Containers with Podman: images, run, ports and logs

Containers and virtual machines

A virtual machine simulates a whole computer, with its own kernel. A container is just a group of normal processes on the host, but the kernel gives them their own view of files, network, process list and users (namespaces) and limits their resources (cgroups). Containers start in a second and use far less memory, which is why apps are now often shipped as container images.

Images, containers and registries

• Image: a read-only package with an application and its files, built in layers. Like a template.
• Container: a running (or stopped) instance of an image, with a thin writable layer on top.
• Registry: a server that stores images, such as registry.access.redhat.com (Red Hat's public images), registry.redhat.io (needs a Red Hat login) or quay.io.
• Image name: registry/namespace/name:tag, for example registry.access.redhat.com/ubi9/httpd-24:latest. The tag picks a version; if you leave it out, latest is used.

UBI (Universal Base Image) images are RHEL-based images that Red Hat lets anyone use and redistribute, a good base for your own containers.

First container

$ sudo dnf install -y container-tools        # podman, skopeo, buildah
$ podman search httpd-24 --limit 3
$ podman pull registry.access.redhat.com/ubi9/httpd-24
$ podman images
REPOSITORY                                  TAG     IMAGE ID      CREATED      SIZE
registry.access.redhat.com/ubi9/httpd-24    latest  2b6f1c7e8d9a  2 weeks ago  387 MB
$ podman run -d --name web -p 8080:8080 registry.access.redhat.com/ubi9/httpd-24
5c1e9f0a7b...
$ podman ps
CONTAINER ID  IMAGE                                            COMMAND               CREATED        STATUS        PORTS                   NAMES
5c1e9f0a7b2d  registry.access.redhat.com/ubi9/httpd-24:latest  /usr/bin/run-http...  5 seconds ago  Up 5 seconds  0.0.0.0:8080->8080/tcp  web
$ curl -s localhost:8080 | head -1
<!DOCTYPE html>

Everyday commands

$ podman logs web              # the container's output (add -f to follow)
$ podman exec -it web /bin/bash   # a shell inside the running container
$ podman inspect web | grep -i ipaddress
$ podman stop web; podman start web
$ podman rm web                # remove a stopped container (-f to force a running one)
$ podman rmi registry.access.redhat.com/ubi9/httpd-24   # remove the image
$ podman run --rm -it registry.access.redhat.com/ubi9/ubi cat /etc/redhat-release
Red Hat Enterprise Linux release 9.4 (Plow)

Many images are configured with environment variables, passed with -e. For example a MariaDB image needs a root password and a database name: podman run -d --name db -e MYSQL_ROOT_PASSWORD=... -e MYSQL_DATABASE=shop -p 3306:3306 registry.redhat.io/rhel9/mariadb-105. The image's documentation lists its variables.

Rootless by default

When a normal user runs podman, the containers are rootless: they run with that user's rights on the host, even if the program inside thinks it is root. A break-out from the container gets only that user's access. Each user has their own images and containers (stored in ~/.local/share/containers). Rootless containers cannot publish host ports below 1024 by default, which is why the example uses 8080, not 80.

Common mistakes

• Using -p 8080 alone, or swapping the order. The format is -p HOST_PORT:CONTAINER_PORT.
• Expecting data written inside a container to survive podman rm. The container's own layer is deleted with it; use volumes (next lesson).
• Running podman with sudo and then looking for the container as a normal user, or the reverse: root and each user see different containers.
• Forgetting the host firewall when others must reach the published port.