Building, running, and managing containers

Procedure

1. Install RHEL.

2. Register RHEL: Enter your user name and password. The user name and password are the same as your login credentials for Red Hat Customer Portal:

   # subscription-manager register
   Registering to: subscription.rhsm.redhat.com:443/subscription
   Username: <username>
   Password: <password>

3. Subscribe to RHEL.

   • To auto-subscribe to RHEL:

     # subscription-manager attach --auto

   • To subscribe to RHEL by Pool ID:

     # subscription-manager attach --pool <PoolID>

4. Install the container-tools meta-package:

   # dnf install container-tools

5. Optional: Install the podman-docker package:

   # dnf install podman-docker

   The podman-docker package replaces the Docker command-line interface and docker-api with the matching Podman commands instead.

Procedure

1. Install RHEL.

2. Install the podman package:

   # dnf install podman -y

3. Create a new user account:

   # useradd -c "Joe Jones" joe
   # passwd joe

   • The user is automatically configured to be able to use rootless Podman.
   • The useradd command automatically sets the range of accessible user and group IDs automatically in the /etc/subuid and /etc/subgid files.
   • If you change the /etc/subuid or /etc/subgid manually, you have to run the podman system migrate command to allow the new changes to be applied.

4. Connect to the user:

   $ ssh joe@server.example.com

   Note

   Do not use su or su - commands because these commands do not set the correct environment variables.

5. Pull the registry.access.redhat.com/ubi9/ubi container image:

   $ podman pull registry.access.redhat.com/ubi9/ubi

6. Run the container named myubi and display the OS version:

   $ podman run --rm --name=myubi registry.access.redhat.com/ubi9/ubi \
     cat /etc/os-release
   NAME="Red Hat Enterprise Linux"
   VERSION="9 (Plow)"

Procedure

1. Authenticate to the registry:

   # podman login quay.io

2. Search for the image:

   • To search for a particular image on a specific registry, enter:

     # podman search quay.io/postgresql-10
     INDEX       NAME                                           DESCRIPTION           STARS   OFFICIAL   AUTOMATED
     redhat.io   registry.redhat.io/rhel8/postgresql-10         This container image ...  0
     redhat.io   registry.redhat.io/rhscl/postgresql-10-rhel7   PostgreSQL is an  ...     0

   • Alternatively, to display all images provided by a particular registry, enter:

     # podman search quay.io/

   • To search for the image name in all registries, enter:

     # podman search postgresql-10

     To display the full descriptions, pass the --no-trunc option to the command.

Procedure

1. Log in to the registry.redhat.io registry:

   $ podman login registry.redhat.io
   Username: <username>
   Password: <password>
   Login Succeeded!

2. Pull the registry.redhat.io/ubi9/ubi container image:

   $ podman pull registry.redhat.io/ubi9/ubi

Procedure

1. Create the /var/lib/images/nginx directory:

   $ mkdir -p /var/lib/images/nginx

2. Copy the layers of the docker://docker.io/nginx:latest image to the newly created directory:

   $ skopeo copy docker://docker.io/nginx:latest dir:/var/lib/images/nginx

Procedure

1. List all images:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED      SIZE
   registry.redhat.io/ubi9/ubi          latest  3269c37eae33  7 weeks ago  208 MB

2. Assign the myubi name to the registry.redhat.io/ubi9/ubi image using one of the following options:

   • The image name:

     $ podman tag registry.redhat.io/ubi9/ubi myubi

   • The image ID:

     $ podman tag 3269c37eae33 myubi

     Both commands give you the same result.

3. List all images:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED       SIZE
   registry.redhat.io/ubi9/ubi          latest  3269c37eae33  2 months ago  208 MB
   localhost/myubi                      latest  3269c37eae33  2 months ago  208 MB

   Notice that the default tag is latest for both images. You can see all the image names are assigned to the single image ID 3269c37eae33.

4. Add the 9 tag to the registry.redhat.io/ubi9/ubi image using either:

   • The image name:

     $ podman tag registry.redhat.io/ubi9/ubi myubi:9

   • The image ID:

     $ podman tag 3269c37eae33 myubi:9

     Both commands give you the same result.

5. List all images:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED       SIZE
   registry.redhat.io/ubi9/ubi          latest  3269c37eae33  2 months ago  208 MB
   localhost/myubi                      latest  3269c37eae33  2 months ago  208 MB
   localhost/myubi                      9     3269c37eae33  2 months ago  208 MB

   Notice that the default tag is latest for both images. You can see all the image names are assigned to the single image ID 3269c37eae33.

Procedure

1. Save the registry.redhat.io/rhel9/rsyslog image as a tarball:

   • In the default docker-dir format:

     $ podman save -o myrsyslog.tar registry.redhat.io/rhel9/rsyslog:latest

   • In the oci-archive format, using the --format option:

     $ podman save -o myrsyslog-oci.tar --format=oci-archive registry.redhat.io/rhel9/rsyslog

     The myrsyslog.tar and myrsyslog-oci.tar archives are stored in your current directory. The next steps are performed with the myrsyslog.tar tarball.

2. Check the file type of myrsyslog.tar:

   $ file myrsyslog.tar
   myrsyslog.tar: POSIX tar archive

3. To load the registry.redhat.io/rhel9/rsyslog:latest image from the myrsyslog.tar:

   $ podman load -i myrsyslog.tar
   ...
   Loaded image(s): registry.redhat.io/rhel9/rsyslog:latest

Procedure

1. Optional: Add an additional name to the ubi image:

   # podman tag registry.redhat.io/ubi9/ubi registry.example.com:5000/ubi9/ubi

2. Push the registry.example.com:5000/ubi9/ubi image from your local storage to a registry:

   # podman push registry.example.com:5000/ubi9/ubi

Procedure

1. List all images on your local system:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED      SIZE
   registry.redhat.io/rhel8/rsyslog     latest  4b32d14201de  7 weeks ago  228 MB
   registry.redhat.io/ubi8/ubi          latest  3269c37eae33  7 weeks ago  208 MB
   localhost/myubi                      X.Y     3269c37eae33  7 weeks ago  208 MB

2. List all containers:

   $ podman ps -a
   CONTAINER ID  IMAGE                                    COMMAND          CREATED        STATUS            PORTS   NAMES
   7ccd6001166e  registry.redhat.io/rhel8/rsyslog:latest  /bin/rsyslog.sh  6 seconds ago  Up 5 seconds ago          mysyslog

   To remove the registry.redhat.io/rhel8/rsyslog image, you have to stop all containers running from this image using the podman stop command. You can stop a container by its ID or name.

3. Stop the mysyslog container:

   $ podman stop mysyslog
   7ccd6001166e9720c47fbeb077e0afd0bb635e74a1b0ede3fd34d09eaf5a52e9

4. Remove the registry.redhat.io/rhel8/rsyslog image:

   $ podman rmi registry.redhat.io/rhel8/rsyslog

   • To remove multiple images:

     $ podman rmi registry.redhat.io/rhel8/rsyslog registry.redhat.io/ubi8/ubi

   • To remove all images from your system:

     $ podman rmi -a

   • To remove images that have multiple names (tags) associated with them, add the -f option to remove them:

     $ podman rmi -f 1de7d7b3f531
     1de7d7b3f531...

Procedure

1. Display the type of operating system of the container based on the registry.access.redhat.com/ubi9/ubi container image using the cat /etc/os-release command:

   $ podman run --rm registry.access.redhat.com/ubi9/ubi cat /etc/os-release
   NAME="Red Hat Enterprise Linux"
   ...
   ID="rhel"
   ...
   HOME_URL="https://www.redhat.com/"
   BUG_REPORT_URL="https://bugzilla.redhat.com/"
   
   REDHAT_BUGZILLA_PRODUCT=" Red Hat Enterprise Linux 9"
   ...

2. Optional: List all containers.

   $ podman ps
   CONTAINER ID  IMAGE   COMMAND  CREATED  STATUS  PORTS   NAMES

   Because of the --rm option you should not see any container. The container was removed.

