Procedure

1. Install RHEL.

2. Register RHEL: Enter your user name and password. The user name and password are the same as your login credentials for Red Hat Customer Portal:

   # subscription-manager register
   Registering to: subscription.rhsm.redhat.com:443/subscription
   Username: ********
   Password: **********

3. Subscribe to RHEL.

   • To auto-subscribe to RHEL:

     # subscription-manager attach --auto

   • To subscribe to RHEL by Pool ID:

     # subscription-manager attach --pool PoolID

4. Install the container-tools module:

   # yum module install -y container-tools

5. Optional. Install the podman-docker package:

   # yum install -y podman-docker

   The podman-docker package replaces the Docker command-line interface and docker-api with the matching Podman commands instead.

Procedure

1. Install RHEL.

2. Install the podman package:

   # yum install podman -y

3. Create a new user account:

   # useradd -c "Joe Jones" joe
   # passwd joe

   • The user is automatically configured to be able to use rootless Podman.
   • The useradd command automatically sets the range of accessible user and group IDs automatically in the /etc/subuid and /etc/subgid files.

4. Connect to the user:

   $ ssh joe@server.example.com

1. Pull the registry.access.redhat.com/ubi8/ubi container image:

   $ podman pull registry.access.redhat.com/ubi8/ubi

2. Run the container named myubi and display the OS version:

   $ podman run --rm --name=myubi registry.access.redhat.com/ubi8/ubi cat \
       /etc/os-release
   NAME="Red Hat Enterprise Linux"
   VERSION="8.4 (Ootpa)"

Procedure

1. Create a Containerfile with the following contents to a new directory:

   FROM registry.access.redhat.com/ubi8/ubi-init
   RUN yum -y install httpd; yum clean all; systemctl enable httpd;
   RUN echo "Successful Web Server Test" > /var/www/html/index.html
   RUN mkdir /etc/systemd/system/httpd.service.d/; echo -e '[Service]\nRestart=always' > /etc/systemd/system/httpd.service.d/httpd.conf
   EXPOSE 80
   CMD [ "/sbin/init" ]

   The Containerfile installs the httpd package, enables the httpd service to start at boot time, creates a test file (index.html), exposes the Web server to the host (port 80), and starts the systemd init service (/sbin/init) when the container starts.

2. Build the container:

   # podman build --format=docker -t mysysd .

3. Optional. If you want to run containers with systemd and SELinux is enabled on your system, you must set the container_manage_cgroup boolean variable:

   # setsebool -P container_manage_cgroup 1

4. Run the container named mysysd_run:

   # podman run -d --name=mysysd_run -p 80:80 mysysd

   The mysysd image runs as the mysysd_run container as a daemon process, with port 80 from the container exposed to port 80 on the host system.

   NOTE

   In rootless mode, you have to choose host port number >= 1024. For example:

   $ podman run -d --name=mysysd -p 8081:80 mysysd

   To use port numbers < 1024, you have to modify the net.ipv4.ip_unprivileged_port_start variable:

   $ sudo sysctl net.ipv4.ip_unprivileged_port_start=80

5. Check that the container is running:

   # podman ps
   a282b0c2ad3d  localhost/mysysd:latest  /sbin/init  15 seconds ago  Up 14 seconds ago  0.0.0.0:80->80/tcp  mysysd_run

6. Test the web server:

   # curl localhost/index.html
   Successful Web Server Test

Procedure

1. Pull and build the registry.access.redhat.com/ubi8/ubi-micro image:

   # microcontainer=$(buildah from registry.access.redhat.com/ubi8/ubi-micro)

2. Mount a working container root filesystem:

   # micromount=$(buildah mount $microcontainer)

3. Install the httpd service to the micromount directory:

   # yum install \
       --installroot $micromount \
       --releasever 8 \
       --setopt install_weak_deps=false \
       --nodocs -y \
       httpd
   # yum clean all \
       --installroot $micromount

4. Unmount the root file system on the working container:

   # buildah umount $microcontainer

5. Create the ubi-micro-httpd image from a working container:

   # buildah commit $microcontainer ubi-micro-httpd

Verification steps

1. Display details about the ubi-micro-httpd image:

   # podman images ubi-micro-httpd
   localhost/ubi-micro-httpd latest 7c557e7fbe9f  22 minutes ago  151 MB

Procedure

1. Authenticate to the registry:

   # podman login quay.io

2. Search for the image:

   • To search for a particular image on a specific registry, enter:

     podman search quay.io/postgresql-10
     INDEX       NAME                                           DESCRIPTION           STARS   OFFICIAL   AUTOMATED
     redhat.io   registry.redhat.io/rhel8/postgresql-10         This container image ...  0
     redhat.io   registry.redhat.io/rhscl/postgresql-10-rhel7   PostgreSQL is an  ...     0

   • Alternatively, to display all images provided by a particular registry, enter:

     # podman search quay.io/

   • To search for the image name in all registries, enter:

     # podman search postgresql-10

     To display the full descriptions, pass the --no-trunc option to the command.

Procedure

1. Log in to the registry.redhat.io registry:

   $ podman login registry.redhat.io
   Username: username
   Password: **********
   Login Succeeded!

2. Pull the registry.redhat.io/ubi8/ubi container image:

   $ podman pull registry.redhat.io/ubi8/ubi

Procedure

1. Create the /var/lib/images/nginx directory:

   $ mkdir -p /var/lib/images/nginx

2. Copy the layers of the docker://docker.io/nginx:latest image to the newly created directory:

   $ skopeo copy docker://docker.io/nginx:latest dir:/var/lib/images/nginx

Procedure

1. List all images:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED      SIZE
   registry.redhat.io/ubi8/ubi          latest  3269c37eae33  7 weeks ago  208 MB

2. Assign the myubi name to the registry.redhat.io/ubi8/ubi image using either:

   • The image name:

     $ podman tag registry.redhat.io/ubi8/ubi myubi

   • The image ID:

     $ podman tag 3269c37eae33 myubi

     Both commands give you the same result.

3. List all images:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED       SIZE
   registry.redhat.io/ubi8/ubi          latest  3269c37eae33  2 months ago  208 MB
   localhost/myubi                      latest  3269c37eae33  2 months ago  208 MB

   Notice that the default tag is latest for both images. You can see all the image names are assigned to the single image ID 3269c37eae33.

4. Add the 8.4 tag to the registry.redhat.io/ubi8/ubi image using either:

   • The image name:

     $ podman tag registry.redhat.io/ubi8/ubi myubi:8.4

   • The image ID:

     $ podman tag 3269c37eae33 myubi:8.4

     Both commands give you the same result.

5. List all images:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED       SIZE
   registry.redhat.io/ubi8/ubi          latest  3269c37eae33  2 months ago  208 MB
   localhost/myubi                      latest  3269c37eae33  2 months ago  208 MB
   localhost/myubi                      8.4     3269c37eae33  2 months ago  208 MB

   Notice that the default tag is latest for both images. You can see all the image names are assigned to the single image ID 3269c37eae33.

Procedure

1. Save the registry.redhat.io/rhel8/rsyslog image as a tarball:

   • In the default docker-dir format:

     $ podman save -o myrsyslog.tar registry.redhat.io/rhel8/rsyslog:latest

   • In the oci-archive format, using the --format option:

     $ podman save -o myrsyslog-oci.tar --format=oci-archive registry.redhat.io/rhel8/rsyslog

     The myrsyslog.tar and myrsyslog-oci.tar archives are stored in your current directory. The next steps are performed with the myrsyslog.tar tarball.

2. Check the file type of myrsyslog.tar:

   $ file myrsyslog.tar
   myrsyslog.tar: POSIX tar archive

3. To load the registry.redhat.io/rhel8/rsyslog:latest image from the myrsyslog.tar:

   $ podman load -i myrsyslog.tar
   ...
   Loaded image(s): registry.redhat.io/rhel8/rsyslog:latest

Procedure

1. Optional: Add an additional name to the ubi image:

   # podman tag registry.redhat.io/ubi8/ubi registry.example.com:5000/ubi8/ubi

2. Push the registry.example.com:5000/ubi8/ubi image from your local storage to a registry:

   # podman push registry.example.com:5000/ubi8/ubi

   IMPORTANT

   While there are few restrictions on how you use these images, there are some restrictions about how you can refer to them. For example, you cannot call those images Red Hat certified or Red Hat supported unless you certify it through the Red Hat Partner Connect Program, either with Red Hat Container Certification or Red Hat OpenShift Operator Certification.

Procedure

1. Update an existing trust scope for the registry.access.redhat.com:

   # podman image trust set -f /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release registry.access.redhat.com

2. Optional. To verify the trust policy configuration, display the /etc/containers/policy.json file:

   ...
   "transports": {
     "docker": {
         "registry.access.redhat.com": [
          {
            "type": "signedBy",
            "keyType": "GPGKeys",
            "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
          }
        ]
   },
   ...

3. Update an existing trust scope for the registry.redhat.io:

   # podman image trust set -f /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release registry.redhat.io

4. Optional. To verify the trust policy configuration, display the /etc/containers/policy.json file:

   ...
   "transports": {
    "docker": {
         "registry.access.redhat.com": [
         {
           "type": "signedBy",
           "keyType": "GPGKeys",
           "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
         }
       ],
        "registry.redhat.io": [
        {
           "type": "signedBy",
           "keyType": "GPGKeys",
           "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
        }
      ]
   },
   ...

Procedure

1. List all images on your local system:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED      SIZE
   registry.redhat.io/rhel8/rsyslog     latest  4b32d14201de  7 weeks ago  228 MB
   registry.redhat.io/ubi8/ubi          latest  3269c37eae33  7 weeks ago  208 MB
   localhost/myubi                      X.Y     3269c37eae33  7 weeks ago  208 MB

2. List all containers:

   $ podman ps -a
   CONTAINER ID  IMAGE                                    COMMAND          CREATED        STATUS            PORTS   NAMES
   7ccd6001166e  registry.redhat.io/rhel8/rsyslog:latest  /bin/rsyslog.sh  6 seconds ago  Up 5 seconds ago          mysyslog

   To remove the registry.redhat.io/rhel8/rsyslog image, you have to stop all containers running from this image using the podman stop command. You can stop a container by its ID or name.

