.redhat.com/ubi8/ubi-init top
   bc219740a210455fa27deacc96d50a9e20516492f1417507c13ce1533dbdcd9d

2. Optional: List containers that are running or have exited:

   # podman ps -a
   CONTAINER ID  IMAGE                                            COMMAND  CREATED         STATUS             PORTS   NAMES
   76465a5e2933  registry.access.redhat.com/8/ubi-init:latest  top      24 seconds ago  Up 23 seconds ago          myubi

3. Generate a systemd unit file for the myubi container:

   # podman generate systemd --new --files --name myubi /root/container-myubi.service

4. Copy unit files to /usr/lib/systemd/system for installing it as a root user:

   # cp -Z ~/container-myubi.service /usr/lib/systemd/system

5. Reload systemd manager configuration:

   # systemctl daemon-reload

6. Start and check the status of a container:

   # systemctl start container-myubi.service
   # systemctl status container-myubi.service

7. Auto-update the container:

   # podman auto-update

Procedure

1. Display the podman-auto-update.service unit file:

   # cat /usr/lib/systemd/system/podman-auto-update.service
   
   [Unit]
   Description=Podman auto-update service
   Documentation=man:podman-auto-update(1)
   Wants=network.target
   After=network-online.target
   
   [Service]
   Type=oneshot
   ExecStart=/usr/bin/podman auto-update
   
   [Install]
   WantedBy=multi-user.target default.target

2. Display the podman-auto-update.timer unit file:

   # cat /usr/lib/systemd/system/podman-auto-update.timer
   
   [Unit]
   Description=Podman auto-update timer
   
   [Timer]
   OnCalendar=daily
   Persistent=true
   
   [Install]
   WantedBy=timers.target

   In this example, the podman auto-update command is launched daily at midnight.

3. Enable the podman-auto-update.timer service at system start:

   # systemctl enable podman-auto-update.timer

4. Start the systemd service:

   # systemctl start podman-auto-update.timer

5. Optional: List all timers:

   # systemctl list-timers --all
   NEXT                         LEFT      LAST                         PASSED       UNIT                         ACTIVATES
   Wed 2020-12-09 00:00:00 CET  9h left   n/a                          n/a          podman-auto-update.timer     podman-auto-update.service

   You can see that podman-auto-update.timer activates the podman-auto-update.service.

Procedure

1. Log in to the registry.redhat.io registry:

   $ podman login registry.redhat.io
   Username: myuser@mycompany.com
   Password: <password>
   Login Succeeded!

2. Get the registry.redhat.io/rhel8/skopeo container image:

   $ podman pull registry.redhat.io/rhel8/skopeo

3. Inspect a remote container image registry.access.redhat.com/ubi8/ubi using Skopeo:

   $ podman run --rm registry.redhat.io/rhel8/skopeo \ skopeo inspect docker://registry.access.redhat.com/ubi8/ubi
   {
       "Name": "registry.access.redhat.com/ubi8/ubi",
       ...
       "Labels": {
           "architecture": "x86_64",
           ...
           "name": "ubi8",
           ...
           "summary": "Provides the latest release of Red Hat Universal Base Image 8.",
           "url": "https://access.redhat.com/containers/#/registry.access.redhat.com/ubi8/images/8.2-347",
           ...
       },
       "Architecture": "amd64",
       "Os": "linux",
       "Layers": [
       ...
       ],
       "Env": [
           "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
           "container=oci"
       ]
   }

   The --rm option removes the registry.redhat.io/rhel8/skopeo image after the container exits.

Procedure

1. Copy the registry.access.redhat.com/ubi8/ubi image into your local container storage:

   $ podman run --privileged --rm -v $HOME/.local/share/containers/storage:/var/lib/containers/storage \ registry.redhat.io/rhel8/skopeo skopeo copy \ docker://registry.access.redhat.com/ubi8/ubi containers-storage:registry.access.redhat.com/ubi8/ubi

   • The --privileged option disables all security mechanisms. Red Hat recommends only using this option in trusted environments.