Procedure

1. Run the container named myubi based on the registry.redhat.io/ubi9/ubi image:

   $ podman run --name=myubi -it registry.access.redhat.com/ubi9/ubi /bin/bash
   [root@6ccffd0f6421 /]#

   • The -i option creates an interactive session. Without the -t option, the shell stays open, but you cannot type anything to the shell.
   • The -t option opens a terminal session. Without the -i option, the shell opens and then exits.

2. Install the procps-ng package containing a set of system utilities (for example ps, top, uptime, and so on):

   [root@6ccffd0f6421 /]# dnf install procps-ng

3. Use the ps -ef command to list current processes:

   # ps -ef
   UID          PID    PPID  C STIME TTY          TIME CMD
   root           1       0  0 12:55 pts/0    00:00:00 /bin/bash
   root          31       1  0 13:07 pts/0    00:00:00 ps -ef

4. Enter exit to exit the container and return to the host:

   # exit

5. Optional: List all containers:

   $ podman ps
   CONTAINER ID  IMAGE                               COMMAND    CREATED         STATUS                     PORTS   NAMES
   1984555a2c27  registry.redhat.io/ubi9/ubi:latest  /bin/bash  21 minutes ago  Exited (0) 21 minutes ago          myubi

   You can see that the container is in Exited status.

Procedure

1. Run the container based on registry.redhat.io/rhel9/rsyslog image:

   $ podman run -d registry.redhat.io/rhel8/rsyslog

2. List all containers:

   • To list all running containers:

     $ podman ps
     CONTAINER ID IMAGE              COMMAND         CREATED       STATUS            PORTS NAMES
     74b1da000a11 rhel9/rsyslog /bin/rsyslog.sh 2 minutes ago Up About a minute       musing_brown

   • To list all containers, running or stopped:

     $ podman ps -a
     CONTAINER ID IMAGE         COMMAND    CREATED    STATUS                PORTS NAMES     IS INFRA
     d65aecc325a4 ubi9/ubi      /bin/bash  3 secs ago Exited (0) 5 secs ago peaceful_hopper false
     74b1da000a11 rhel9/rsyslog rsyslog.sh 2 mins ago Up About a minute     musing_brown    false

Procedure

1. Start the myubi container:

   • In the non interactive mode:

     $ podman start myubi

     Alternatively, you can use podman start 1984555a2c27.

   • In the interactive mode, use -a (--attach) and -i (--interactive) options to work with container bash shell:

     $ podman start -a -i myubi

     Alternatively, you can use podman start -a -i 1984555a2c27.

2. Enter exit to exit the container and return to the host:

   [root@6ccffd0f6421 /]# exit

Procedure

1. Run the container named log_test and mount the host /dev/log device inside the container:

   # podman run --name="log_test" -v /dev/log:/dev/log --rm \
     registry.redhat.io/ubi9/ubi logger "Testing logging to the host"

2. Use the journalctl utility to display logs:

   # journalctl -b | grep Testing
   Dec 09 16:55:00 localhost.localdomain root[14634]: Testing logging to the host

   The --rm option removes the container when it exits.

Procedure

1. Run the container named mysyslog:

   # podman run -d --name=mysyslog registry.redhat.io/rhel9/rsyslog

2. Optional: List all containers:

   # podman ps -a
   CONTAINER ID  IMAGE                                    COMMAND          CREATED         STATUS                     PORTS   NAMES
   c56ef6a256f8  registry.redhat.io/rhel9/rsyslog:latest  /bin/rsyslog.sh  20 minutes ago  Up 20 minutes ago                  mysyslog

3. Mount the mysyslog container:

   # podman mount mysyslog
   /var/lib/containers/storage/overlay/990b5c6ddcdeed4bde7b245885ce4544c553d108310e2b797d7be46750894719/merged

4. Display the content of the mount point using ls command:

   # ls /var/lib/containers/storage/overlay/990b5c6ddcdeed4bde7b245885ce4544c553d108310e2b797d7be46750894719/merged
   bin  boot  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

5. Display the OS version:

   # cat /var/lib/containers/storage/overlay/990b5c6ddcdeed4bde7b245885ce4544c553d108310e2b797d7be46750894719/merged/etc/os-release
   NAME="Red Hat Enterprise Linux"
   VERSION="9 (Ootpa)"
   ID="rhel"
   ID_LIKE="fedora"
   ...

Procedure

1. Set the container network interface to the IP address 10.88.0.44:

   # podman run -d --ip=10.88.0.44 registry.access.redhat.com/rhel9/rsyslog
   efde5f0a8c723f70dd5cb5dc3d5039df3b962fae65575b08662e0d5b5f9fbe85

2. Check that the IP address is set properly:

   # podman inspect efde5f0a8c723 | grep 10.88.0.44
   "IPAddress": "10.88.0.44",

Procedure

1. Execute the rpm -qa command inside the myrsyslog container to list all installed packages:

   $ podman exec -it myrsyslog rpm -qa
   tzdata-2020d-1.el8.noarch
   python3-pip-wheel-9.0.3-18.el8.noarch
   redhat-release-8.3-1.0.el8.x86_64
   filesystem-3.8-3.el8.x86_64
   ...

2. Execute a /bin/bash command in the myrsyslog container:

   $ podman exec -it myrsyslog /bin/bash

3. Install the procps-ng package containing a set of system utilities (for example ps, top, uptime, and so on):

   # dnf install procps-ng

4. Inspect the container:

   • To list every process on the system:

     # ps -ef
     UID          PID    PPID  C STIME TTY          TIME CMD
     root           1       0  0 10:23 ?        00:00:01 /usr/sbin/rsyslogd -n
     root           8       0  0 11:07 pts/0    00:00:00 /bin/bash
     root          47       8  0 11:13 pts/0    00:00:00 ps -ef

   • To display file system disk space usage:

     # df -h
     Filesystem      Size  Used Avail Use% Mounted on
     fuse-overlayfs   27G  7.1G   20G  27% /
     tmpfs            64M     0   64M   0% /dev
     tmpfs           269M  936K  268M   1% /etc/hosts
     shm              63M     0   63M   0% /dev/shm
     ...

   • To display system information:

     # uname -r
     4.18.0-240.10.1.el8_3.x86_64

   • To display amount of free and used memory in megabytes:

     # free --mega
     total        used        free      shared  buff/cache   available
     Mem:       2818         615        1183          12         1020        1957
     Swap:      3124           0        3124

Procedure

1. Create a volume:

   $ podman volume create hostvolume

2. Display information about the volume:

   $ podman volume inspect hostvolume
   [
       {
           "name": "hostvolume",
           "labels": {},
           "mountpoint": "/home/username/.local/share/containers/storage/volumes/hostvolume/_data",
           "driver": "local",
           "options": {},
           "scope": "local"
       }
   ]

   Notice that it creates a volume in the volumes directory. You can save the mount point path to the variable for easier manipulation: $ mntPoint=$(podman volume inspect hostvolume --format {{.Mountpoint}}).

   Notice that if you run sudo podman volume create hostvolume, then the mount point changes to /var/lib/containers/storage/volumes/hostvolume/_data.

3. Create a text file inside the directory using the path that is stored in the mntPoint variable:

   $ echo "Hello from host" >> $mntPoint/host.txt

4. List all files in the directory defined by the mntPoint variable:

   $ ls $mntPoint/
   host.txt

5. Run the container named myubi1 and map the directory defined by the hostvolume volume name on the host to the /containervolume1 directory on the container:

   $ podman run -it --name myubi1 -v hostvolume:/containervolume1 registry.access.redhat.com/ubi9/ubi /bin/bash

   Note that if you use the volume path defined by the mntPoint variable (-v $mntPoint:/containervolume1), data can be lost when running podman volume prune command, which removes unused volumes. Always use -v hostvolume_name:/containervolume_name.

6. List the files in the shared volume on the container:

   # ls /containervolume1
   host.txt

   You can see the host.txt file which you created on the host.