3. Stop the mysyslog container:

   $ podman stop mysyslog
   7ccd6001166e9720c47fbeb077e0afd0bb635e74a1b0ede3fd34d09eaf5a52e9

4. Remove the registry.redhat.io/rhel8/rsyslog image:

   $ podman rmi registry.redhat.io/rhel8/rsyslog

   • To remove multiple images:

     $ podman rmi registry.redhat.io/rhel8/rsyslog registry.redhat.io/ubi8/ubi

   • To remove all images from your system:

     $ podman rmi -a

   • To remove images that have multiple names (tags) associated with them, add the -f option to remove them:

     $ podman rmi -f 1de7d7b3f531
     1de7d7b3f531...

Procedure

1. Display the type of operating system of the container based on the registry.access.redhat.com/ubi8/ubi container image using the cat /etc/os-release command:

   $ podman run --rm registry.access.redhat.com/ubi8/ubi cat /etc/os-release
   NAME="Red Hat Enterprise Linux"
   VERSION="8.2 (Ootpa)"
   ID="rhel"
   ID_LIKE="fedora"
   VERSION_ID="8.2"
   PLATFORM_ID="platform:el8"
   PRETTY_NAME="Red Hat Enterprise Linux 8.2 (Ootpa)"
   ANSI_COLOR="0;31"
   CPE_NAME="cpe:/o:redhat:enterprise_linux:8.2:GA"
   HOME_URL="https://www.redhat.com/"
   BUG_REPORT_URL="https://bugzilla.redhat.com/"
   
   REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 8"
   REDHAT_BUGZILLA_PRODUCT_VERSION=8.2
   REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
   REDHAT_SUPPORT_PRODUCT_VERSION="8.2"

2. Optional: List all containers.

   $ podman ps
   CONTAINER ID  IMAGE   COMMAND  CREATED  STATUS  PORTS   NAMES

   Because of the --rm option you should not see any container. The container was removed.

Procedure

1. Run the container named myubi based on the registry.redhat.io/ubi8/ubi image:

   $ podman run --name=myubi -it registry.access.redhat.com/ubi8/ubi /bin/bash
   [root@6ccffd0f6421 /]#

   • The -i option creates an interactive session. Without the -t option, the shell stays open, but you cannot type anything to the shell.
   • The -t option opens a terminal session. Without the -i option, the shell opens and then exits.

2. Install the procps-ng package containing a set of system utilities (for example ps, top, uptime, and so on):

   [root@6ccffd0f6421 /]# yum install procps-ng

3. Use the ps -ef command to list current processes:

   # ps -ef
   UID          PID    PPID  C STIME TTY          TIME CMD
   root           1       0  0 12:55 pts/0    00:00:00 /bin/bash
   root          31       1  0 13:07 pts/0    00:00:00 ps -ef

4. Enter exit to exit the container and return to the host:

   # exit

5. Optional: List all containers:

   $ podman ps
   CONTAINER ID  IMAGE                               COMMAND    CREATED         STATUS                     PORTS   NAMES
   1984555a2c27  registry.redhat.io/ubi8/ubi:latest  /bin/bash  21 minutes ago  Exited (0) 21 minutes ago          myubi

   You can see that the container is in Exited status.

Procedure

1. Run the container based on registry.redhat.io/rhel8/rsyslog image:

   $ podman run -d registry.redhat.io/rhel8/rsyslog

2. List all containers:

   • To list all running containers:

     $ podman ps
     CONTAINER ID IMAGE              COMMAND         CREATED       STATUS            PORTS NAMES
     74b1da000a11 rhel8/rsyslog /bin/rsyslog.sh 2 minutes ago Up About a minute       musing_brown

   • To list all containers, running or stopped:

     $ podman ps -a
     CONTAINER ID IMAGE         COMMAND    CREATED    STATUS                PORTS NAMES     IS INFRA
     d65aecc325a4 ubi8/ubi      /bin/bash  3 secs ago Exited (0) 5 secs ago peaceful_hopper false
     74b1da000a11 rhel8/rsyslog rsyslog.sh 2 mins ago Up About a minute     musing_brown    false

Procedure

1. Start the myubi container:

   • In the non interactive mode:

     $ podman start myubi

     Alternatively, you can use podman start 1984555a2c27.

   • In the interactive mode, use -a (--attach) and -t (--interactive) options to work with container bash shell:

     $ podman start -a -i myubi

     Alternatively, you can use podman start -a -i 1984555a2c27.

2. Enter exit to exit the container and return to the host:

   [root@6ccffd0f6421 /]# exit

Procedure

1. Run the container named log_test and mount the host /dev/log device inside the container:

   # podman run --name="log_test" -v /dev/log:/dev/log --rm \
     registry.redhat.io/ubi8/ubi logger "Testing logging to the host"

2. Use the journalctl utility to display logs:

   # journalctl -b | grep Testing
   Dec 09 16:55:00 localhost.localdomain root[14634]: Testing logging to the host

   The --rm option removes the container when it exits.

Procedure

1. Run the container named mysyslog:

   # podman run -d --name=mysyslog registry.redhat.io/rhel8/rsyslog

2. Optional: List all containers:

   # podman ps -a
   CONTAINER ID  IMAGE                                    COMMAND          CREATED         STATUS                     PORTS   NAMES
   c56ef6a256f8  registry.redhat.io/rhel8/rsyslog:latest  /bin/rsyslog.sh  20 minutes ago  Up 20 minutes ago                  mysyslog

3. Mount the mysyslog container:

   # podman mount mysyslog
   /var/lib/containers/storage/overlay/990b5c6ddcdeed4bde7b245885ce4544c553d108310e2b797d7be46750894719/merged

4. Display the content of the mount point using ls command:

   # ls /var/lib/containers/storage/overlay/990b5c6ddcdeed4bde7b245885ce4544c553d108310e2b797d7be46750894719/merged
   bin  boot  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

5. Display the OS version:

   # cat /var/lib/containers/storage/overlay/990b5c6ddcdeed4bde7b245885ce4544c553d108310e2b797d7be46750894719/merged/etc/os-release
   NAME="Red Hat Enterprise Linux"
   VERSION="8.3 (Ootpa)"
   ID="rhel"
   ID_LIKE="fedora"
   VERSION_ID="8.3"

Procedure

1. Set the container network interface to the IP address 10.88.0.44:

   # podman run -d --ip=10.88.0.44 registry.access.redhat.com/rhel7/rsyslog
   efde5f0a8c723f70dd5cb5dc3d5039df3b962fae65575b08662e0d5b5f9fbe85

2. Check that the IP address is set properly:

   # podman inspect efde5f0a8c723 | grep 10.88.0.44
   "IPAddress": "10.88.0.44",

Procedure

1. Execute the rpm -qa command inside the myrsyslog container to list all installed packages:

   $ podman exec -it myrsyslog rpm -qa
   tzdata-2020d-1.el8.noarch
   python3-pip-wheel-9.0.3-18.el8.noarch
   redhat-release-8.3-1.0.el8.x86_64
   filesystem-3.8-3.el8.x86_64
   ...

2. Execute a /bin/bash command in the myrsyslog container:

   $ podman exec -it myrsyslog /bin/bash

3. Install the procps-ng package containing a set of system utilities (for example ps, top, uptime, and so on):

   # yum install procps-ng

4. Inspect the container:

   • To list every process on the system:

     # ps -ef
     UID          PID    PPID  C STIME TTY          TIME CMD
     root           1       0  0 10:23 ?        00:00:01 /usr/sbin/rsyslogd -n
     root           8       0  0 11:07 pts/0    00:00:00 /bin/bash
     root          47       8  0 11:13 pts/0    00:00:00 ps -ef

   • To display file system disk space usage:

     # df -h
     Filesystem      Size  Used Avail Use% Mounted on
     fuse-overlayfs   27G  7.1G   20G  27% /
     tmpfs            64M     0   64M   0% /dev
     tmpfs           269M  936K  268M   1% /etc/hosts
     shm              63M     0   63M   0% /dev/shm
     ...

   • To display system information:

     # uname -r
     4.18.0-240.10.1.el8_3.x86_64

   • To display amount of free and used memory in megabytes:

     # free --mega
     total        used        free      shared  buff/cache   available
     Mem:       2818         615        1183          12         1020        1957
     Swap:      3124           0        3124

Procedure

1. Create a volume:

   $ podman volume create hostvolume

2. Display information about the volume:

   $ podman volume inspect hostvolume
   [
       {
           "name": "hostvolume",
           "labels": {},
           "mountpoint": "/home/username/.local/share/containers/storage/volumes/hostvolume/_data",
           "driver": "local",
           "options": {},
           "scope": "local"
       }
   ]

   Notice that it creates a volume in the volumes directory. You can save the mount point path to the variable for easier manipulation: $ mntPoint=$(podman volume inspect hostvolume --format {{.Mountpoint}}).

   Notice that if you run sudo podman volume create hostvolume, then the mount point changes to /var/lib/containers/storage/volumes/hostvolume/_data.

3. Create a text file inside the directory using the path is stored in the mntPoint variable:

   $ echo "Hello from host" >> $mntPoint/host.txt

4. List all files in the directory defined by the mntPoint variable:

   $ ls $mntPoint/
   host.txt

5. Run the container named myubi1 and map the directory defined by the hostvolume volume name on the host to the /containervolume1 directory on the container:

   $ podman run -it --name myubi1 -v hostvolume:/containervolume1 registry.access.redhat.com/ubi8/ubi /bin/bash

   Note that if you use the volume path defined by the mntPoint variable (-v $mntPoint:/containervolume1), data can be lost when running podman volume prune command, which removes unused volumes. Always use -v hostvolume_name:/containervolume_name.

6. List the files in the shared volume on the container:

   # ls /containervolume1
   host.txt

   You can see the host.txt file which you created on the host.

7. Create a text file inside the /containervolume1 directory:

   # echo "Hello from container 1" >> /containervolume1/container1.txt

8. Detach from the container with CTRL+p and CTRL+q.

9. List the files in the shared volume on the host, you should see two files:

   $ ls $mntPoint
   container1.rxt  host.txt

   At this point, you are sharing files between the container and host. To share files between two containers, run another container named myubi2. Steps 10 - 13 are analogous to steps 5 - 8.