   • To avoid disabling security mechanisms, export the images to a tarball or any other path-based image transport and mount them in the Skopeo container:

     • $ podman save --format oci-archive -o oci.tar $IMAGE
     • $ podman run --rm -v oci.tar:/oci.tar registry.redhat.io/rhel8/skopeo copy oci-archive:/oci.tar $DESTINATION

2. Optional: List images in local storage:

   $ podman images
   REPOSITORY                               TAG     IMAGE ID      CREATED       SIZE
   registry.access.redhat.com/ubi8/ubi      latest  ecbc6f53bba0  8 weeks ago   211 MB

Procedure

1. Log in to the registry.redhat.io registry:

   $ podman login registry.redhat.io
   Username: myuser@mycompany.com
   Password: <password>
   Login Succeeded!

2. Pull and run the registry.redhat.io/rhel8/buildah image:

   # podman run --rm --device /dev/fuse --cap-add sys_chroot -it \ registry.redhat.io/rhel8/buildah /bin/bash

   • The --rm option removes the registry.redhat.io/rhel8/buildah image after the container exits.
   • The --device option adds a host device to the container.
   • The sys_chroot - capability to change to a different root directory. It is not included in the default capabilities of a container.

3. Create a new container using a registry.access.redhat.com/ubi8 image:

   # buildah from registry.access.redhat.com/ubi8
   ...
   ubi8-working-container

4. Run the ls / command inside the ubi8-working-container container:

   # buildah run --isolation=chroot ubi8-working-container ls /
   bin  boot  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv

5. Optional: List all images in a local storage:

   # buildah images
   REPOSITORY                        TAG      IMAGE ID       CREATED       SIZE
   registry.access.redhat.com/ubi8   latest   ecbc6f53bba0   5 weeks ago   211 MB

6. Optional: List the working containers and their base images:

   # buildah containers
   CONTAINER ID  BUILDER  IMAGE ID     IMAGE NAME                       CONTAINER NAME
   0aaba7192762     *     ecbc6f53bba0 registry.access.redhat.com/ub... ubi8-working-container

7. Optional: Push the registry.access.redhat.com/ubi8 image to the a local registry located on registry.example.com:

   # buildah push ecbc6f53bba0 registry.example.com:5000/ubi8/ubi

Procedure

1. Run the container based on registry.redhat.io/rhel8/podman image:

   # podman run --privileged --name podman_container -it \ registry.redhat.io/rhel8/podman /bin/bash

   • Run the outer container named podman_container based on the registry.redhat.io/rhel8/podman image.
   • The --it option specifies that you want to run an interactive bash shell within a container.
   • The --privileged option disables the security features that isolate the container from the host.

2. Create a Containerfile inside the podman_container container:

   # vi Containerfile
   FROM registry.access.redhat.com/ubi8/ubi
   RUN yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
   RUN yum -y install moon-buggy && yum clean all
   CMD ["/usr/bin/moon-buggy"]

   The commands in the Containerfile cause the following build command to:

   • Build a container from the registry.access.redhat.com/ubi8/ubi image.
   • Install the epel-release-latest-8.noarch.rpm package.
   • Install the moon-buggy package.
   • Set the container command.

3. Build a new container image named moon-buggy using the Containerfile:

   # podman build -t moon-buggy .

4. Optional: List all images:

   # podman images
   REPOSITORY                  TAG      IMAGE ID      CREATED        SIZE
   localhost/moon-buggy  latest  c97c58abb564  13 seconds ago  1.67 GB
   registry.access.redhat.com/ubi8/ubi latest 4199acc83c6a  132seconds ago 213 MB

5. Run a new container based on a moon-buggy container:

   # podman run -it --name moon moon-buggy

6. Optional: Tag the moon-buggy image:

   # podman tag moon-buggy registry.example.com/moon-buggy

7. Optional: Push the moon-buggy image to the registry:

   # podman push registry.example.com/moon-buggy

Verification

1. List all images in local storage:

   # buildah images
   REPOSITORY                                  TAG      IMAGE ID       CREATED       SIZE
   registry.access.redhat.com/ubi8/ubi         latest   272209ff0ae5   2 weeks ago   234 MB

2. List the working containers and their base images:

   # buildah containers
   CONTAINER ID  BUILDER  IMAGE ID     IMAGE NAME                       CONTAINER NAME
   01eab9588ae1     *     272209ff0ae5 registry.access.redhat.com/ub... ubi-working-container

Procedure

1. Create a Containerfile:

   # cat Containerfile
   FROM registry.access.redhat.com/ubi8/ubi
   ADD myecho /usr/local/bin
   ENTRYPOINT "/usr/local/bin/myecho"