7. Create a text file inside the /containervolume1 directory:

   # echo "Hello from container 1" >> /containervolume1/container1.txt

8. Detach from the container with CTRL+p and CTRL+q.

9. List the files in the shared volume on the host, you should see two files:

   $ ls $mntPoint
   container1.rxt  host.txt

   At this point, you are sharing files between the container and host. To share files between two containers, run another container named myubi2.

10. Run the container named myubi2 and map the directory defined by the hostvolume volume name on the host to the /containervolume2 directory on the container:

    $ podman run -it --name myubi2 -v hostvolume:/containervolume2 registry.access.redhat.com/ubi9/ubi /bin/bash

11. List the files in the shared volume on the container:

    # ls /containervolume2
    container1.txt host.txt

    You can see the host.txt file which you created on the host and container1.txt which you created inside the myubi1 container.

12. Create a text file inside the /containervolume2 directory:

    # echo "Hello from container 2" >> /containervolume2/container2.txt

13. Detach from the container with CTRL+p and CTRL+q.

14. List the files in the shared volume on the host, you should see three files:

    $ ls $mntPoint
    container1.rxt  container2.txt host.txt

Procedure

1. Run the myubi container based on the registry.access.redhat.com/ubi9/ubi image:

   $ podman run -dt --name=myubi registry.access.redhat.com/9/ubi

2. Optional: List all containers:

   $ podman ps -a
   CONTAINER ID  IMAGE                                    COMMAND          CREATED     STATUS         PORTS   NAMES
   a6a6d4896142  registry.access.redhat.com/9:latest   /bin/bash        7 seconds ago  Up 7 seconds ago          myubi

3. Attach to the myubi container:

   $ podman attach myubi

4. Create a file named testfile:

   [root@a6a6d4896142 /]# echo "hello" > testfile

5. Detach from the container with CTRL+p and CTRL+q.

6. Export the file system of the myubi as a myubi-container.tar on the local machine:

   $ podman export -o myubi.tar a6a6d4896142

7. Optional: List the current directory content:

   $ ls -l
   -rw-r--r--. 1 user user 210885120 Apr  6 10:50 myubi-container.tar
   ...

8. Optional: Create a myubi-container directory, extract all files from the myubi-container.tar archive. List a content of the myubi-directory in a tree-like format:

   $ mkdir myubi-container
   $ tar -xf myubi-container.tar -C myubi-container
   $ tree -L 1 myubi-container
   ├── bin -> usr/bin
   ├── boot
   ├── dev
   ├── etc
   ├── home
   ├── lib -> usr/lib
   ├── lib64 -> usr/lib64
   ├── lost+found
   ├── media
   ├── mnt
   ├── opt
   ├── proc
   ├── root
   ├── run
   ├── sbin -> usr/sbin
   ├── srv
   ├── sys
   ├── testfile
   ├── tmp
   ├── usr
   └── var
   
   20 directories, 1 file

   You can see that the myubi-container.tar contains the container file system.

9. Import the myubi.tar and saves it as a filesystem image:

   $ podman import myubi.tar myubi-imported
   Getting image source signatures
   Copying blob 277cab30fe96 done
   Copying config c296689a17 done
   Writing manifest to image destination
   Storing signatures
   c296689a17da2f33bf9d16071911636d7ce4d63f329741db679c3f41537e7cbf

10. List all images:

    $ podman images
    REPOSITORY                              TAG     IMAGE ID      CREATED         SIZE
    docker.io/library/myubi-imported       latest  c296689a17da  51 seconds ago  211 MB

11. Display the content of the testfile file:

    $ podman run -it --name=myubi-imported docker.io/library/myubi-imported cat testfile
    hello

Procedure

1. List all containers, running or stopped:

   $ podman ps -a
   CONTAINER ID IMAGE         COMMAND    CREATED    STATUS                PORTS NAMES     IS INFRA
   d65aecc325a4 ubi9/ubi      /bin/bash  3 secs ago Exited (0) 5 secs ago peaceful_hopper false
   74b1da000a11 rhel9/rsyslog rsyslog.sh 2 mins ago Up About a minute     musing_brown    false

2. Remove the containers:

   • To remove the peaceful_hopper container:

     $ podman rm peaceful_hopper

     Notice that the peaceful_hopper container was in Exited status, which means it was stopped and it can be removed immediately.

   • To remove the musing_brown container, first stop the container and then remove it:

     $ podman stop musing_brown
     $ podman rm musing_brown

     NOTE

     • To remove multiple containers:

       $ podman rm clever_yonath furious_shockley

     • To remove all containers from your local system:

       $ podman rm -a

Procedure

1. Pull the registry.access.redhat.com/ubi9/ubi container image:

   # podman pull registry.access.redhat.com/ubi9/ubi

2. Export the registry.access.redhat.com/ubi9/ubi image to the rhel.tar archive:

   # podman export $(podman create registry.access.redhat.com/ubi9/ubi) > rhel.tar

3. Create the bundle/rootfs directory:

   # mkdir -p bundle/rootfs

4. Extract the rhel.tar archive into the bundle/rootfs directory:

   # tar -C bundle/rootfs -xf rhel.tar

5. Create a new specification file named config.json for the bundle:

   # <runtime> spec -b bundle

   • The -b option specifies the bundle directory. The default value is the current directory.

6. Optional: Change the settings:

   # vi bundle/config.json

7. Create an instance of a container named myubi for a bundle:

   # <runtime> create -b bundle/ myubi

8. Start a myubi container:

   # <runtime> start myubi

Procedure

1. Pull the registry.access.redhat.com/ubi9/ubi container image:

   $ podman pull registry.access.redhat.com/ubi9/ubi

2. Change the container runtime using the --runtime option:

   $ podman run --name=myubi -dt --runtime=<runtime> ubi9
   e4654eb4df12ac031f1d0f2657dc4ae6ff8eb0085bf114623b66cc664072e69b

3. Optional: List all images:

   $ podman ps -a
   CONTAINER ID  IMAGE                                   COMMAND  CREATED        STATUS            PORTS   NAMES
   e4654eb4df12  registry.access.redhat.com/ubi9:latest  bash     4 seconds ago  Up 4 seconds ago          myubi

Procedure

1. Change the runtime in the /etc/containers/containers.conf file:

   # vim /etc/containers/containers.conf
   [engine]
   runtime = "<runtime>"

2. Run the container named myubi:

   # podman run --name=myubi -dt ubi9 bash
   Resolved "ubi9" as an alias (/etc/containers/registries.conf.d/001-rhel-shortnames.conf)
   Trying to pull registry.access.redhat.com/ubi9:latest…
   ...
   Storing signatures

Procedure

1. Create a Containerfile with the following contents to a new directory:

   FROM registry.access.redhat.com/ubi9/ubi-init
   RUN dnf -y install httpd; dnf clean all; systemctl enable httpd;
   RUN echo "Successful Web Server Test" > /var/www/html/index.html
   RUN mkdir /etc/systemd/system/httpd.service.d/; echo -e '[Service]\nRestart=always' > /etc/systemd/system/httpd.service.d/httpd.conf
   EXPOSE 80
   CMD [ "/sbin/init" ]

   The Containerfile installs the httpd package, enables the httpd service to start at boot time, creates a test file (index.html), exposes the Web server to the host (port 80), and starts the systemd init service (/sbin/init) when the container starts.

2. Build the container:

   # podman build --format=docker -t mysysd .

3. Optional: If you want to run containers with systemd and SELinux is enabled on your system, you must set the container_manage_cgroup boolean variable:

   # setsebool -P container_manage_cgroup 1

4. Run the container named mysysd_run:

   # podman run -d --name=mysysd_run -p 80:80 mysysd

   The mysysd image runs as the mysysd_run container as a daemon process, with port 80 from the container exposed to port 80 on the host system.