10. Run the container named myubi2 and map the directory defined by the hostvolume volume name on the host to the /containervolume2 directory on the container:

    $ podman run -it --name myubi2 -v hostvolume:/containervolume2 registry.access.redhat.com/ubi8/ubi  /bin/bash

11. List the files in the shared volume on the container:

    # ls /containervolume2
    container1.txt host.txt

    You can see the host.txt file which you created on the host and container1.txt which you created inside the myubi1 container.

12. Create a text file inside the /containervolume2 directory:

    # echo "Hello from container 2" >> /containervolume2/container2.txt

13. Detach from the container with CTRL+p and CTRL+q.

14. List the files in the shared volume on the host, you should see three files:

    $ ls $mntPoint
    container1.rxt  container2.txt host.txt

Procedure

1. Run the myubi container based on the registry.access.redhat.com/ubi8/ubi image:

   $ podman run -dt --name=myubi registry.access.redhat.com/ubi8/ubi

2. Optional: List all containers:

   $ podman ps -a
   CONTAINER ID  IMAGE                                    COMMAND          CREATED     STATUS         PORTS   NAMES
   a6a6d4896142  registry.access.redhat.com/ubi8:latest   /bin/bash        7 seconds ago  Up 7 seconds ago          myubi

3. Attach to the myubi container:

   $ podman attach myubi

4. Create a file named testfile:

   [root@a6a6d4896142 /]# echo "hello" > testfile

5. Detach from the container with CTRL+p and CTRL+q.

6. Export the file system of the myubi as a myubi-container.tar on the local machine:

   $ podman export -o myubi.tar a6a6d4896142

7. Optional: List the current directory content:

   $ ls -l
   -rw-r--r--. 1 user user 210885120 Apr  6 10:50 myubi-container.tar
   ...

8. Optional: Create a myubi-container directory, extract all files from the myubi-container.tar archive. List a content of the myubi-directory in a tree-like format:

   $ mkdir myubi-container
   $ tar -xf myubi-container.tar -C myubi-container
   $ tree -L 1 myubi-container
   ├── bin -> usr/bin
   ├── boot
   ├── dev
   ├── etc
   ├── home
   ├── lib -> usr/lib
   ├── lib64 -> usr/lib64
   ├── lost+found
   ├── media
   ├── mnt
   ├── opt
   ├── proc
   ├── root
   ├── run
   ├── sbin -> usr/sbin
   ├── srv
   ├── sys
   ├── testfile
   ├── tmp
   ├── usr
   └── var
   
   20 directories, 1 file

   You can see that the myubi-container.tar contains the container file system.

9. Import the myubi.tar and saves it as a filesystem image:

   $ podman import myubi.tar myubi-imported
   Getting image source signatures
   Copying blob 277cab30fe96 done
   Copying config c296689a17 done
   Writing manifest to image destination
   Storing signatures
   c296689a17da2f33bf9d16071911636d7ce4d63f329741db679c3f41537e7cbf

10. List all images:

    $ podman images
    REPOSITORY                              TAG     IMAGE ID      CREATED         SIZE
    docker.io/library/myubi-imported       latest  c296689a17da  51 seconds ago  211 MB

11. Display the content of the testfile file:

    $ podman run -it  --name=myubi-imported docker.io/library/myubi-imported cat testfile
    hello

Procedure

1. List all containers, running or stopped:

   $ podman ps -a
   CONTAINER ID IMAGE         COMMAND    CREATED    STATUS                PORTS NAMES     IS INFRA
   d65aecc325a4 ubi8/ubi      /bin/bash  3 secs ago Exited (0) 5 secs ago peaceful_hopper false
   74b1da000a11 rhel8/rsyslog rsyslog.sh 2 mins ago Up About a minute     musing_brown    false

2. Remove the containers:

   • To remove the peaceful_hopper container:

     $ podman rm peaceful_hopper

     Notice that the peaceful_hopper container was in Exited status, which means it was stopped and it can be removed immediately.

   • To remove the musing_brown container, first stop the container and then remove it:

     $ podman stop musing_brown
     $ podman rm musing_brown

     NOTE

     • To remove multiple containers:

       $ podman rm clever_yonath furious_shockley

     • To remove all containers from your local system:

       $ podman rm -a

Procedure

1. Pull the registry.access.redhat.com/ubi8/ubi container image:

   # podman pull registry.access.redhat.com/ubi8/ubi

2. Export the registry.access.redhat.com/ubi8/ubi image to the rhel.tar archive:

   # podman export $(podman create registry.access.redhat.com/ubi8/ubi) > rhel.tar

3. Create the bundle/rootfs directory:

   # mkdir -p bundle/rootfs

4. Extract the rhel.tar archive into the bundle/rootfs directory:

   # tar -C bundle/rootfs -xf rhel.tar

5. Create a new specification file named config.json for the bundle:

   # <runtime> spec -b bundle

   • The -b option specifies the bundle directory. The default value is the current directory.

6. Optional. Change the settings:

   # vi bundle/config.json

7. Create an instance of a container named myubi for a bundle:

   # <runtime>  create -b bundle/ myubi

8. Start a myubi container:

   # <runtime>  start myubi

Procedure

1. Install Open MPI:

   $ sudo yum install openmpi

2. To activate the environment modules, type:

   $ . /etc/profile.d/modules.sh

3. Load the mpi/openmpi-x86_64 module:

   $ module load mpi/openmpi-x86_64

   Optionally, to automatically load mpi/openmpi-x86_64 module, add this line to the .bashrc file:

   $ echo "module load mpi/openmpi-x86_64" >> .bashrc

4. To combine mpirun and podman, create a container with the following definition:

   $ cat Containerfile
   FROM registry.access.redhat.com/ubi8/ubi
   
   RUN yum -y install openmpi-devel wget && \
       yum clean all
   
   RUN wget https://raw.githubusercontent.com/open-mpi/ompi/master/test/simple/ring.c && \
       /usr/lib64/openmpi/bin/mpicc ring.c -o /home/ring && \
       rm -f ring.c

5. Build the container:

   $ podman build --tag=mpi-ring .

6. Start the container. On a system with 4 CPUs this command starts 4 containers:

   $ mpirun \
      --mca orte_tmpdir_base /tmp/podman-mpirun \
      podman run --env-host \
        -v /tmp/podman-mpirun:/tmp/podman-mpirun \
        --userns=keep-id \
        --net=host --pid=host --ipc=host \
        mpi-ring /home/ring
   Rank 2 has cleared MPI_Init
   Rank 2 has completed ring
   Rank 2 has completed MPI_Barrier
   Rank 3 has cleared MPI_Init
   Rank 3 has completed ring
   Rank 3 has completed MPI_Barrier
   Rank 1 has cleared MPI_Init
   Rank 1 has completed ring
   Rank 1 has completed MPI_Barrier
   Rank 0 has cleared MPI_Init
   Rank 0 has completed ring
   Rank 0 has completed MPI_Barrier

   As a result, mpirun starts up 4 Podman containers and each container is running one instance of the ring binary. All 4 processes are communicating over MPI with each other.

Procedure

1. Create a Python based server:

   # cat counter.py
   #!/usr/bin/python3
   
   import http.server
   
   counter = 0
   
   class handler(http.server.BaseHTTPRequestHandler):
       def do_GET(s):
           global counter
              s.send_response(200)
              s.send_header('Content-type', 'text/html')
              s.end_headers()
              s.wfile.write(b'%d\n' % counter)
              counter += 1
   
   
   server = http.server.HTTPServer(('', 8088), handler)
   server.serve_forever()

2. Create a container with the following definition:

   # cat Containerfile
   FROM registry.access.redhat.com/ubi8/ubi
   
   COPY counter.py /home/counter.py
   
   RUN useradd -ms /bin/bash counter
   
   RUN yum -y install python3 && chmod 755 /home/counter.py
   
   USER counter
   ENTRYPOINT /home/counter.py

   The container is based on the Universal Base Image (UBI 8) and uses a Python based server.

3. Build the container:

   # podman build . --tag counter

   Files counter.py and Containerfile are the input for the container build process (podman build). The built image is stored locally and tagged with the tag counter.

4. Start the container as root:

   # podman run --name criu-test --detach counter

5. To list all running containers, enter:

   # podman ps
   CONTAINER ID  IMAGE  COMMAND  CREATED   STATUS  PORTS NAMES
   e4f82fd84d48  localhost/counter:latest  5 seconds ago  Up 4 seconds ago  criu-test

6. Display IP address of the container:

   # podman inspect criu-test --format "{{.NetworkSettings.IPAddress}}"
   10.88.0.247

7. Send requests to the container:

   # curl 10.88.0.247:8080
   0
   # curl 10.88.0.247:8080
   1

8. Create a checkpoint for the container:

   # podman container checkpoint criu-test

9. Reboot the system.

10. Restore the container:

    # podman container restore --keep criu-test

11. Send requests to the container:

    # curl 10.88.0.247:8080
    2
    # curl 10.88.0.247:8080
    3
    # curl 10.88.0.247:8080
    4

    The result now does not start at 0 again, but continues at the previous value.

Procedure

1. Create a checkpoint of the container, and export the checkpoint image to a tar.gz file:

   # podman container checkpoint criu-test --export /tmp/chkpt.tar.gz

2. Restore the container from the tar.gz file:

   # podman container restore --import /tmp/chkpt.tar.gz --name counter1
   # podman container restore --import /tmp/chkpt.tar.gz --name counter2
   # podman container restore --import /tmp/chkpt.tar.gz --name counter3

   The --name (-n) option specifies a new name for containers restored from the exported checkpoint.

3. Display ID and name of each container:

   # podman ps -a --format "{{.ID}} {{.Names}}"
   a8b2e50d463c counter3
   faabc5c27362 counter2
   2ce648af11e5 counter1

4. Display IP address of each container:

   #️ podman inspect counter1 --format "{{.NetworkSettings.IPAddress}}"
   10.88.0.248
   
   #️ podman inspect counter2 --format "{{.NetworkSettings.IPAddress}}"
   10.88.0.249
   
   #️ podman inspect counter3 --format "{{.NetworkSettings.IPAddress}}"
   10.88.0.250

5. Send requests to each container:

   #️ curl 10.88.0.248:8080
   4
   #️ curl 10.88.0.249:8080
   4
   #️ curl 10.88.0.250:8080
   4

   Note, that the result is 4 in all cases, because you are working with different containers restored from the same checkpoint.