2. Create a myecho script:

   # cat myecho
   echo "This container works!"

3. Change the access permissions of myecho script:

   # chmod 755 myecho

4. Build the myecho image using Containerfile in the current directory:

   # buildah bud -t myecho .
   STEP 1: FROM registry.access.redhat.com/ubi8/ubi
   STEP 2: ADD myecho /usr/local/bin
   STEP 3: ENTRYPOINT "/usr/local/bin/myecho"
   STEP 4: COMMIT myecho
   ...
   Storing signatures

Verification

1. List all images:

   # buildah images
   REPOSITORY                                  TAG      IMAGE ID       CREATED              SIZE
   localhost/myecho                            latest   b28cd00741b3   About a minute ago   234 MB

2. Run the myecho container based on the localhost/myecho image:

   # podman run --name=myecho localhost/myecho
   This container works!

3. List all containers:

   # podman ps -a
   0d97517428d  localhost/myecho                                     12 seconds ago  Exited (0) 13 seconds ago          myecho

Procedure

1. Create a working container based on the registry.access.redhat.com/ubi8/ubi image and save the name of the container to the mycontainer variable:

   # mycontainer=$(buildah from localhost/myecho)
   
   # echo $mycontainer
   myecho-working-container

2. Mount the myecho-working-container container and save the mount point path to the mymount variable:

   # mymount=$(buildah mount $mycontainer)
   
   # echo $mymount
   /var/lib/containers/storage/overlay/c1709df40031dda7c49e93575d9c8eebcaa5d8129033a58e5b6a95019684cc25/merged

3. Modify the myecho script and make it executable:

   # echo 'echo "We modified this container."' >> $mymount/usr/local/bin/myecho
   # chmod +x $mymount/usr/local/bin/myecho

4. Create the myecho2 image from the myecho-working-container container:

   # buildah commit $mycontainer containers-storage:myecho2

Verification

1. List all images in local storage:

   # buildah images
   REPOSITORY                                  TAG      IMAGE ID       CREATED          SIZE
   docker.io/library/myecho2                   latest   4547d2c3e436   4 minutes ago    234 MB
   localhost/myecho                            latest   b28cd00741b3   56 minutes ago   234 MB

2. Run the myecho2 container based on the docker.io/library/myecho2 image:

   # podman run --name=myecho2 docker.io/library/myecho2
   This container works!
   We even modified it.

Procedure

1. Create a script named newecho and make it executable:

   # cat newecho
   echo "I changed this container"
   # chmod 755 newecho

2. Create a new working container:

   # buildah from myecho:latest
   myecho-working-container-2

3. Copy the newecho script to /usr/local/bin directory inside the container:

   # buildah copy myecho-working-container-2 newecho /usr/local/bin

4. Change the configuration to use the newecho script as the new entrypoint:

   # buildah config --entrypoint "/bin/sh -c /usr/local/bin/newecho" myecho-working-container-2

5. Optional. Run the myecho-working-container-2 container whixh triggers the newecho script to be executed:

   # buildah run myecho-working-container-2 -- sh -c '/usr/local/bin/newecho'
   I changed this container

6. Commit the myecho-working-container-2 container to a new image called mynewecho:

   # buildah commit myecho-working-container-2 containers-storage:mynewecho

1. Create an empty container:

   # buildah from scratch
   working-container

2. Mount the working-container container and save the mount point path to the scratchmnt variable:

   # scratchmnt=$(buildah mount working-container)
   
   
   # echo $scratchmnt
   /var/lib/containers/storage/overlay/be2eaecf9f74b6acfe4d0017dd5534fde06b2fa8de9ed875691f6ccc791c1836/merged

3. Initialize an RPM database within the scratch image and add the redhat-release package:

   # yum install -y --releasever=8 --installroot=$scratchmnt redhat-release

4. Install the httpd service to the scratch directory:

   # yum install -y --setopt=reposdir=/etc/yum.repos.d \ --installroot=$scratchmnt \ --setopt=cachedir=/var/cache/dnf httpd

5. Create the $scratchmnt/var/www/html/index.html file:

   # mkdir -p $scratchmnt/var/www/html
   # echo "Your httpd container from scratch works!" > $scratchmnt/var/www/html/index.html