   Note

   In rootless mode, you have to choose host port number >= 1024. For example:

   $ podman run -d --name=mysysd -p 8081:80 mysysd

   To use port numbers < 1024, you have to modify the net.ipv4.ip_unprivileged_port_start variable:

   # sysctl net.ipv4.ip_unprivileged_port_start=80

5. Check that the container is running:

   # podman ps
   a282b0c2ad3d  localhost/mysysd:latest  /sbin/init  15 seconds ago  Up 14 seconds ago  0.0.0.0:80->80/tcp  mysysd_run

6. Test the web server:

   # curl localhost/index.html
   Successful Web Server Test

Procedure

1. Pull and build the registry.access.redhat.com/ubi8/ubi-micro image:

   # microcontainer=$(buildah from registry.access.redhat.com/ubi9/ubi-micro)

2. Mount a working container root filesystem:

   # micromount=$(buildah mount $microcontainer)

3. Install the httpd service to the micromount directory:

   # dnf install \
       --installroot $micromount \
       --releasever=/ \
       --setopt install_weak_deps=false \
       --setopt=reposdir=/etc/yum.repos.d/ \
       --nodocs -y \
       httpd
   # dnf clean all \
       --installroot $micromount

4. Unmount the root file system on the working container:

   # buildah umount $microcontainer

5. Create the ubi-micro-httpd image from a working container:

   # buildah commit $microcontainer ubi-micro-httpd

Verification

1. Display details about the ubi-micro-httpd image:

   # podman images ubi-micro-httpd
   localhost/ubi-micro-httpd latest 7c557e7fbe9f  22 minutes ago  151 MB

Procedure

1. Pull and run the registry.access.redhat.com/ubi9/ubi image:

   $ podman run -it --name myubi registry.access.redhat.com/ubi9/ubi

2. Add a package to the myubi container.

   • To add a package that is in the UBI repository, disable all dnf repositories except for UBI repositories. For example, to add the bzip2 package:

     # dnf install --disablerepo=* --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms bzip2

   • To add a package that is not in the UBI repository, do not disable any repositories. For example, to add the zsh package:

     # dnf install zsh

   • To add a package that is in a different host repository, explicitly enable the repository you need. For example, to install the python38-devel package from the codeready-builder-for-rhel-8-x86_64-rpms repository:

     # dnf install --enablerepo=codeready-builder-for-rhel-8-x86_64-rpms python38-devel

Verification

1. List all enabled repositories inside the container:

   # dnf repolist

2. Ensure that the required repositories are listed.

3. List all installed packages:

   # rpm -qa

4. Ensure that the required packages are listed.

Procedure

1. Pull and run the registry.access.redhat.com/ubi9/ubi-minimal image:

   $ podman run -it --name myubimin registry.access.redhat.com/ubi9/ubi-minimal

2. Add a package to the myubimin container:

   • To add a package that is in the UBI repository, do not disable any repositories. For example, to add the bzip2 package:

     # microdnf install bzip2 --setopt install_weak_deps=false

   • To add a package that is in a different host repository, explicitly enable the repository you need. For example, to install the python38-devel package from the codeready-builder-for-rhel-8-x86_64-rpms repository:

     # microdnf install --enablerepo=codeready-builder-for-rhel-8-x86_64-rpms python38-devel --setopt install_weak_deps=false

     The --setopt install_weak_deps=false option disables the installation of weak dependencies. Weak dependencies include recommended or suggested packages that are not strictly required but are often installed by default.

Verification

1. List all enabled repositories inside the container:

   # microdnf repolist

2. Ensure that the required repositories are listed.

3. List all installed packages:

   # rpm -qa

4. Ensure that the required packages are listed.

Verification

1. List all enabled repositories:

   • To list all enabled repositories inside the containers based on UBI standard or UBI init images:

     #  dnf repolist

   • To list all enabled repositories inside the containers based on UBI minimal containers:

     # microdnf repolist

2. Ensure that the required repositories are listed.

3. List all installed packages:

   # rpm -qa

4. Ensure that the required packages are listed.

Procedure

1. Create a Containerfile:

   FROM registry.access.redhat.com/ubi9/ubi
   USER root
   LABEL maintainer="John Doe"
   # Update image
   RUN dnf update --disablerepo=* --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms -y && rm -rf /var/cache/yum
   RUN dnf install --disablerepo=* --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms httpd -y && rm -rf /var/cache/yum
   # Add default Web page and expose port
   RUN echo "The Web Server is Running" > /var/www/html/index.html
   EXPOSE 80
   # Start the service
   CMD ["-D", "FOREGROUND"]
   ENTRYPOINT ["/usr/sbin/httpd"]

2. Build the container image:

   # buildah bud -t johndoe/webserver .
   STEP 1: FROM registry.access.redhat.com/ubi9/ubi:latest
   STEP 2: USER root
   STEP 3: LABEL maintainer="John Doe"
   STEP 4: RUN dnf update --disablerepo=* --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms -y
   ...
   Writing manifest to image destination
   Storing signatures
   --> f9874f27050
   f9874f270500c255b950e751e53d37c6f8f6dba13425d42f30c2a8ef26b769f2

Verification

1. Run the web server:

   # podman run -d --name=myweb -p 80:80 johndoe/webserver
   bbe98c71d18720d966e4567949888dc4fb86eec7d304e785d5177168a5965f64

2. Test the web server:

   # curl http://localhost/index.html
   The Web Server is Running

Procedure

1. Use the skopeo copy command to copy the source container image to a local directory:

   $ skopeo copy \
   docker://registry.access.redhat.com/ubi9:8.1-397-source \
   dir:$HOME/TEST
   ...
   Copying blob 477bc8106765 done
   Copying blob c438818481d3 done
   ...
   Writing manifest to image destination
   Storing signatures

2. Use the skopeo inspect command to inspect the source container image:

   $ skopeo inspect dir:$HOME/TEST
   {
       "Digest": "sha256:7ab721ef3305271bbb629a6db065c59bbeb87bc53e7cbf88e2953a1217ba7322",
       "RepoTags": [],
       "Created": "2020-02-11T12:14:18.612461174Z",
       "DockerVersion": "",
       "Labels": null,
       "Architecture": "amd64",
       "Os": "linux",
       "Layers": [
           "sha256:1ae73d938ab9f11718d0f6a4148eb07d38ac1c0a70b1d03e751de8bf3c2c87fa",
           "sha256:9fe966885cb8712c47efe5ecc2eaa0797a0d5ffb8b119c4bd4b400cc9e255421",
           "sha256:61b2527a4b836a4efbb82dfd449c0556c0f769570a6c02e112f88f8bbcd90166",
           ...
           "sha256:cc56c782b513e2bdd2cc2af77b69e13df4ab624ddb856c4d086206b46b9b9e5f",
           "sha256:dcf9396fdada4e6c1ce667b306b7f08a83c9e6b39d0955c481b8ea5b2a465b32",
           "sha256:feb6d2ae252402ea6a6fca8a158a7d32c7e4572db0e6e5a5eab15d4e0777951e"
       ],
       "Env": null
   }

3. Unpack all the content:

   $ cd $HOME/TEST
   $ for f in $(ls); do tar xvf $f; done

4. Check the results:

   $ find blobs/ rpm_dir/
   blobs/
   blobs/sha256
   blobs/sha256/10914f1fff060ce31388f5ab963871870535aaaa551629f5ad182384d60fdf82
   rpm_dir/
   rpm_dir/gzip-1.9-4.el8.src.rpm

   If the results are correct, the image is ready to be used.

Procedure

1. Generate a GPG key:

   # gpg --full-gen-key

2. Export the public key:

   # gpg --output <path>/key.gpg --armor --export <username@domain.com>

3. Build the container image using Containerfile in the current directory:

   $ podman build -t <registry>/<namespace>/<image>

   Replace <registry>, <namespace>, and <image> with the container image identifiers. For more details, see Container registries.

4. Sign the image and push it to the registry:

    $  podman push \
       --sign-by <username@domain.com> \
       <registry>/<namespace>/<image>

   Note

   If you need to sign existing images while moving them across container registries, you can use the skopeo copy command.