Procedure

1. Start the container as root:

   # podman run --name criu-test --detach counter

2. Display IP address of the container:

   # podman inspect criu-test --format "{{.NetworkSettings.IPAddress}}"
   10.88.0.247

3. Send requests to the container:

   # curl 10.88.0.247:8080
   0
   # curl 10.88.0.247:8080
   1

4. Create a checkpoint of the container, and export the checkpoint image to a tar.gz file:

   # podman container checkpoint criu-test --export /tmp/chkpt.tar.gz

5. Copy the checkpoint archive to the destination host:

   # scp /tmp/chkpt.tar.gz other_host:/tmp/

6. Restore the checkpoint on the destination host (other_host):

   # podman container restore --import /tmp/chkpt.tar.gz

7. Send a request to the container on the destination host (other_host):

   # curl 10.88.0.247:8080
   2

Procedure

1. Create an empty pod:

   $ podman pod create --name mypod
   223df6b390b4ea87a090a4b5207f7b9b003187a6960bd37631ae9bc12c433aff
   The pod is in the initial state Created.

   The pod is in the initial state Created.

2. Optional: List all pods:

   $ podman pod ps
   POD ID         NAME    STATUS    CREATED                  # OF CONTAINERS   INFRA ID
   223df6b390b4   mypod   Created   Less than a second ago   1                 3afdcd93de3e

   Notice that the pod has one container in it.

3. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                 COMMAND  CREATED                 STATUS   PORTS  NAMES               POD
   3afdcd93de3e  registry.access.redhat.com/ubi8/pause            Less than a second ago  Created         223df6b390b4-infra  223df6b390b4

   You can see that the pod ID from podman ps command matches the pod ID in the podman pod ps command. The default infra container is based on the registry.access.redhat.com/ubi8/pause image.

4. Run a container named myubi in the existing pod named mypod:

   $ podman run -dt --name myubi --pod mypod registry.access.redhat.com/ubi8/ubi  /bin/bash
   5df5c48fea87860cf75822ceab8370548b04c78be9fc156570949013863ccf71

5. Optional: List all pods:

   $ podman pod ps
   POD ID         NAME    STATUS    CREATED                  # OF CONTAINERS   INFRA ID
   223df6b390b4   mypod   Running   Less than a second ago   2                 3afdcd93de3e

   You can see that the pod has two containers in it.

6. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                       COMMAND    CREATED                 STATUS                     PORTS  NAMES               POD
   5df5c48fea87  registry.access.redhat.com/ubi8/ubi:latest  /bin/bash  Less than a second ago  Up Less than a second ago         myubi               223df6b390b4
   3afdcd93de3e  registry.access.redhat.com/ubi8/pause                                   Less than a second ago  Up Less than a second ago         223df6b390b4-infra  223df6b390b4

Procedure

1. Stop the pod mypod:

   $ podman pod stop mypod

2. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                               COMMAND    CREATED             STATUS                    PORTS   NAMES               POD ID        PODNAME
   5df5c48fea87  registry.redhat.io/ubi8/ubi:latest  /bin/bash  About a minute ago  Exited (0) 7 seconds ago          myubi               223df6b390b4  mypod
   
   3afdcd93de3e  registry.access.redhat.com/ubi8/pause                           About a minute ago  Exited (0) 7 seconds ago          8a4e6527ac9d-infra  223df6b390b4  mypod

   You can see that the pod mypod and container myubi are in "Exited" status.

Procedure

1. Remove the pod mypod, type:

   $ podman pod rm mypod
   223df6b390b4ea87a090a4b5207f7b9b003187a6960bd37631ae9bc12c433aff

   Note that removing the pod automatically removes all containers inside it.

2. Optional: Check that all containers and pods were removed:

   $ podman ps
   $ podman pod ps

Procedure

1. Pull and run the registry.access.redhat.com/ubi8/ubi image:

   $ podman run -it --name myubi registry.access.redhat.com/ubi8/ubi

2. Add a package to the myubi container.

   • To add a package that is in the UBI repository, disable all yum repositories except for UBI repositories. For example, to add the bzip2 package:

     # yum install --disablerepo=* --enablerepo=ubi-8-appstream --enablerepo=ubi-8-baseos bzip2

   • To add a package that is not in the UBI repository, do not disable any repositories. For example, to add the zsh package:

     # yum install zsh

   • To add a package that is in a different host repository, explicitly enable the repository you need. For example, to install the python38-devel package from the codeready-builder-for-rhel-8-x86_64-rpms repository:

     # yum install --enablerepo=codeready-builder-for-rhel-8-x86_64-rpms  python38-devel

Verification steps

1. List all enabled repositories inside the container:

   # yum repolist

2. Ensure that the required repositories are listed.

3. List all installed packages:

   # rpm -qa

4. Ensure that the required packages are listed.

   NOTE

   Installing Red Hat packages that are not inside the Red Hat UBI repositories can limit the ability to distribute the container outside of subscribed RHEL systems.

Procedure

1. Pull and run the registry.access.redhat.com/ubi8/ubi-minimal image:

   $ podman run -it --name myubimin registry.access.redhat.com/ubi8/ubi-minimal

2. Add a package to the myubimin container:

   • To add a package that is in the UBI repository, do not disable any repositories. For example, to add the bzip2 package:

     # microdnf install bzip2

   • To add a package that is in a different host repository, explicitly enable the repository you need. For example, to install the python38-devel package from the codeready-builder-for-rhel-8-x86_64-rpms repository:

     # microdnf install --enablerepo=codeready-builder-for-rhel-8-x86_64-rpms  python38-devel

Verification steps

1. List all enabled repositories inside the container:

   # microdnf repolist

2. Ensure that the required repositories are listed.

3. List all installed packages:

   # rpm -qa

4. Ensure that the required packages are listed.

   NOTE

   Installing Red Hat packages that are not inside the Red Hat UBI repositories can limit the ability to distribute the container outside of subscribed RHEL systems.

Verification steps

1. List all enabled repositories:

   • To list all enabled repositories inside the containers based on UBI standard or UBI init images:

     #  yum repolist

   • To list all enabled repositories inside the containers based on UBI minimal containers:

     # microdnf repolist

2. Ensure that the required repositories are listed.

3. List all installed packages:

   # rpm -qa

4. Ensure that the required packages are listed.

Procedure

1. Create a Containerfile:

   FROM registry.access.redhat.com/ubi8/ubi
   USER root
   LABEL maintainer="John Doe"
   # Update image
   RUN yum update --disablerepo=* --enablerepo=ubi-8-appstream --enablerepo=ubi-8-baseos -y && rm -rf /var/cache/yum
   RUN yum install --disablerepo=* --enablerepo=ubi-8-appstream --enablerepo=ubi-8-baseos httpd -y && rm -rf /var/cache/yum
   # Add default Web page and expose port
   RUN echo "The Web Server is Running" > /var/www/html/index.html
   EXPOSE 80
   # Start the service
   CMD ["-D", "FOREGROUND"]
   ENTRYPOINT ["/usr/sbin/httpd"]

2. Build the container image:

   # buildah bud -t johndoe/webserver .
   STEP 1: FROM registry.access.redhat.com/ubi8/ubi:latest
   STEP 2: USER root
   STEP 3: LABEL maintainer="John Doe"
   STEP 4: RUN yum update --disablerepo=* --enablerepo=ubi-8-appstream --enablerepo=ubi-8-baseos -y
   ...
   Writing manifest to image destination
   Storing signatures
   --> f9874f27050
   f9874f270500c255b950e751e53d37c6f8f6dba13425d42f30c2a8ef26b769f2

Verification steps

1. Run the web server:

   # podman run -d --name=myweb -p 80:80 johndoe/webserver
   bbe98c71d18720d966e4567949888dc4fb86eec7d304e785d5177168a5965f64

2. Test the web server:

   # curl http://localhost/index.html
   The Web Server is Running

Procedure

1. Use the skopeo copy command to copy the source container image to a local directory:

   $ skopeo copy \
   docker://registry.access.redhat.com/ubi8:8.1-397-source \
   dir:$HOME/TEST
   ...
   Copying blob 477bc8106765 done
   Copying blob c438818481d3 done
   ...
   Writing manifest to image destination
   Storing signatures

2. Use the skopeo inspect command to inspect the source container image:

   $ skopeo inspect dir:$HOME/TEST
   {
       "Digest": "sha256:7ab721ef3305271bbb629a6db065c59bbeb87bc53e7cbf88e2953a1217ba7322",
       "RepoTags": [],
       "Created": "2020-02-11T12:14:18.612461174Z",
       "DockerVersion": "",
       "Labels": null,
       "Architecture": "amd64",
       "Os": "linux",
       "Layers": [
           "sha256:1ae73d938ab9f11718d0f6a4148eb07d38ac1c0a70b1d03e751de8bf3c2c87fa",
           "sha256:9fe966885cb8712c47efe5ecc2eaa0797a0d5ffb8b119c4bd4b400cc9e255421",
           "sha256:61b2527a4b836a4efbb82dfd449c0556c0f769570a6c02e112f88f8bbcd90166",
           ...
           "sha256:cc56c782b513e2bdd2cc2af77b69e13df4ab624ddb856c4d086206b46b9b9e5f",
           "sha256:dcf9396fdada4e6c1ce667b306b7f08a83c9e6b39d0955c481b8ea5b2a465b32",
           "sha256:feb6d2ae252402ea6a6fca8a158a7d32c7e4572db0e6e5a5eab15d4e0777951e"
       ],
       "Env": null
   }

3. Unpack all the content:

   $ cd $HOME/TEST
   $ for f in $(ls); do tar xvf $f; done

4. Check the results:

   $ find blobs/ rpm_dir/
   blobs/
   blobs/sha256
   blobs/sha256/10914f1fff060ce31388f5ab963871870535aaaa551629f5ad182384d60fdf82
   rpm_dir/
   rpm_dir/gzip-1.9-4.el8.src.rpm

   If the results are correct, the image is ready to be used.