6. Configure working-container to run the httpd daemon directly from the container:

   # buildah config --cmd "/usr/sbin/httpd -DFOREGROUND" working-container
   # buildah config --port 80/tcp working-container
   # buildah commit working-container localhost/myhttpd:latest

Verification

1. List all images in local storage:

   # podman images
   REPOSITORY                                 TAG     IMAGE ID      CREATED         SIZE
   localhost/myhttpd                          latest  08da72792f60  2 minutes ago   121 MB

2. Run the localhost/myhttpd image and configure port mappings between the container and the host system:

   # podman run -p 8080:80 -d --name myhttpd 08da72792f60

3. Test the web server:

   # curl localhost:8080
   Your httpd container from scratch works!

Procedure

1. Create the local registry on your machine:

   # podman run -d -p 5000:5000 registry:2

2. Push the myecho:latest image to the localhost registry:

   #  buildah push --tls-verify=false myecho:latest localhost:5000/myecho:latest
   Getting image source signatures
   Copying blob sha256:e4efd0...
   ...
   Writing manifest to image destination
   Storing signatures

Verification

1. List all images in the localhost repository:

   # curl http://localhost:5000/v2/_catalog
   {"repositories":["myecho2]}
   
   
   # curl http://localhost:5000/v2/myecho2/tags/list
   {"name":"myecho","tags":["latest"]}

2. Inspect the docker://localhost:5000/myecho:latest image:

   # skopeo inspect --tls-verify=false docker://localhost:5000/myecho:latest | less
   {
       "Name": "localhost:5000/myecho",
       "Digest": "sha256:8999ff6050...",
       "RepoTags": [
           "latest"
       ],
       "Created": "2021-06-28T14:44:05.919583964Z",
       "DockerVersion": "",
       "Labels": {
           "architecture": "x86_64",
           "authoritative-source-url": "registry.redhat.io",
       ...
   }

3. Pull the localhost:5000/myecho image:

   # podman pull --tls-verify=false localhost:5000/myecho2
   # podman run localhost:5000/myecho2
   This container works!

Procedure

1. Push the docker.io/library/myecho:latest to your Docker Hub. Replace username and password with your Docker Hub credentials:

   # buildah push --creds username:password \ docker.io/library/myecho:latest docker://testaccountXX/myecho:latest

Procedure

1. List all images on your local system:

   # buildah images
   REPOSITORY                                  TAG      IMAGE ID       CREATED          SIZE
   localhost/johndoe/webserver                 latest   dc5fcc610313   46 minutes ago   263 MB
   docker.io/library/mynewecho                 latest   fa2091a7d8b6   17 hours ago     234 MB
   docker.io/library/myecho2                   latest   4547d2c3e436   6 days ago       234 MB
   localhost/myecho                            latest   b28cd00741b3   6 days ago       234 MB
   localhost/ubi-micro-httpd                   latest   c6a7678c4139   12 days ago      152 MB
   registry.access.redhat.com/ubi8/ubi         latest   272209ff0ae5   3 weeks ago      234 MB

2. Remove the localhost/myecho image:

   # buildah rmi localhost/myecho

   • To remove multiple images:

     # buildah rmi docker.io/library/mynewecho docker.io/library/myecho2

   • To remove all images from your system:

     # buildah rmi -a

   • To remove images that have multiple names (tags) associated with them, add the -f option to remove them:

     # buildah rmi -f localhost/ubi-micro-httpd

Procedure

1. List all containers:

   # buildah containers
   CONTAINER ID  BUILDER  IMAGE ID     IMAGE NAME                       CONTAINER NAME
   05387e29ab93     *     c37e14066ac7 docker.io/library/myecho:latest  myecho-working-container

2. Remove the myecho-working-container container:

   # buildah rm myecho-working-container
   05387e29ab93151cf52e9c85c573f3e8ab64af1592b1ff9315db8a10a77d7c22

Procedure

1. Define a health check:

   $ podman run -dt --name=hc-container -p 8080:8080 --health-cmd='curl http://localhost:8080 || exit 1' --health-interval=0 registry.access.redhat.com/ubi8/httpd-24

   • The --health-cmd option sets a health check command for the container.
   • The --health-interval=0 option with 0 value indicates that you want to run the health check manually.