5. Optional: Display the new image signature:

   # (cd /var/lib/containers/sigstore/; find . -type f)
   ./<image>@sha256=<digest>/signature-1

6. Copy your local signatures to the lookaside web server:

   # rsync -a /var/lib/containers/sigstore <user@registry-lookaside.example.com>:/registry-lookaside/webroot/sigstore

Procedure

1. Update a trust scope for the <registry>:

   $ podman image trust set -f <path>/key.gpg <registry>/<namespace>

2. Optional: Verify the trust policy configuration by displaying the /etc/containers/policy.json file:

   $ cat /etc/containers/policy.json
   {
     ...
     "transports": {
       "docker": {
         "<registry>/<namespace>": [
           {
             "type": "signedBy",
             "keyType": "GPGKeys",
             "keyPath": "<path>/key.gpg"
           }
         ]
       }
     }
   }

   Note

   Typically, the /etc/containers.policy.json file is configured at a level of organization where the same keys are used. For example, <registry>/<namespace> for a public registry, or just a <registry> for a single-company dedicated registry.

3. Pull the image:

   # podman pull <registry>/<namespace>/<image>
   ...
   Storing signatures
   e7d92cdc71feacf90708cb59182d0df1b911f8ae022d29e8e95d75ca6a99776a

   The podman pull command enforces signature presence as configured, no extra options are required.

Procedure

1. Generate a sigstore public/private key pair:

   $ skopeo generate-sigstore-key --output-prefix myKey

   • The public and private keys myKey.pub and myKey.private are generated.

     Note

     The skopeo generate-sigstore-key command is available from RHEL 9.2. Otherwise, you must use the upstream Cosign project to generate public/private key pair:

     • Install the cosign tool:

       $ git clone -b v2.0.0 https://github.com/sigstore/cosign
       $ cd cosign
       $ make ./cosign

     • Generate a public/private key pair:

       $ ./cosign generate-key-pair
       ...
       Private key written to cosign.key
       Public key written to cosign.pub

2. Add the following content to the /etc/containers/registries.d/default.yaml file:

   docker:
       <registry>:
           use-sigstore-attachments: true

   By setting the use-sigstore-attachments option, Podman and Skopeo can read and write the container sigstore signatures together with the image and save them in the same repository as the signed image.

   Note

   You can edit the system-wide registry configuration in the /etc/containers/registries.d/default.yaml file. You can also edit the registry or repository configuration section in any YAML file in the /etc/containers/registries.d directory. All YAML files are read and the filename can be arbitrary. A single scope (default-docker, registry, or namespace) can only exist in one file within the /etc/containers/registries.d directory.

3. Build the container image using Containerfile in the current directory:

   $ podman build -t <registry>/<namespace>/<image>

4. Sign the image and push it to the registry:

   $ podman push --sign-by-sigstore-private-key ./myKey.private <registry>/<namespace>/image>

   The podman push command pushes the <registry>/<namespace>/<image> local image to the remote registry as <registry>/<namespace>/<image>. The --sign-by-sigstore-private-key option adds a sigstore signature using the myKey.private private key to the <registry>/<namespace>/<image> image. The image and the sigstore signature are uploaded to the remote registry.

Procedure

1. Add the following content to the /etc/containers/registries.d/default.yaml file:

   docker:
       <registry>:
           use-sigstore-attachments: true

   By setting the use-sigstore-attachments option, Podman and Skopeo can read and write the container sigstore signatures together with the image and save them in the same repository as the signed image.

   Note

   You can edit the system-wide registry configuration in the /etc/containers/registries.d/default.yaml file. You can also edit the registry or repository configuration section in any YAML file in the /etc/containers/registries.d directory. All YAML files are read and the filename can be arbitrary. A single scope (default-docker, registry, or namespace) can only exist in one file within the /etc/containers/registries.d directory.

2. Edit the /etc/containers/policy.json file to enforce sigstore signature presence:

   ...
   "transports": {
               "docker": {
                   "<registry>/<namespace>": [
                       {
                           "type": "sigstoreSigned",
                           "keyPath": "/some/path/to/cosign.pub"
                       }
                   ]
               }
           }
   ...

   By modifying the /etc/containers/policy.json configuration file, you change the trust policy configuration. Podman, Buildah, and Skopeo enforce the existence of the container image signatures.

3. Pull the image:

   $ podman pull <registry>/<namespace>/<image>

Procedure

1. Add the following content to the /etc/containers/registries.conf.d/default.yaml file:

   docker:
       <registry>:
           use-sigstore-attachments: true

   • By setting the use-sigstore-attachments option, Podman and Skopeo can read and write the container sigstore signatures together with the image and save them in the same repository as the signed image.

     Note

     You can edit the registry or repository configuration section in any YAML file in the /etc/containers/registries.d directory. A single scope (default-docker, registry, or namespace) can only exist in one file within the /etc/containers/registries.d directory. You can also edit the system-wide registry configuration in the /etc/containers/registries.d/default.yaml file. Please note that all YAML files are read and the filename is arbitrary.

2. Create the file.yml file:

   fulcio:
     fulcioURL: "https://<your-fulcio-server>"
     oidcMode: "interactive"
     oidcIssuerURL: "https://<your-OIDC-provider>"
     oidcClientID: "sigstore"
   rekorURL: "https://<your-rekor-server>"

   • The file.yml is the sigstore signing parameter YAML file used to store options required to create sigstore signatures.

3. Sign the image and push it to the registry:

   $ podman push --sign-by-sigstore=file.yml <registry>/<namespace>/<image>

   • You can alternatively use the skopeo copy command with similar --sign-by-sigstore options to sign existing images while moving them across container registries.

Procedure

1. Add the following content to the /etc/containers/registries.conf.d/default.yaml file:

   docker:
       <registry>:
           use-sigstore-attachments: true

   • By setting the use-sigstore-attachments option, Podman and Skopeo can read and write the container sigstore signatures together with the image and save them in the same repository as the signed image.

     Note

     You can edit the registry or repository configuration section in any YAML file in the /etc/containers/registries.d directory. A single scope (default-docker, registry, or namespace) can only exist in one file within the /etc/containers/registries.d directory. You can also edit the system-wide registry configuration in the /etc/containers/registries.d/default.yaml file. Please note that all YAML files are read and the filename is arbitrary.

2. Add the fulcio section and the rekorPublicKeyPath or rekorPublicKeyData fields in the /etc/containers/policy.json file:

   {
       ...
       "transports": {
   	"docker": {
           "<registry>/<namespace>": [
               {
               "type": "sigstoreSigned",
               "fulcio": {
                   "caPath": "/path/to/local/CA/file",
                   "oidcIssuer": "https://expected.OIDC.issuer/",
                   "subjectEmail", "expected-signing-user@example.com",
               },
               "rekorPublicKeyPath": "/path/to/local/public/key/file",
               }
           ]
       ...
   	}
     }
     ...
   }

   • The fulcio section provides that the signature is based on a Fulcio-issued certificate.
   • You have to specify one of caPath and caData fields, containing the CA certificate of the Fulcio instance.
   • Both oidcIssuer and subjectEmail are mandatory, exactly specifying the expected identity provider, and the identity of the user obtaining the Fulcio certificate.
   • You have to specify one of rekorPublicKeyPath and rekorPublicKeyData fields.

3. Pull the image:

   $ podman pull <registry>/<namespace>/<image>

Procedure

1. Generate a sigstore public/private key pair:

   $ skopeo generate-sigstore-key --output-prefix myKey

   • The public and private keys myKey.pub and myKey.private are generated.

2. Add the following content to the /etc/containers/registries.conf.d/default.yaml file:

   docker:
       <registry>:
           use-sigstore-attachments: true

   • By setting the use-sigstore-attachments option, Podman and Skopeo can read and write the container sigstore signatures together with the image and save them in the same repository as the signed image.