   NOTE

   It could take several hours after a container image is released for its associated source container to become available.

Procedure

1. Log in to the registry.redhat.io registry:

   $ podman login registry.redhat.io
   Username: myuser@mycompany.com
   Password: ***********
   Login Succeeded!

2. Get the registry.redhat.io/rhel8/skopeo container image:

   $ podman pull registry.redhat.io/rhel8/skopeo

3. Inspect a remote container image registry.access.redhat.com/ubi8/ubi using Skopeo:

   $ podman run --rm registry.redhat.io/rhel8/skopeo skopeo inspect docker://registry.access.redhat.com/ubi8/ubi
   {
       "Name": "registry.access.redhat.com/ubi8/ubi",
       ...
       "Labels": {
           "architecture": "x86_64",
           ...
           "name": "ubi8",
           ...
           "summary": "Provides the latest release of Red Hat Universal Base Image 8.",
           "url": "https://access.redhat.com/containers/#/registry.access.redhat.com/ubi8/images/8.2-347",
           ...
       },
       "Architecture": "amd64",
       "Os": "linux",
       "Layers": [
       ...
       ],
       "Env": [
           "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
           "container=oci"
       ]
   }

   The --rm option removes the registry.redhat.io/rhel8/skopeo image after the container exits.

Procedure

1. Copy the registry.access.redhat.com/ubi8/ubi image into your local container storage:

   $ podman run --privileged --rm -v $HOME/.local/share/containers/storage:/var/lib/containers/storage registry.redhat.io/rhel8/skopeo skopeo copy docker://registry.access.redhat.com/ubi8/ubi containers-storage:registry.access.redhat.com/ubi8/ubi

   • The --privileged option disables all security mechanisms. Red Hat recommends only using this option in trusted environments.

   • To avoid disabling security mechanisms, export the images to a tarball or any other path-based image transport and mount them in the Skopeo container:

     • $ podman save --format oci-archive -o oci.tar $IMAGE
     • $ podman run --rm -v oci.tar:/oci.tar registry.redhat.io/rhel8/skopeo copy oci-archive:/oci.tar $DESTINATION

2. Optional: List images in local storage:

   $ podman images
   REPOSITORY                               TAG     IMAGE ID      CREATED       SIZE
   registry.access.redhat.com/ubi8/ubi      latest  ecbc6f53bba0  8 weeks ago   211 MB

Procedure

1. Log in to the registry.redhat.io registry:

   $ podman login registry.redhat.io
   Username: myuser@mycompany.com
   Password: ***********
   Login Succeeded!

2. Pull and run the registry.redhat.io/rhel8/buildah image:

   # podman run --rm --device /dev/fuse -it registry.redhat.io/rhel8/buildah  /bin/bash

   • The --rm option removes the registry.redhat.io/rhel8/buildah image after the container exits.
   • The --device option adds a host device to the container.

3. Create a new container using a registry.access.redhat.com/ubi8 image:

   # buildah from registry.access.redhat.com/ubi8
   ...
   ubi8-working-container

4. Run the ls / command inside the ubi8-working-container container:

   # buildah run  --isolation=chroot ubi8-working-container ls /
   bin  boot  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv

5. Optional: List all images in a local storage:

   # buildah images
   REPOSITORY                        TAG      IMAGE ID       CREATED       SIZE
   registry.access.redhat.com/ubi8   latest   ecbc6f53bba0   5 weeks ago   211 MB

6. Optional: List the working containers and their base images:

   # buildah containers
   CONTAINER ID  BUILDER  IMAGE ID     IMAGE NAME                       CONTAINER NAME
   0aaba7192762     *     ecbc6f53bba0 registry.access.redhat.com/ub... ubi8-working-container

7. Optional: Push the registry.access.redhat.com/ubi8 image to the a local registry located on registry.example.com:

   # buildah push ecbc6f53bba0 registry.example.com:5000/ubi8/ubi

Procedure

1. Run the container based on registry.redhat.io/rhel8/podman image:

   # podman run --privileged --name podman_container -it registry.redhat.io/rhel8/podman /bin/bash

   • Run the outer container named podman_container based on the registry.redhat.io/rhel8/podman image.
   • The --it option specifies that you want to run an interactive bash shell within a container.
   • The --privileged option disables the security features that isolate the container from the host.

2. Create a Containerfile inside the podman_container container:

   # vi Containerfile
   FROM registry.access.redhat.com/ubi8/ubi
   RUN yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
   RUN yum -y install moon-buggy && yum clean all
   CMD ["/usr/bin/moon-buggy"]

   The commands in the Containerfile cause the following build command to:

   • Build a container from the registry.access.redhat.com/ubi8/ubi image.
   • Install the epel-release-latest-8.noarch.rpm package.
   • Install the moon-buggy package.
   • Set the container command.

3. Build a new container image named moon-buggy using the Containerfile:

   # podman build -t moon-buggy .

4. Optional: List all images:

   # podman images
   REPOSITORY                  TAG      IMAGE ID      CREATED        SIZE
   localhost/moon-buggy  latest  c97c58abb564  13 seconds ago  1.67 GB
   registry.access.redhat.com/ubi8/ubi latest 4199acc83c6a  132seconds ago 213 MB

5. Run a new container based on a moon-buggy container:

   # podman run -it --name moon moon-buggy

6. Optional: Tag the moon-buggy image:

   # podman tag moon-buggy registry.example.com/moon-buggy

7. Optional: Push the moon-buggy image to the registry:

   # podman push registry.example.com/moon-buggy

Procedure

1. Pull the rsyslog image:

   # podman pull registry.redhat.io/rhel8/rsyslog

2. Display the install runlabel for rsyslog:

   # podman container runlabel install --display rhel8/rsyslog
   command: podman run --rm --privileged -v /:/host -e HOST=/host -e IMAGE=registry.redhat.io/rhel8/rsyslog:latest -e NAME=rsyslog registry.redhat.io/rhel8/rsyslog:latest /bin/install.sh

   This shows that the command will open privileges to the host, mount the host root filesystem on /host in the container, and run an install.sh script.

3. Run the install runlabel for rsyslog:

   # podman container runlabel install rhel8/rsyslog
   command: podman run --rm --privileged -v /:/host -e HOST=/host -e IMAGE=registry.redhat.io/rhel8/rsyslog:latest -e NAME=rsyslog registry.redhat.io/rhel8/rsyslog:latest /bin/install.sh
   Creating directory at /host//etc/pki/rsyslog
   Creating directory at /host//etc/rsyslog.d
   Installing file at /host//etc/rsyslog.conf
   Installing file at /host//etc/sysconfig/rsyslog
   Installing file at /host//etc/logrotate.d/syslog

   This creates files on the host system that the rsyslog image will use later.

4. Display the run runlabel for rsyslog:

   # podman container runlabel run --display rhel8/rsyslog
   command: podman run -d --privileged --name rsyslog --net=host --pid=host -v /etc/pki/rsyslog:/etc/pki/rsyslog -v /etc/rsyslog.conf:/etc/rsyslog.conf -v /etc/sysconfig/rsyslog:/etc/sysconfig/rsyslog -v /etc/rsyslog.d:/etc/rsyslog.d -v /var/log:/var/log -v /var/lib/rsyslog:/var/lib/rsyslog -v /run:/run -v /etc/machine-id:/etc/machine-id -v /etc/localtime:/etc/localtime -e IMAGE=registry.redhat.io/rhel8/rsyslog:latest -e NAME=rsyslog --restart=always registry.redhat.io/rhel8/rsyslog:latest /bin/rsyslog.sh

   This shows that the command opens privileges to the host and mount specific files and directories from the host inside the container, when it launches the rsyslog container to run the rsyslogd daemon.

5. Execute the run runlabel for rsyslog:

   # podman container runlabel run rhel8/rsyslog
   command: podman run -d --privileged --name rsyslog --net=host --pid=host -v /etc/pki/rsyslog:/etc/pki/rsyslog -v /etc/rsyslog.conf:/etc/rsyslog.conf -v /etc/sysconfig/rsyslog:/etc/sysconfig/rsyslog -v /etc/rsyslog.d:/etc/rsyslog.d -v /var/log:/var/log -v /var/lib/rsyslog:/var/lib/rsyslog -v /run:/run -v /etc/machine-id:/etc/machine-id -v /etc/localtime:/etc/localtime -e IMAGE=registry.redhat.io/rhel8/rsyslog:latest -e NAME=rsyslog --restart=always registry.redhat.io/rhel8/rsyslog:latest /bin/rsyslog.sh
   28a0d719ff179adcea81eb63cc90fcd09f1755d5edb121399068a4ea59bd0f53

   The rsyslog container opens privileges, mounts what it needs from the host, and runs the rsyslogd daemon in the background (-d). The rsyslogd daemon begins gathering log messages and directing messages to files in the /var/log directory.

6. Display the uninstall runlabel for rsyslog:

   # podman container runlabel uninstall --display rhel8/rsyslog
   command: podman run --rm --privileged -v /:/host -e HOST=/host -e IMAGE=registry.redhat.io/rhel8/rsyslog:latest -e NAME=rsyslog registry.redhat.io/rhel8/rsyslog:latest /bin/uninstall.sh

7. Run the uninstall runlabel for rsyslog:

   # podman container runlabel uninstall rhel8/rsyslog
   command: podman run --rm --privileged -v /:/host -e HOST=/host -e IMAGE=registry.redhat.io/rhel8/rsyslog:latest -e NAME=rsyslog registry.redhat.io/rhel8/rsyslog:latest /bin/uninstall.sh

Procedure

1. List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                       COMMAND    CREATED                 STATUS                     PORTS  NAMES               POD
   5df5c48fea87  registry.access.redhat.com/ubi8/ubi:latest  /bin/bash  Less than a second ago  Up Less than a second ago         myubi               223df6b390b4
   3afdcd93de3e  k8s.gcr.io/pause:3.1                                   Less than a second ago  Up Less than a second ago         223df6b390b4-infra  223df6b390b4

2. Use the pod name or ID to generate the Kubernetes YAML file:

   $ podman generate kube mypod > mypod.yaml

   Note that the podman generate command does not reflect any Logical Volume Manager (LVM) logical volumes or physical volumes that might be attached to the container.

