Project · Linux and Red Hat (RHCSA to RHCE)
Project: a rootless container service for an online spice shop
The brief
A small online spice seller in Kochi wants its product catalogue served from a container, not installed straight on the server. You run Red Hat's Apache image as an ordinary user (rootless), keep the pages in a host folder with the right SELinux label, turn the container into a systemd user service with Quadlet, and make it start at boot without anyone logging in.
Why it matters
Companies now ship many apps as container images. Running them rootless, with persistent storage and systemd in charge, is how RHEL does it safely, and it is an RHCSA objective. The same skills lead straight on to Kubernetes and OpenShift jobs.
Skills you practise
- container-tools and podman
- podman pull, run, ps and logs
- volumes with :Z and container_file_t
- Quadlet .container files
- systemctl --user
- loginctl enable-linger
- firewall-cmd --add-port
You need
- A RHEL 9 virtual machine (free Red Hat Developer subscription) or Rocky Linux 9 / AlmaLinux 9, version 9.3 or later
- Internet access from the VM to registry.access.redhat.com
- A user that can run sudo, and another machine on the network to test from
What you will have at the end
A rootless Apache container that serves the catalogue from a labelled host folder, runs as a systemd user service through Quadlet and survives a reboot; catalogue.container and commands.sh are in the summary.
How it is marked (rubric, 100 points)
| Service survives a rebootAfter a reboot with nobody logged in, the page loads from another machine. | 35 |
|---|---|
| Rootless and secureEverything runs as webapp, SELinux stays enforcing, the folder is container_file_t with :Z, and only 8080/tcp is opened. | 25 |
| Clean Quadlet filecatalogue.container is short and correct: image with full registry name, port, volume with %h and :Z, restart policy and [Install]. | 20 |
| Documentedcommands.sh shows every command and which user ran it, and how to read the logs. | 20 |
0/7 steps done
Step 1 of 7
Install the tools and log in as the app user
container-tools is installed and the user webapp can run podman 4.4 or later.
A rootless container runs as an ordinary user, so a break-in inside the container does not give root on the server. Install container-tools as an admin, create the user webapp, then log in as webapp with ssh (or sudo machinectl shell webapp@). Do not use su or sudo -i: they do not start a proper login session, and systemctl --user later fails. Quadlet needs Podman 4.4 or newer, which RHEL 9.3 and later have.
$ whoami; podman --versionYour notes: commands.sh, catalogue.container
Write down each command you ran. It goes into your project summary.