     Note

     You can edit the registry or repository configuration section in any YAML file in the /etc/containers/registries.d directory. A single scope (default-docker, registry, or namespace) can only exist in one file within the /etc/containers/registries.d directory. You can also edit the system-wide registry configuration in the /etc/containers/registries.d/default.yaml file. Please note that all YAML files are read and the filename is arbitrary.

3. Build the container image using Containerfile in the current directory:

   $ podman build -t <registry>/<namespace>/<image>

4. Create the file.yml file:

   privateKeyFile: "/home/user/sigstore/myKey.private"
   privateKeyPassphraseFile: "/mnt/user/sigstore-myKey-passphrase"
   rekorURL: "https://<your-rekor-server>"

   • The file.yml is the sigstore signing parameter YAML file used to store options required to create sigstore signatures.

5. Sign the image and push it to the registry:

   $ podman push --sign-by-sigstore=file.yml <registry>/<namespace>/<image>

   • You can alternatively use the skopeo copy command with similar --sign-by-sigstore options to sign existing images while moving them across container registries.

Procedure

1. List all networks:

   # podman network ls
   NETWORK ID    NAME        VERSION     PLUGINS
   2f259bab93aa  podman      0.4.0       bridge,portmap,firewall,tuning
   11c844f95e28  mynet       0.4.0       bridge,portmap,firewall,tuning,dnsname

2. Remove the mynet network:

   # podman network rm mynet
   mynet

Procedure

1. Create an empty pod:

   $ podman pod create --name mypod
   223df6b390b4ea87a090a4b5207f7b9b003187a6960bd37631ae9bc12c433aff
   The pod is in the initial state Created.

   The pod is in the initial state Created.

2. Optional: List all pods:

   $ podman pod ps
   POD ID         NAME    STATUS    CREATED                  # OF CONTAINERS   INFRA ID
   223df6b390b4   mypod   Created   Less than a second ago   1                 3afdcd93de3e

   Notice that the pod has one container in it.

3. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                 COMMAND  CREATED                 STATUS   PORTS  NAMES               POD
   3afdcd93de3e  registry.access.redhat.com/ubi9/pause            Less than a second ago  Created         223df6b390b4-infra  223df6b390b4

   You can see that the pod ID from podman ps command matches the pod ID in the podman pod ps command. The default infra container is based on the registry.access.redhat.com/ubi9/pause image.

4. Run a container named myubi in the existing pod named mypod:

   $ podman run -dt --name myubi --pod mypod registry.access.redhat.com/ubi9/ubi /bin/bash
   5df5c48fea87860cf75822ceab8370548b04c78be9fc156570949013863ccf71

5. Optional: List all pods:

   $ podman pod ps
   POD ID         NAME    STATUS    CREATED                  # OF CONTAINERS   INFRA ID
   223df6b390b4   mypod   Running   Less than a second ago   2                 3afdcd93de3e

   You can see that the pod has two containers in it.

6. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                       COMMAND    CREATED                 STATUS                     PORTS  NAMES               POD
   5df5c48fea87  registry.access.redhat.com/ubi9/ubi:latest  /bin/bash  Less than a second ago  Up Less than a second ago         myubi               223df6b390b4
   3afdcd93de3e  registry.access.redhat.com/ubi9/pause                                   Less than a second ago  Up Less than a second ago         223df6b390b4-infra  223df6b390b4

Procedure

1. Stop the pod mypod:

   $ podman pod stop mypod

2. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                               COMMAND    CREATED             STATUS                    PORTS   NAMES               POD ID        PODNAME
   5df5c48fea87  registry.redhat.io/ubi9/ubi:latest  /bin/bash  About a minute ago  Exited (0) 7 seconds ago          myubi               223df6b390b4  mypod
   
   3afdcd93de3e  registry.access.redhat.com/9/pause                           About a minute ago  Exited (0) 7 seconds ago          8a4e6527ac9d-infra  223df6b390b4  mypod

   You can see that the pod mypod and container myubi are in "Exited" status.

Procedure

1. Remove the pod mypod, type:

   $ podman pod rm mypod
   223df6b390b4ea87a090a4b5207f7b9b003187a6960bd37631ae9bc12c433aff

   Note that removing the pod automatically removes all containers inside it.

2. Optional: Check that all containers and pods were removed:

   $ podman ps
   $ podman pod ps

Procedure

1. Start the container named web-container:

   # podman run -dt --name=web-container docker.io/library/httpd

2. List all containers:

   # podman ps -a
   
   CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES
   b8c057333513  docker.io/library/httpd:latest  httpd-foreground  4 seconds ago  Up 5 seconds ago              web-container

3. Inspect the container and display the IP address:

   # podman inspect --format='{{.NetworkSettings.IPAddress}}' web-container
   
   10.88.0.2

4. Run the myubi container and verify that web server is running:

   # podman run -it --name=myubi ubi9/ubi curl 10.88.0.2:80
   
   <html><body><h1>It works!</h1></body></html>

Procedure

1. Verify that the bridge is configured:

   # podman network inspect podman | grep bridge
   
       "bridge": "cni-podman0",
       "type": "bridge"

2. Display the host network configuration:

   # ip addr show cni-podman0
   
   6: cni-podman0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
       link/ether 62:af:a1:0a:ca:2e brd ff:ff:ff:ff:ff:ff
       inet 10.88.0.1/16 brd 10.88.255.255 scope global cni-podman0
          valid_lft forever preferred_lft forever
       inet6 fe80::60af:a1ff:fe0a:ca2e/64 scope link
          valid_lft forever preferred_lft forever

   You can see that the web-container has an IP of the cni-podman0 network and the network is bridged to the host.

3. Inspect the web-container and display its IP address:

   # podman inspect --format='{{.NetworkSettings.IPAddress}}' web-container
   
   10.88.0.2

4. Access the web-container directly from the host:

   $ curl 10.88.0.2:80
   
   <html><body><h1>It works!</h1></body></html>

Procedure

1. Run the unpublished container:

   # podman run -dt --name=web1 ubi9/httpd-24

2. Run the automatically published container:

   # podman run -dt --name=web2 -P ubi9/httpd-24

3. Run the manually published container and publish container port 80:

   # podman run -dt --name=web3 -p 9090:80 ubi9/httpd-24

4. List all containers:

   # podman ps
   
   CONTAINER ID  IMAGE                                            COMMAND               CREATED         STATUS             PORTS                                             NAMES
   f12fa79b8b39  registry.access.redhat.com/ubi9/httpd-24:latest  /usr/bin/run-http...  23 seconds ago  Up 24 seconds ago                                                    web1
   9024d9e815e2  registry.access.redhat.com/ubi9/httpd-24:latest  /usr/bin/run-http...  13 seconds ago  Up 13 seconds ago  0.0.0.0:43595->8080/tcp, 0.0.0.0:42423->8443/tcp  web2
   03bc2a019f1b  registry.access.redhat.com/ubi9/httpd-24:latest  /usr/bin/run-http...  2 seconds ago   Up 2 seconds ago   0.0.0.0:9090->80/tcp                              web3

   You can see that:

   • Container web1 has no published ports and can be reached only by container network or a bridge.

   • Container web2 has automatically mapped ports 43595 and 42423 to publish the application ports 8080 and 8443, respectively.

     Note

     The automatic port mapping is possible because the registry.access.redhat.com/9/httpd-24 image has the EXPOSE 8080 and EXPOSE 8443 commands in the Containerfile.

   • Container web3 has a manually published port. The host port 9090 is mapped to the container port 80.