3. Display the mypod.yaml file:

   $ cat mypod.yaml
   # Generation of Kubernetes YAML is still under development!
   #
   # Save the output of this file and use kubectl create -f to import
   # it into Kubernetes.
   #
   # Created with podman-1.6.4
   apiVersion: v1
   kind: Pod
   metadata:
     creationTimestamp: "2020-06-09T10:31:56Z"
     labels:
   app: mypod
     name: mypod
   spec:
     containers:
     - command:
           - /bin/bash
           env:
           - name: PATH
                 value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
           - name: TERM
                 value: xterm
           - name: HOSTNAME
           - name: container
                 value: oci
           image: registry.access.redhat.com/ubi8/ubi:latest
           name: myubi
           resources: {}
           securityContext:
                 allowPrivilegeEscalation: true
                 capabilities: {}
                 privileged: false
                 readOnlyRootFilesystem: false
           tty: true
           workingDir: /
   status: {}

Procedure

1. Create the pod and the container from the mypod.yaml file:

   $ podman play kube mypod.yaml
   Pod:
   b8c5b99ba846ccff76c3ef257e5761c2d8a5ca4d7ffa3880531aec79c0dacb22
   Container:
   848179395ebd33dd91d14ffbde7ae273158d9695a081468f487af4e356888ece

2. List all pods:

   $ podman pod ps
   POD ID         NAME    STATUS    CREATED          # OF CONTAINERS   INFRA ID
   b8c5b99ba846   mypod   Running   19 seconds ago   2                 aa4220eaf4bb

3. List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                       COMMAND    CREATED             STATUS                 PORTS  NAMES               POD
   848179395ebd  registry.access.redhat.com/ubi8/ubi:latest  /bin/bash  About a minute ago  Up About a minute ago         myubi               b8c5b99ba846
   aa4220eaf4bb  k8s.gcr.io/pause:3.1                                   About a minute ago  Up About a minute ago         b8c5b99ba846-infra  b8c5b99ba846

   The pod IDs from podman ps command matches the pod ID from the podman pod ps command.

Procedure

1. Create a container (for example myubi):

   $ podman create --name myubi registry.access.redhat.com/ubi8:latest sleep infinity
   0280afe98bb75a5c5e713b28de4b7c5cb49f156f1cce4a208f13fee2f75cb453

2. Use the container name or ID to generate the systemd unit file and direct it into the ~/.config/systemd/user/container-myubi.service file:

   $ podman generate systemd --name myubi > ~/.config/systemd/user/container-myubi.service

Procedure

1. Pull the image you want to use on your system. For example, to pull the httpd-24 image:

   # podman pull registry.access.redhat.com/ubi8/httpd-24

2. Optional. List all images available on your system:

   # podman images
   REPOSITORY                                TAG                  IMAGE ID      CREATED        SIZE
   registry.access.redhat.com/ubi8/httpd-24  latest               8594be0a0b57  2 weeks ago    462 MB

3. Create the httpd container:

   # podman create --name httpd -p 8080:8080 registry.access.redhat.com/ubi8/httpd-24
   cdb9f981cf143021b1679599d860026b13a77187f75e46cc0eac85293710a4b1

4. Optional. Verify the container has been created:

   # podman ps -a
   CONTAINER ID  IMAGE                                            COMMAND               CREATED        STATUS      PORTS                   NAMES
   cdb9f981cf14  registry.access.redhat.com/ubi8/httpd-24:latest  /usr/bin/run-http...  5 minutes ago  Created     0.0.0.0:8080->8080/tcp  httpd

5. Generate a systemd unit file for the httpd container:

   # podman generate systemd --new --files --name httpd
   /root/container-httpd.service

6. Display the content of the generated container-httpd.service systemd unit file:

   # cat /root/container-httpd.service
   # container-httpd.service
   # autogenerated by Podman 3.3.1
   # Wed Sep  8 20:41:44 CEST 2021
   
   [Unit]
   Description=Podman container-httpd.service
   Documentation=man:podman-generate-systemd(1)
   Wants=network-online.target
   After=network-online.target
   RequiresMountsFor=%t/containers
   
   [Service]
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Restart=on-failure
   TimeoutStopSec=70
   ExecStartPre=/bin/rm -f %t/%n.ctr-id
   ExecStart=/usr/bin/podman run --cidfile=%t/%n.ctr-id --sdnotify=conmon --cgroups=no-conmon --rm -d --replace --name httpd -p 8080:8080 registry.access.redhat.com/ubi8/httpd-24
   ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
   ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
   Type=notify
   NotifyAccess=all
   
   [Install]
   WantedBy=multi-user.target default.target

   NOTE

   Unit files generated using the --new option do not expect containers and pods to exist. Therefore, they perform the podman run command when starting the service (see the ExecStart line) instead of the podman start command. For example, see Section Generating a systemd unit file using Podman.

   • The podman run command uses the following command-line options:

     • The --conmon-pidfile option points to a path to store the process ID for the conmon process running on the host. The conmon process terminates with the same exit status as the container, which allows systemd to report the correct service status and restart the container if needed.
     • The --cidfile option points to the path that stores the container ID.
     • The %t is the path to the run time directory root, for example /run/user/$UserID.
     • The %n is the full name of the service.

7. Copy unit files to /usr/lib/systemd/system for installing them as a root user:

   # cp -Z container-httpd.service  /etc/systemd/system

8. Enable and start the container-httpd.service:

   # systemctl daemon-reload
   # systemctl enable --now container-httpd.service
   Created symlink /etc/systemd/system/multi-user.target.wants/container-httpd.service → /etc/systemd/system/container-httpd.service.
   Created symlink /etc/systemd/system/default.target.wants/container-httpd.service → /etc/systemd/system/container-httpd.service.

Procedure

1. Reload systemd manager configuration:

   # systemctl --user daemon-reload

2. Enable the service container.service and start it at boot time:

   # systemctl --user enable container.service

3. Start the service immediately:

   # systemctl --user start container.service

4. Check the status of the service:

   $ systemctl --user status container.service
   ● container.service - Podman container.service
      Loaded: loaded (/home/user/.config/systemd/user/container.service; enabled; vendor preset: enabled)
      Active: active (running) since Wed 2020-09-16 11:56:57 CEST; 8s ago
        Docs: man:podman-generate-systemd(1)
     Process: 80602 ExecStart=/usr/bin/podman run --conmon-pidfile //run/user/1000/container.service-pid --cidfile //run/user/1000/container.service-cid -d ubi8-minimal:>
     Process: 80601 ExecStartPre=/usr/bin/rm -f //run/user/1000/container.service-pid //run/user/1000/container.service-cid (code=exited, status=0/SUCCESS)
    Main PID: 80617 (conmon)
      CGroup: /user.slice/user-1000.slice/user@1000.service/container.service
              ├─ 2870 /usr/bin/podman
              ├─80612 /usr/bin/slirp4netns --disable-host-loopback --mtu 65520 --enable-sandbox --enable-seccomp -c -e 3 -r 4 --netns-type=path /run/user/1000/netns/cni->
              ├─80614 /usr/bin/fuse-overlayfs -o lowerdir=/home/user/.local/share/containers/storage/overlay/l/YJSPGXM2OCDZPLMLXJOW3NRF6Q:/home/user/.local/share/contain>
              ├─80617 /usr/bin/conmon --api-version 1 -c cbc75d6031508dfd3d78a74a03e4ace1732b51223e72a2ce4aa3bfe10a78e4fa -u cbc75d6031508dfd3d78a74a03e4ace1732b51223e72>
              └─cbc75d6031508dfd3d78a74a03e4ace1732b51223e72a2ce4aa3bfe10a78e4fa
                └─80626 /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 1d

   You can check if the service is enabled using the systemctl is-enabled container.service command.

Procedure

1. Create an empty pod, for example named systemd-pod:

   $ podman pod create --name systemd-pod
   11d4646ba41b1fffa51c108cbdf97cfab3213f7bd9b3e1ca52fe81b90fed5577

2. Optional. List all pods:

   $ podman pod ps
   POD ID        NAME         STATUS   CREATED         # OF CONTAINERS  INFRA ID
   11d4646ba41b  systemd-pod  Created  40 seconds ago  1                8a428b257111
   11d4646ba41b1fffa51c108cbdf97cfab3213f7bd9b3e1ca52fe81b90fed5577

3. Create two containers in the empty pod. For example, to create container0 and container1 in systemd-pod:

   $ podman create --pod systemd-pod --name container0 registry.access.redhat.com/ubi8 top
   $ podman create --pod systemd-pod --name container1 registry.access.redhat.com/ubi8 top

4. Optional. List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                   COMMAND  CREATED        STATUS         PORTS   NAMES               POD ID        PODNAME
   24666f47d9b2  registry.access.redhat.com/ubi8:latest  top      3 minutes ago  Created                container0          3130f724e229  systemd-pod
   56eb1bf0cdfe  k8s.gcr.io/pause:3.2                             4 minutes ago  Created                3130f724e229-infra  3130f724e229  systemd-pod
   62118d170e43  registry.access.redhat.com/ubi8:latest  top      3 seconds ago  Created                container1          3130f724e229  systemd-pod

5. Generate the systemd unit file for the new pod:

   $ podman generate systemd --files --name systemd-pod
   /home/user1/pod-systemd-pod.service
   /home/user1/container-container0.service
   /home/user1/container-container1.service

   Note that three systemd unit files are generated, one for the systemd-pod pod and two for the containers container0 and container1.