2. Check the health status of the hc-container container:

   • Using the podman inspect command:

     $ podman inspect --format='{{json .State.Health.Status}}' hc-container
     healthy

   • Using the podman ps command:

     $ podman ps
     CONTAINER ID  IMAGE                 COMMAND               CREATED      STATUS          PORTS       NAMES
     a680c6919fe  localhost/hc-container:latest  /usr/bin/run-http...  2 minutes ago  Up 2 minutes (healthy) hc-container

   • Using the podman healthcheck run command:

     $ podman healthcheck run hc-container
     healthy

Procedure

1. Create a Containerfile:

   $ cat Containerfile
   FROM registry.access.redhat.com/ubi8/httpd-24
   EXPOSE 8080
   HEALTHCHECK CMD curl http://localhost:8080 || exit 1

   Note

   The HEALTHCHECK instruction is supported only for the docker image format. For the oci image format, the instruction is ignored.

2. Build the container and add an image name:

   $ podman build --format=docker -t hc-container .
   STEP 1/3: FROM registry.access.redhat.com/ubi8/httpd-24
   STEP 2/3: EXPOSE 8080
   --> 5aea97430fd
   STEP 3/3: HEALTHCHECK CMD curl http://localhost:8080 || exit 1
   COMMIT health-check
   Successfully tagged localhost/health-check:latest
   a680c6919fe6bf1a79219a1b3d6216550d5a8f83570c36d0dadfee1bb74b924e

3. Run the container:

   $ podman run -dt --name=hc-container localhost/hc-container

4. Check the health status of the hc-container container:

   • Using the podman inspect command:

     $ podman inspect --format='{{json .State.Health.Status}}' hc-container
     healthy

   • Using the podman ps command:

     $ podman ps
     CONTAINER ID  IMAGE                 COMMAND               CREATED      STATUS          PORTS       NAMES
     a680c6919fe  localhost/hc-container:latest  /usr/bin/run-http...  2 minutes ago  Up 2 minutes (healthy) hc-container

   • Using the podman healthcheck run command:

     $ podman healthcheck run hc-container
     healthy

Procedure

1. Create a Python based server:

   # cat counter.py
   #!/usr/bin/python3
   
   import http.server
   
   counter = 0
   
   class handler(http.server.BaseHTTPRequestHandler):
       def do_GET(s):
           global counter
              s.send_response(200)
              s.send_header('Content-type', 'text/html')
              s.end_headers()
              s.wfile.write(b'%d\n' % counter)
              counter += 1
   
   
   server = http.server.HTTPServer(('', 8088), handler)
   server.serve_forever()

2. Create a container with the following definition:

   # cat Containerfile
   FROM registry.access.redhat.com/ubi8/ubi
   
   COPY counter.py /home/counter.py
   
   RUN useradd -ms /bin/bash counter
   
   RUN yum -y install python3 && chmod 755 /home/counter.py
   
   USER counter
   ENTRYPOINT /home/counter.py

   The container is based on the Universal Base Image (UBI 8) and uses a Python based server.

3. Build the container:

   # podman build . --tag counter

   Files counter.py and Containerfile are the input for the container build process (podman build). The built image is stored locally and tagged with the tag counter.

4. Start the container as root:

   # podman run --name criu-test --detach counter

5. To list all running containers, enter:

   # podman ps
   CONTAINER ID  IMAGE  COMMAND  CREATED   STATUS  PORTS NAMES
   e4f82fd84d48  localhost/counter:latest  5 seconds ago  Up 4 seconds ago  criu-test

6. Display IP address of the container:

   # podman inspect criu-test --format "{{.NetworkSettings.IPAddress}}"
   10.88.0.247

7. Send requests to the container:

   # curl 10.88.0.247:8080
   0
   # curl 10.88.0.247:8080
   1

8. Create a checkpoint for the container:

   # podman container checkpoint criu-test

9. Reboot the system.

10. Restore the container:

    # podman container restore --keep criu-test

11. Send requests to the container:

    # curl 10.88.0.247:8080
    2
    # curl 10.88.0.247:8080
    3
    # curl 10.88.0.247:8080
    4

    The result now does not start at 0 again, but continues at the previous value.