5. Display the IP addresses of web1 and web3 containers:

   # podman inspect --format='{{.NetworkSettings.IPAddress}}' web1
   # podman inspect --format='{{.NetworkSettings.IPAddress}}' web3

6. Reach web1 container using <IP>:<port> notation:

   # curl 10.88.0.14:8080
   ...
   <title>Test Page for the HTTP Server on Red Hat Enterprise Linux</title>
   ...

7. Reach web2 container using localhost:<port> notation:

   # curl localhost:43595
   ...
   <title>Test Page for the HTTP Server on Red Hat Enterprise Linux</title>
   ...

8. Reach web3 container using <IP>:<port> notation:

   # curl 10.88.0.14:9090
   ...
   <title>Test Page for the HTTP Server on Red Hat Enterprise Linux</title>
   ...

Procedure

1. Run a receiver container attached to the mynet network:

   # podman run -d --net mynet --name receiver ubi9 sleep 3000

2. Run a sender container and reach the receiver container by its name:

   # podman run -it --rm --net mynet --name sender alpine ping receiver
   
   PING rcv01 (10.89.0.2): 56 data bytes
   64 bytes from 10.89.0.2: seq=0 ttl=42 time=0.041 ms
   64 bytes from 10.89.0.2: seq=1 ttl=42 time=0.125 ms
   64 bytes from 10.89.0.2: seq=2 ttl=42 time=0.109 ms

   Exit using the CTRL+C.

Procedure

1. Create a pod named web-pod:

   $ podman pod create --name=web-pod

2. Run the web container named web-container in the pod:

   $ podman container run -d --pod web-pod --name=web-container docker.io/library/httpd

3. List all pods and containers associated with them:

   $ podman ps --pod
   
   CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES               POD ID        PODNAME
   58653cf0cf09  k8s.gcr.io/pause:3.5                              4 minutes ago  Up 3 minutes ago              4e61a300c194-infra  4e61a300c194  web-pod
   b3f4255afdb3  docker.io/library/httpd:latest  httpd-foreground  3 minutes ago  Up 3 minutes ago              web-container  4e61a300c194  web-pod

4. Run the container in the web-pod based on the docker.io/library/fedora image:

   $ podman container run -it --rm --pod web-pod docker.io/library/fedora curl localhost
   
   <html><body><h1>It works!</h1></body></html>

   You can see that the container can reach the web-container.

Procedure

1. Create a pod named web-pod:

   # podman pod create --name=web-pod-publish -p 80:80

2. List all pods:

   # podman pod ls
   
   POD ID        NAME         STATUS   CREATED        INFRA ID      # OF CONTAINERS
   26fe5de43ab3  publish-pod  Created  5 seconds ago  7de09076d2b3  1

3. Run the web container named web-container inside the web-pod:

   # podman container run -d --pod web-pod-publish --name=web-container docker.io/library/httpd

4. List containers

   # podman ps
   
   CONTAINER ID  IMAGE                    COMMAND           CREATED             STATUS             PORTS               NAMES
   7de09076d2b3  k8s.gcr.io/pause:3.5                       About a minute ago  Up 23 seconds ago  0.0.0.0:80->80/tcp  26fe5de43ab3-infra
   088befb90e59  docker.io/library/httpd  httpd-foreground  23 seconds ago      Up 23 seconds ago  0.0.0.0:80->80/tcp  web-container

5. Verify that the web-container can be reached:

   $ curl localhost:80
   
   <html><body><h1>It works!</h1></body></html>

Procedure

1. Create a network named pod-net:

   # podman network create pod-net
   
   /etc/cni/net.d/pod-net.conflist

2. Create a pod web-pod:

   # podman pod create --net pod-net --name web-pod

3. Run a container named web-container inside the web-pod:

   # podman run -d --pod webt-pod --name=web-container docker.io/library/httpd

4. Optional: Display the pods the containers are associated with:

   # podman ps -p
   
   CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES               POD ID        PODNAME
   b7d6871d018c   registry.access.redhat.com/ubi9/pause:latest                             9 minutes ago  Up 6 minutes ago              a8e7360326ba-infra  a8e7360326ba  web-pod
   645835585e24  docker.io/library/httpd:latest  httpd-foreground  6 minutes ago  Up 6 minutes ago              web-container    a8e7360326ba  web-pod

Procedure

1. Manually run the dhcp plugin:

   # /usr/libexec/cni/dhcp daemon &
   [1] 4966

2. Check that the dhcp plugin is running:

   # ps -a | grep dhcp
   4966 pts/1    00:00:00 dhcp

3. Run the alpine container:

   # podman run -it --rm --network=example alpine ip addr show enp1s0
   Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
   Trying to pull docker.io/library/alpine:latest...
   ...
   Storing signatures
   
   2: eth0@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
       link/ether f6:dd:1b:a7:9b:92 brd ff:ff:ff:ff:ff:ff
       inet 192.168.1.22/24 brd 192.168.1.255 scope global eth0
       ...

   In this example:

   • The --network=example option specifies the network named example to connect.
   • The ip addr show enp1s0 command inside the alpine container checks the IP address of the network interface enp1s0.
   • The host network is 192.168.1.0/24
   • The eth0 interface leases an IP address of 192.168.1.122 for the alpine container.

Procedure

1. Create the socket unit file:

   # cat /usr/lib/systemd/system/io.podman.dhcp.socket
   [Unit]
   Description=DHCP Client for CNI
   
   [Socket]
   ListenStream=%t/cni/dhcp.sock
   SocketMode=0600
   
   [Install]
   WantedBy=sockets.target

2. Create the service unit file:

   # cat /usr/lib/systemd/system/io.podman.dhcp.service
   [Unit]
   Description=DHCP Client CNI Service
   Requires=io.podman.dhcp.socket
   After=io.podman.dhcp.socket
   
   [Service]
   Type=simple
   ExecStart=/usr/libexec/cni/dhcp daemon
   TimeoutStopSec=30
   KillMode=process
   
   
   [Install]
   WantedBy=multi-user.target
   Also=io.podman.dhcp.socket

3. Start the service immediately:

   # systemctl --now enable io.podman.dhcp.socket

Procedure

1. If the /etc/containers/containers.conf file does not exist, copy the /usr/share/containers/containers.conf file to the /etc/containers/ directory:

   # cp /usr/share/containers/containers.conf /etc/containers/

2. Edit the /etc/containers/containers.conf file, and add the following content to the [network] section:

   network_backend="netavark"

3. If you have any containers or pods, reset the storage back to the initial state:

   # podman system reset

4. Reboot the system:

   # reboot

Procedure

1. If the /etc/containers/containers.conf file does not exist, copy the /usr/share/containers/containers.conf file to the /etc/containers/ directory:

   # cp /usr/share/containers/containers.conf /etc/containers/

2. Edit the /etc/containers/containers.conf file, and add the following content to the [network] section:

   network_backend="cni"

3. If you have any containers or pods, reset the storage back to the initial state:

   # podman system reset

4. Reboot the system:

   # reboot

Procedure

1. List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                       COMMAND    CREATED                 STATUS                     PORTS  NAMES               POD
   5df5c48fea87  registry.access.redhat.com/ubi9/ubi:latest  /bin/bash  Less than a second ago  Up Less than a second ago         myubi               223df6b390b4
   3afdcd93de3e  k8s.gcr.io/pause:3.1                                   Less than a second ago  Up Less than a second ago         223df6b390b4-infra  223df6b390b4

2. Use the pod name or ID to generate the Kubernetes YAML file:

   $ podman generate kube mypod > mypod.yaml

   Note that the podman generate command does not reflect any Logical Volume Manager (LVM) logical volumes or physical volumes that might be attached to the container.