6. Display pod-systemd-pod.service unit file:

   $ cat pod-systemd-pod.service
   # pod-systemd-pod.service
   # autogenerated by Podman 3.3.1
   # Wed Sep  8 20:49:17 CEST 2021
   
   [Unit]
   Description=Podman pod-systemd-pod.service
   Documentation=man:podman-generate-systemd(1)
   Wants=network-online.target
   After=network-online.target
   RequiresMountsFor=
   Requires=container-container0.service container-container1.service
   Before=container-container0.service container-container1.service
   
   [Service]
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Restart=on-failure
   TimeoutStopSec=70
   ExecStart=/usr/bin/podman start bcb128965b8e-infra
   ExecStop=/usr/bin/podman stop -t 10 bcb128965b8e-infra
   ExecStopPost=/usr/bin/podman stop -t 10 bcb128965b8e-infra
   PIDFile=/run/user/1000/containers/overlay-containers/1dfdcf20e35043939ea3f80f002c65c00d560e47223685dbc3230e26fe001b29/userdata/conmon.pid
   Type=forking
   
   [Install]
   WantedBy=multi-user.target default.target

   • The Requires line in the [Unit] section defines dependencies on container-container0.service and container-container1.service unit files. Both unit files will be activated.
   • The ExecStart and ExecStop lines in the [Service] section start and stop the infra-container, respectively.

7. Display container-container0.service unit file:

   $ cat container-container0.service
   # container-container0.service
   # autogenerated by Podman 3.3.1
   # Wed Sep  8 20:49:17 CEST 2021
   
   [Unit]
   Description=Podman container-container0.service
   Documentation=man:podman-generate-systemd(1)
   Wants=network-online.target
   After=network-online.target
   RequiresMountsFor=/run/user/1000/containers
   BindsTo=pod-systemd-pod.service
   After=pod-systemd-pod.service
   
   [Service]
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Restart=on-failure
   TimeoutStopSec=70
   ExecStart=/usr/bin/podman start container0
   ExecStop=/usr/bin/podman stop -t 10 container0
   ExecStopPost=/usr/bin/podman stop -t 10 container0
   PIDFile=/run/user/1000/containers/overlay-containers/4bccd7c8616ae5909b05317df4066fa90a64a067375af5996fdef9152f6d51f5/userdata/conmon.pid
   Type=forking
   
   [Install]
   WantedBy=multi-user.target default.target

   • The BindsTo line line in the [Unit] section defines the dependency on the pod-systemd-pod.service unit file
   • The ExecStart and ExecStop lines in the [Service] section start and stop the container0 respectively.

8. Display container-container1.service unit file:

   $ cat container-container1.service

9. Copy all the generated files to $HOME/.config/systemd/user for installing as a non-root user:

   $ cp pod-systemd-pod.service container-container0.service container-container1.service $HOME/.config/systemd/user

10. Enable the service and start at user login:

    $ systemctl enable --user pod-systemd-pod.service
    Created symlink /home/user1/.config/systemd/user/multi-user.target.wants/pod-systemd-pod.service → /home/user1/.config/systemd/user/pod-systemd-pod.service.
    Created symlink /home/user1/.config/systemd/user/default.target.wants/pod-systemd-pod.service → /home/user1/.config/systemd/user/pod-systemd-pod.service.

    Note that the service stops at user logout.

Procedure

1. Start a myubi container based on the registry.access.redhat.com/ubi8/ubi-init image:

   # podman run --label "io.containers.autoupdate=image" \
   --name myubi  -dt registry.access.redhat.com/ubi8/ubi-init top
   bc219740a210455fa27deacc96d50a9e20516492f1417507c13ce1533dbdcd9d

2. Optional: List containers that are running or have exited:

   # podman ps -a
   CONTAINER ID  IMAGE                                            COMMAND  CREATED         STATUS             PORTS   NAMES
   76465a5e2933  registry.access.redhat.com/ubi8/ubi-init:latest  top      24 seconds ago  Up 23 seconds ago          myubi

3. Generate a systemd unit file for the myubi container:

   # podman generate systemd --new --files --name myubi
   /root/container-myubi.service

4. Copy unit files to /usr/lib/systemd/system for installing it as a root user:

   # cp -Z ~/container-myubi.service /usr/lib/systemd/system

5. Reload systemd manager configuration:

   # systemctl daemon-reload

6. Start and check the status of a container:

   # systemctl start container-myubi.service
   # systemctl status container-myubi.service

7. Auto-update the container:

   # podman auto-update

Procedure

1. Display the podman-auto-update.service unit file:

   # cat /usr/lib/systemd/system/podman-auto-update.service
   
   [Unit]
   Description=Podman auto-update service
   Documentation=man:podman-auto-update(1)
   Wants=network.target
   After=network-online.target
   
   [Service]
   Type=oneshot
   ExecStart=/usr/bin/podman auto-update
   
   [Install]
   WantedBy=multi-user.target default.target

2. Display the podman-auto-update.timer unit file:

   # cat /usr/lib/systemd/system/podman-auto-update.timer
   
   [Unit]
   Description=Podman auto-update timer
   
   [Timer]
   OnCalendar=daily
   Persistent=true
   
   [Install]
   WantedBy=timers.target

   In this example, the podman auto-update command is launched daily at midnight.

3. Enable the podman-auto-update.timer service at system start:

   # systemctl enable podman-auto-update.timer

4. Start the systemd service:

   # systemctl start podman-auto-update.timer

5. Optional: List all timers:

   # systemctl list-timers --all
   NEXT                         LEFT      LAST                         PASSED       UNIT                         ACTIVATES
   Wed 2020-12-09 00:00:00 CET  9h left   n/a                          n/a          podman-auto-update.timer     podman-auto-update.service

   You can see that podman-auto-update.timer activates the podman-auto-update.service.

Verification

1. List all images in local storage:

   # buildah images
   REPOSITORY                                  TAG      IMAGE ID       CREATED       SIZE
   registry.access.redhat.com/ubi8/ubi         latest   272209ff0ae5   2 weeks ago   234 MB

2. List the working containers and their base images:

   # buildah containers
   CONTAINER ID  BUILDER  IMAGE ID     IMAGE NAME                       CONTAINER NAME
   01eab9588ae1     *     272209ff0ae5 registry.access.redhat.com/ub... ubi-working-container

Procedure

1. Create a Containerfile:

   # cat Containerfile
   FROM registry.access.redhat.com/ubi8/ubi
   ADD myecho /usr/local/bin
   ENTRYPOINT "/usr/local/bin/myecho"

2. Create a myecho script:

   # cat myecho
   echo "This container works!"

3. Change the access permissions of myecho script:

   # chmod 755 myecho

4. Build the myecho image using Containerfile in the current directory:

   # buildah bud -t myecho .
   STEP 1: FROM registry.access.redhat.com/ubi8/ubi
   STEP 2: ADD myecho /usr/local/bin
   STEP 3: ENTRYPOINT "/usr/local/bin/myecho"
   STEP 4: COMMIT myecho
   ...
   Storing signatures

Verification

1. List all images:

   # buildah images
   REPOSITORY                                  TAG      IMAGE ID       CREATED              SIZE
   localhost/myecho                            latest   b28cd00741b3   About a minute ago   234 MB

2. Run the myecho container based on the localhost/myecho image:

   # podman run --name=myecho localhost/myecho
   This container works!

3. List all containers:

   # podman ps -a
   0d97517428d  localhost/myecho                                     12 seconds ago  Exited (0) 13 seconds ago          myecho

Procedure

1. Create a working container based on the registry.access.redhat.com/ubi8/ubi image and save the name of the container to the mycontainer variable:

   # mycontainer=$(buildah from localhost/myecho)
   
   # echo $mycontainer
   myecho-working-container

2. Mount the myecho-working-container container and save the mount point path to the mymount variable:

   # mymount=$(buildah mount $mycontainer)
   
   # echo $mymount
   /var/lib/containers/storage/overlay/c1709df40031dda7c49e93575d9c8eebcaa5d8129033a58e5b6a95019684cc25/merged

3. Modify the myecho script and make it executable:

   # echo 'echo "We modified this container."' >> $mymount/usr/local/bin/myecho
   # chmod +x $mymount/usr/local/bin/myecho

4. Create the myecho2 image from the myecho-working-container container:

   # buildah commit $mycontainer containers-storage:myecho2

Verification

1. List all images in local storage:

   # buildah images
   REPOSITORY                                  TAG      IMAGE ID       CREATED          SIZE
   docker.io/library/myecho2                   latest   4547d2c3e436   4 minutes ago    234 MB
   localhost/myecho                            latest   b28cd00741b3   56 minutes ago   234 MB

2. Run the myecho2 container based on the docker.io/library/myecho2 image:

   # podman run --name=myecho2 docker.io/library/myecho2
   This container works!
   We even modified it.

Procedure

1. Create a script named newecho and make it executable:

   # cat newecho
   echo "I changed this container"
   # chmod 755 newecho

2. Create a new working container:

   # buildah from myecho:latest
   myecho-working-container-2

3. Copy the newecho script to /usr/local/bin directory inside the container:

   # buildah copy myecho-working-container-2 newecho /usr/local/bin

4. Change the configuration to use the newecho script as the new entrypoint:

   # buildah config --entrypoint "/bin/sh -c /usr/local/bin/newecho" myecho-working-container-2

5. Optional. Run the myecho-working-container-2 container whixh triggers the newecho script to be executed:

   # buildah run myecho-working-container-2 -- sh -c '/usr/local/bin/newecho'
   I changed this container

6. Commit the myecho-working-container-2 container to a new image called mynewecho:

   # buildah commit myecho-working-container-2 containers-storage:mynewecho

1. Create an empty container:

   # buildah from scratch
   working-container

2. Mount the working-container container and save the mount point path to the scratchmnt variable:

   # scratchmnt=$(buildah mount working-container)
   
   
   # echo $scratchmnt
   /var/lib/containers/storage/overlay/be2eaecf9f74b6acfe4d0017dd5534fde06b2fa8de9ed875691f6ccc791c1836/merged

3. Initialize an RPM database within the scratch image and add the redhat-release package:

   # yum install -y --releasever=8 --installroot=$scratchmnt redhat-release

4. Install the httpd service to the scratch directory:

   # yum install -y --setopt=reposdir=/etc/yum.repos.d \
         --installroot=$scratchmnt \
         --setopt=cachedir=/var/cache/dnf httpd

5. Create the $scratchmnt/var/www/html/index.html file:

   # mkdir -p $scratchmnt/var/www/html
   # echo "Your httpd container from scratch works!" > $scratchmnt/var/www/html/index.html