Procedure

1. Create a checkpoint of the container, and export the checkpoint image to a tar.gz file:

   # podman container checkpoint criu-test --export /tmp/chkpt.tar.gz

2. Restore the container from the tar.gz file:

   # podman container restore --import /tmp/chkpt.tar.gz --name counter1
   # podman container restore --import /tmp/chkpt.tar.gz --name counter2
   # podman container restore --import /tmp/chkpt.tar.gz --name counter3

   The --name (-n) option specifies a new name for containers restored from the exported checkpoint.

3. Display ID and name of each container:

   # podman ps -a --format "{{.ID}} {{.Names}}"
   a8b2e50d463c counter3
   faabc5c27362 counter2
   2ce648af11e5 counter1

4. Display IP address of each container:

   #️ podman inspect counter1 --format "{{.NetworkSettings.IPAddress}}"
   10.88.0.248
   
   #️ podman inspect counter2 --format "{{.NetworkSettings.IPAddress}}"
   10.88.0.249
   
   #️ podman inspect counter3 --format "{{.NetworkSettings.IPAddress}}"
   10.88.0.250

5. Send requests to each container:

   #️ curl 10.88.0.248:8080
   4
   #️ curl 10.88.0.249:8080
   4
   #️ curl 10.88.0.250:8080
   4

   Note, that the result is 4 in all cases, because you are working with different containers restored from the same checkpoint.

Procedure

1. Start the container as root:

   # podman run --name criu-test --detach counter

2. Display IP address of the container:

   # podman inspect criu-test --format "{{.NetworkSettings.IPAddress}}"
   10.88.0.247

3. Send requests to the container:

   # curl 10.88.0.247:8080
   0
   # curl 10.88.0.247:8080
   1

4. Create a checkpoint of the container, and export the checkpoint image to a tar.gz file:

   # podman container checkpoint criu-test --export /tmp/chkpt.tar.gz

5. Copy the checkpoint archive to the destination host:

   # scp /tmp/chkpt.tar.gz other_host:/tmp/

6. Restore the checkpoint on the destination host (other_host):

   # podman container restore --import /tmp/chkpt.tar.gz

7. Send a request to the container on the destination host (other_host):

   # *curl 10.88.0.247:8080*
   2

Procedure

1. Install Open MPI:

   # yum install openmpi

2. To activate the environment modules, type:

   $ . /etc/profile.d/modules.sh

3. Load the mpi/openmpi-x86_64 module:

   $ module load mpi/openmpi-x86_64

   Optionally, to automatically load mpi/openmpi-x86_64 module, add this line to the .bashrc file:

   $ echo "module load mpi/openmpi-x86_64" >> .bashrc

4. To combine mpirun and podman, create a container with the following definition:

   $ cat Containerfile
   FROM registry.access.redhat.com/ubi8/ubi
   
   RUN yum -y install openmpi-devel wget && \
       yum clean all
   
   RUN wget https://raw.githubusercontent.com/open-mpi/ompi/master/test/simple/ring.c && \
       /usr/lib64/openmpi/bin/mpicc ring.c -o /home/ring && \
       rm -f ring.c

5. Build the container:

   $ podman build --tag=mpi-ring .

6. Start the container. On a system with 4 CPUs this command starts 4 containers:

   $ mpirun \ --mca orte_tmpdir_base /tmp/podman-mpirun \ podman run --env-host \ -v /tmp/podman-mpirun:/tmp/podman-mpirun \ --userns=keep-id \ --net=host --pid=host --ipc=host \ mpi-ring /home/ring
   Rank 2 has cleared MPI_Init
   Rank 2 has completed ring
   Rank 2 has completed MPI_Barrier
   Rank 3 has cleared MPI_Init
   Rank 3 has completed ring
   Rank 3 has completed MPI_Barrier
   Rank 1 has cleared MPI_Init
   Rank 1 has completed ring
   Rank 1 has completed MPI_Barrier
   Rank 0 has cleared MPI_Init
   Rank 0 has completed ring
   Rank 0 has completed MPI_Barrier

   As a result, mpirun starts up 4 Podman containers and each container is running one instance of the ring binary. All 4 processes are communicating over MPI with each other.

Procedure

1. Pull the rsyslog image:

   # podman pull registry.redhat.io/rhel8/rsyslog

2. Display the install runlabel for rsyslog:

   # podman container runlabel install --display rhel8/rsyslog
   command: podman run --rm --privileged -v /:/host -e HOST=/host -e IMAGE=registry.redhat.io/rhel8/rsyslog:latest -e NAME=rsyslog registry.redhat.io/rhel8/rsyslog:latest /bin/install.sh

   This shows that the command will open privileges to the host, mount the host root filesystem on /host in the container, and run an install.sh script.