6. Configure working-container to run the httpd daemon directly from the container:

   # buildah config --cmd "/usr/sbin/httpd -DFOREGROUND" working-container
   # buildah config --port 80/tcp working-container
   # buildah commit working-container localhost/myhttpd:latest

Verification

1. List all images in local storage:

   # podman images
   REPOSITORY                                 TAG     IMAGE ID      CREATED         SIZE
   localhost/myhttpd                          latest  08da72792f60  2 minutes ago   121 MB

2. Run the localhost/myhttpd image and and configure port mappings between the container and the host system:

   # podman run -p 8080:80 -d --name myhttpd 08da72792f60

3. Test the web server:

   # curl localhost:8080
   Your httpd container from scratch works!

Procedure

1. Create the local registry on your machine:

   # podman run -d -p 5000:5000 registry:2

2. Push the myecho:latest image to the localhost registry:

   #  buildah push --tls-verify=false myecho:latest localhost:5000/myecho:latest
   Getting image source signatures
   Copying blob sha256:e4efd0...
   ...
   Writing manifest to image destination
   Storing signatures

Verification

1. List all images in the localhost repository:

   # curl http://localhost:5000/v2/_catalog
   {"repositories":["myecho2]}
   
   
   # curl http://localhost:5000/v2/myecho2/tags/list
   {"name":"myecho","tags":["latest"]}

2. Inspect the docker://localhost:5000/myecho:latest image:

   # skopeo inspect --tls-verify=false docker://localhost:5000/myecho:latest | less
   {
       "Name": "localhost:5000/myecho",
       "Digest": "sha256:8999ff6050...",
       "RepoTags": [
           "latest"
       ],
       "Created": "2021-06-28T14:44:05.919583964Z",
       "DockerVersion": "",
       "Labels": {
           "architecture": "x86_64",
           "authoritative-source-url": "registry.redhat.io",
       ...
   }

3. Pull the localhost:5000/myecho image:

   # podman pull --tls-verify=false localhost:5000/myecho2
   # podman run localhost:5000/myecho2
   This container works!

Procedure

1. Push the docker.io/library/myecho:latest to your Docker Hub. Replace username and password with your Docker Hub credentials:

   # buildah push --creds username:password \
             docker.io/library/myecho:latest docker://testaccountXX/myecho:latest

Procedure

1. List all images on your local system:

   # buildah images
   REPOSITORY                                  TAG      IMAGE ID       CREATED          SIZE
   localhost/johndoe/webserver                 latest   dc5fcc610313   46 minutes ago   263 MB
   docker.io/library/mynewecho                 latest   fa2091a7d8b6   17 hours ago     234 MB
   docker.io/library/myecho2                   latest   4547d2c3e436   6 days ago       234 MB
   localhost/myecho                            latest   b28cd00741b3   6 days ago       234 MB
   localhost/ubi-micro-httpd                   latest   c6a7678c4139   12 days ago      152 MB
   registry.access.redhat.com/ubi8/ubi         latest   272209ff0ae5   3 weeks ago      234 MB

2. Remove the localhost/myecho image:

   # buildah rmi localhost/myecho

   • To remove multiple images:

     # buildah rmi docker.io/library/mynewecho  docker.io/library/myecho2

   • To remove all images from your system:

     # buildah rmi -a

   • To remove images that have multiple names (tags) associated with them, add the -f option to remove them:

     # buildah rmi -f localhost/ubi-micro-httpd

Procedure

1. List all containers:

   # buildah containers
   CONTAINER ID  BUILDER  IMAGE ID     IMAGE NAME                       CONTAINER NAME
   05387e29ab93     *     c37e14066ac7 docker.io/library/myecho:latest  myecho-working-container

2. Remove the myecho-working-container container:

   # buildah rm myecho-working-container
   05387e29ab93151cf52e9c85c573f3e8ab64af1592b1ff9315db8a10a77d7c22

Procedure

1. Define a healthcheck:

   $ podman run -dt --name hc1 -p 8080:8080  --health-cmd='curl http://localhost:8080 || exit 1' --health-interval=0 registry.access.redhat.com/ubi8/httpd-24

   • The --health-cmd option sets a healthcheck command for the container.
   • The -health-interval=0 option with 0 value indicates that you want to run healthcheck manually.

2. Run the healthcheck manually:

   $ podman healthcheck run hc1
   Healthy

3. Optionally, you can check the exit status of last command:

   $ echo $?
   0

   The "0" value means success.

1. Use systemd to activate the Podman API socket.
2. Use a Podman client to perform basic commands.

Procedure

1. Start the service immediately:

   # systemctl enable --now podman.socket

2. To enable the link to var/lib/docker.sock using the docker-podman package:

   # yum install podman-docker

Verification steps

1. Display system information of Podman:

   # podman-remote info

2. Verify the link:

   # ls -al /var/run/docker.sock
   lrwxrwxrwx. 1 root root 23 Nov  4 10:19 /var/run/docker.sock -> /run/podman/podman.sock

Procedure

1. Enable and start the service immediately:

   $ systemctl --user enable --now podman.socket

2. Optional. To enable programs using Docker to interact with the rootless Podman socket:

   $ export DOCKER_HOST=unix:///run/user/<uid>/podman//podman.sock

Verification steps

1. Check the status of the socket:

   $ systemctl --user status podman.socket
   ● podman.socket - Podman API Socket
    Loaded: loaded (/usr/lib/systemd/user/podman.socket; enabled; vendor preset: enabled)
   Active: active (listening) since Mon 2021-08-23 10:37:25 CEST; 9min ago
   Docs: man:podman-system-service(1)
   Listen: /run/user/1000/podman/podman.sock (Stream)
   CGroup: /user.slice/user-1000.slice/user@1000.service/podman.socket

   The podman.socket is active and is listening at /run/user/<uid>/podman.podman.sock, where <uid> is the user’s ID.

2. Display system information of Podman:

   $ podman-remote info

Procedure

1. Run the service for the REST API:

   # podman system service -t 0 --log-level=debug

   • The value of 0 means no timeout. The default endpoint for a rootful service is unix:/run/podman/podman.sock.
   • The --log-level <level> option sets the logging level. The standard logging levels are debug, info, warn, error, fatal, and panic.

2. In another terminal, display system information of Podman. The podman-remote command, unlike the regular podman command, communicates through the Podman socket:

   # podman-remote info

3. To troubleshoot the Podman API and display request and responses, use the curl comman. To get the information about the Podman installation on the Linux server in JSON format:

   # curl -s --unix-socket /run/podman/podman.sock http://d/v1.0.0/libpod/info | jq
       {
     "host": {
       "arch": "amd64",
       "buildahVersion": "1.15.0",
       "cgroupVersion": "v1",
       "conmon": {
         "package": "conmon-2.0.18-1.module+el8.3.0+7084+c16098dd.x86_64",
         "path": "/usr/bin/conmon",
         "version": "conmon version 2.0.18, commit: 7fd3f71a218f8d3a7202e464252aeb1e942d17eb"
       },
       …
     "version": {
       "APIVersion": 1,
       "Version": "2.0.0",
       "GoVersion": "go1.14.2",
       "GitCommit": "",
       "BuiltTime": "Thu Jan  1 01:00:00 1970",
       "Built": 0,
       "OsArch": "linux/amd64"
     }
   }

   A jq utility is a command-line JSON processor.

4. Pull the registry.access.redhat.com/ubi8/ubi container image:

   # curl -XPOST --unix-socket /run/podman/podman.sock -v 'http://d/v1.0.0/images/create?fromImage=registry.access.redhat.com%2Fubi8%2Fubi'
   *   Trying /run/podman/podman.sock...
   * Connected to d (/run/podman/podman.sock) port 80 (#0)
   > POST /v1.0.0/images/create?fromImage=registry.access.redhat.com%2Fubi8%2Fubi HTTP/1.1
   > Host: d
   > User-Agent: curl/7.61.1
   > Accept: /
   >
   < HTTP/1.1 200 OK
   < Content-Type: application/json
   < Date: Tue, 20 Oct 2020 13:58:37 GMT
   < Content-Length: 231
   <
   {"status":"pulling image () from registry.access.redhat.com/ubi8/ubi:latest, registry.redhat.io/ubi8/ubi:latest","error":"","progress":"","progressDetail":{},"id":"ecbc6f53bba0d1923ca9e92b3f747da8353a070fccbae93625bd8b47dbee772e"}
   * Connection #0 to host d left intact

5. Display the pulled image:

   # curl --unix-socket /run/podman/podman.sock -v 'http://d/v1.0.0/libpod/images/json' | jq
   *   Trying /run/podman/podman.sock...
     % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                    Dload  Upload   Total   Spent    Left  Speed
     0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to d (/run/podman/podman.sock) port 80 (0) > GET /v1.0.0/libpod/images/json HTTP/1.1 > Host: d > User-Agent: curl/7.61.1 > Accept: / > < HTTP/1.1 200 OK < Content-Type: application/json < Date: Tue, 20 Oct 2020 13:59:55 GMT < Transfer-Encoding: chunked < { [12498 bytes data] 100 12485 0 12485 0 0 2032k 0 --:--:-- --:--:-- --:--:-- 2438k * Connection #0 to host d left intact [ { "Id": "ecbc6f53bba0d1923ca9e92b3f747da8353a070fccbae93625bd8b47dbee772e", "RepoTags": [ "registry.access.redhat.com/ubi8/ubi:latest", "registry.redhat.io/ubi8/ubi:latest" ], "Created": "2020-09-01T19:44:12.470032Z", "Size": 210838671, "Labels": { "architecture": "x86_64", "build-date": "2020-09-01T19:43:46.041620", "com.redhat.build-host": "cpt-1008.osbs.prod.upshift.rdu2.redhat.com", ... "maintainer": "Red Hat, Inc.", "name": "ubi8", ... "summary": "Provides the latest release of Red Hat Universal Base Image 8.", "url": "https://access.redhat.com/containers//registry.access.redhat.com/ubi8/images/8.2-347",
         ...
       },
       "Names": [
         "registry.access.redhat.com/ubi8/ubi:latest",
         "registry.redhat.io/ubi8/ubi:latest"
       ],
       ...
       ]
     }
   ]