3. Run the install runlabel for rsyslog:

   # podman container runlabel install rhel8/rsyslog
   command: podman run --rm --privileged -v /:/host -e HOST=/host -e IMAGE=registry.redhat.io/rhel8/rsyslog:latest -e NAME=rsyslog registry.redhat.io/rhel8/rsyslog:latest /bin/install.sh
   Creating directory at /host//etc/pki/rsyslog
   Creating directory at /host//etc/rsyslog.d
   Installing file at /host//etc/rsyslog.conf
   Installing file at /host//etc/sysconfig/rsyslog
   Installing file at /host//etc/logrotate.d/syslog

   This creates files on the host system that the rsyslog image will use later.

4. Display the run runlabel for rsyslog:

   # podman container runlabel run --display rhel8/rsyslog
   command: podman run -d --privileged --name rsyslog --net=host --pid=host -v /etc/pki/rsyslog:/etc/pki/rsyslog -v /etc/rsyslog.conf:/etc/rsyslog.conf -v /etc/sysconfig/rsyslog:/etc/sysconfig/rsyslog -v /etc/rsyslog.d:/etc/rsyslog.d -v /var/log:/var/log -v /var/lib/rsyslog:/var/lib/rsyslog -v /run:/run -v /etc/machine-id:/etc/machine-id -v /etc/localtime:/etc/localtime -e IMAGE=registry.redhat.io/rhel8/rsyslog:latest -e NAME=rsyslog --restart=always registry.redhat.io/rhel8/rsyslog:latest /bin/rsyslog.sh

   This shows that the command opens privileges to the host and mount specific files and directories from the host inside the container, when it launches the rsyslog container to run the rsyslogd daemon.

5. Execute the run runlabel for rsyslog:

   # podman container runlabel run rhel8/rsyslog
   command: podman run -d --privileged --name rsyslog --net=host --pid=host -v /etc/pki/rsyslog:/etc/pki/rsyslog -v /etc/rsyslog.conf:/etc/rsyslog.conf -v /etc/sysconfig/rsyslog:/etc/sysconfig/rsyslog -v /etc/rsyslog.d:/etc/rsyslog.d -v /var/log:/var/log -v /var/lib/rsyslog:/var/lib/rsyslog -v /run:/run -v /etc/machine-id:/etc/machine-id -v /etc/localtime:/etc/localtime -e IMAGE=registry.redhat.io/rhel8/rsyslog:latest -e NAME=rsyslog --restart=always registry.redhat.io/rhel8/rsyslog:latest /bin/rsyslog.sh
   28a0d719ff179adcea81eb63cc90fcd09f1755d5edb121399068a4ea59bd0f53

   The rsyslog container opens privileges, mounts what it needs from the host, and runs the rsyslogd daemon in the background (-d). The rsyslogd daemon begins gathering log messages and directing messages to files in the /var/log directory.

6. Display the uninstall runlabel for rsyslog:

   # podman container runlabel uninstall --display rhel8/rsyslog
   command: podman run --rm --privileged -v /:/host -e HOST=/host -e IMAGE=registry.redhat.io/rhel8/rsyslog:latest -e NAME=rsyslog registry.redhat.io/rhel8/rsyslog:latest /bin/uninstall.sh

7. Run the uninstall runlabel for rsyslog:

   # podman container runlabel uninstall rhel8/rsyslog
   command: podman run --rm --privileged -v /:/host -e HOST=/host -e IMAGE=registry.redhat.io/rhel8/rsyslog:latest -e NAME=rsyslog registry.redhat.io/rhel8/rsyslog:latest /bin/uninstall.sh

1. Use systemd to activate the Podman API socket.
2. Use a Podman client to perform basic commands.

Procedure

1. Start the service immediately:

   # systemctl enable --now podman.socket

2. To enable the link to var/lib/docker.sock using the docker-podman package:

   # yum install podman-docker

Verification steps

1. Display system information of Podman:

   # podman-remote info

2. Verify the link:

   # ls -al /var/run/docker.sock
   lrwxrwxrwx. 1 root root 23 Nov  4 10:19 /var/run/docker.sock -> /run/podman/podman.sock