3. Display the mypod.yaml file:

   $ cat mypod.yaml
   # Generation of Kubernetes YAML is still under development!
   #
   # Save the output of this file and use kubectl create -f to import
   # it into Kubernetes.
   #
   # Created with podman-1.6.4
   apiVersion: v1
   kind: Pod
   metadata:
     creationTimestamp: "2020-06-09T10:31:56Z"
     labels:
   app: mypod
     name: mypod
   spec:
     containers:
     - command:
           - /bin/bash
           env:
           - name: PATH
                 value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
           - name: TERM
                 value: xterm
           - name: HOSTNAME
           - name: container
                 value: oci
           image: registry.access.redhat.com/ubi9/ubi:latest
           name: myubi
           resources: {}
           securityContext:
                 allowPrivilegeEscalation: true
                 capabilities: {}
                 privileged: false
                 readOnlyRootFilesystem: false
           tty: true
           workingDir: /
   status: {}

Procedure

1. Create the pod and the container from the mypod.yaml file:

   $ podman play kube mypod.yaml
   Pod:
   b8c5b99ba846ccff76c3ef257e5761c2d8a5ca4d7ffa3880531aec79c0dacb22
   Container:
   848179395ebd33dd91d14ffbde7ae273158d9695a081468f487af4e356888ece

2. List all pods:

   $ podman pod ps
   POD ID         NAME    STATUS    CREATED          # OF CONTAINERS   INFRA ID
   b8c5b99ba846   mypod   Running   19 seconds ago   2                 aa4220eaf4bb

3. List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                       COMMAND    CREATED             STATUS                 PORTS  NAMES               POD
   848179395ebd  registry.access.redhat.com/ubi9/ubi:latest  /bin/bash  About a minute ago  Up About a minute ago         myubi               b8c5b99ba846
   aa4220eaf4bb  k8s.gcr.io/pause:3.1                                   About a minute ago  Up About a minute ago         b8c5b99ba846-infra  b8c5b99ba846

   The pod IDs from podman ps command matches the pod ID from the podman pod ps command.

Procedure

1. Display the mariadb-conf/Containerfile file:

   $ cat mariadb-conf/Containerfile
   FROM docker.io/library/mariadb
   COPY my.cnf /etc/mysql/my.cnf

2. Display the mariadb-conf/my.cnf file:

   [client-server]
   # Port or socket location where to connect
   port = 3306
   socket = /run/mysqld/mysqld.sock
   
   # Import all .cnf files from the configuration directory
   [mariadbd]
   skip-host-cache
   skip-name-resolve
   bind-address = 127.0.0.1
   
   !includedir /etc/mysql/mariadb.conf.d/
   !includedir /etc/mysql/conf.d/

3. Build the docker.io/library/mariadb image using mariadb-conf/Containerfile:

   $ cd mariadb-conf
   $ podman build -t mariadb-conf .
   $ cd ..
   STEP 1: FROM docker.io/library/mariadb
   Trying to pull docker.io/library/mariadb:latest...
   Getting image source signatures
   Copying blob 7b1a6ab2e44d done
   ...
   Storing signatures
   STEP 2: COPY my.cnf /etc/mysql/my.cnf
   STEP 3: COMMIT mariadb-conf
   --> ffae584aa6e
   Successfully tagged localhost/mariadb-conf:latest
   ffae584aa6e733ee1cdf89c053337502e1089d1620ff05680b6818a96eec3c17

4. Optional: List all images:

   $ podman images
   LIST IMAGES
   REPOSITORY                                                       TAG         IMAGE ID      CREATED             SIZE
   localhost/mariadb-conf                                           latest      b66fa0fa0ef2  57 seconds ago      416 MB

5. Create the pod named wordpresspod and configure port mappings between the container and the host system:

   $ podman pod create --name wordpresspod -p 8080:80

6. Create the mydb container inside the wordpresspod pod:

   $ podman run --detach --pod wordpresspod \
       -e MYSQL_ROOT_PASSWORD=1234 \
       -e MYSQL_DATABASE=mywpdb \
       -e MYSQL_USER=mywpuser \
       -e MYSQL_PASSWORD=1234 \
       --name mydb localhost/mariadb-conf

7. Create the myweb container inside the wordpresspod pod:

   $ podman run --detach --pod wordpresspod \
       -e WORDPRESS_DB_HOST=127.0.0.1 \
       -e WORDPRESS_DB_NAME=mywpdb \
       -e WORDPRESS_DB_USER=mywpuser \
       -e WORDPRESS_DB_PASSWORD=1234 \
       --name myweb docker.io/wordpress

8. Optional: List all pods and containers associated with them:

   $ podman ps --pod -a
   CONTAINER ID  IMAGE                               COMMAND               CREATED                 STATUS                     PORTS                 NAMES               POD ID        PODNAME
   9ea56f771915  k8s.gcr.io/pause:3.5                                      Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  4b7f054a6f01-infra  4b7f054a6f01  wordpresspod
   60e8dbbabac5  localhost/mariadb-conf:latest       mariadbd              Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  mydb                4b7f054a6f01  wordpresspod
   045d3d506e50  docker.io/library/wordpress:latest  apache2-foregroun...  Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  myweb               4b7f054a6f01  wordpresspod

Procedure

1. List all pods and containers associated with them:

   $ podman ps --pod -a
   CONTAINER ID  IMAGE                               COMMAND               CREATED                 STATUS                     PORTS                 NAMES               POD ID        PODNAME
   9ea56f771915  k8s.gcr.io/pause:3.5                                      Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  4b7f054a6f01-infra  4b7f054a6f01  wordpresspod
   60e8dbbabac5  localhost/mariadb-conf:latest       mariadbd              Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  mydb                4b7f054a6f01  wordpresspod
   045d3d506e50  docker.io/library/wordpress:latest  apache2-foregroun...  Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  myweb               4b7f054a6f01  wordpresspod

2. Use the pod name or ID to generate the Kubernetes YAML file:

   $ podman generate kube wordpresspod >> wordpresspod.yaml

1. a directory with the same name as the image used in YAML file exists
2. that directory contains a Containerfile

Procedure

1. Create the wordpress pod using the wordpress.yaml file:

   $ podman play kube wordpress.yaml
   STEP 1/2: FROM docker.io/library/mariadb
   STEP 2/2: COPY my.cnf /etc/mysql/my.cnf
   COMMIT localhost/mariadb-conf:latest
   --> 428832c45d0
   Successfully tagged localhost/mariadb-conf:latest
   428832c45d07d78bb9cb34e0296a7dc205026c2fe4d636c54912c3d6bab7f399
   Trying to pull docker.io/library/wordpress:latest...
   Getting image source signatures
   Copying blob 99c3c1c4d556 done
   ...
   Storing signatures
   Pod:
   3e391d091d190756e655219a34de55583eed3ef59470aadd214c1fc48cae92ac
   Containers:
   6c59ebe968467d7fdb961c74a175c88cb5257fed7fb3d375c002899ea855ae1f
   29717878452ff56299531f79832723d3a620a403f4a996090ea987233df0bc3d

   The podman play kube command:

   • Automatically build the localhost/mariadb-conf:latest image based on docker.io/library/mariadb image.
   • Pull the docker.io/library/wordpress:latest image.
   • Create a pod named wordpresspod with two containers named wordpresspod-mydb and wordpresspod-myweb.

2. List all containers and pods:

   $ podman ps --pod -a
   CONTAINER ID  IMAGE                               COMMAND               CREATED        STATUS                    PORTS                 NAMES               POD ID        PODNAME
   a1dbf7b5606c  k8s.gcr.io/pause:3.5                                      3 minutes ago  Up 2 minutes ago          0.0.0.0:8080->80/tcp  3e391d091d19-infra  3e391d091d19  wordpresspod
   6c59ebe96846  localhost/mariadb-conf:latest       mariadbd              2 minutes ago  Exited (1) 2 minutes ago  0.0.0.0:8080->80/tcp  wordpresspod-mydb   3e391d091d19  wordpresspod
   29717878452f  docker.io/library/wordpress:latest  apache2-foregroun...  2 minutes ago  Up 2 minutes ago          0.0.0.0:8080->80/tcp  wordpresspod-myweb  3e391d091d19  wordpresspod

Procedure

1. Create the mysleep.container unit file:

   $ cat $HOME/.config/containers/systemd/mysleep.container
   [Unit]
   Description=The sleep container
   After=local-fs.target
   
   [Container]
   Image=registry.access.redhat.com/ubi9-minimal:latest
   Exec=sleep 1000
   
   [Install]
   # Start by default on boot
   WantedBy=multi-user.target default.target

   In the [Container] section you must specify:

   • Image - container mage you want to tun

   • Exec - the command you want to run inside the container

     This enables you to use all other fields specified in a systemd unit file.

2. Create the mysleep.service based on the mysleep.container file:

   $ systemctl --user daemon-reload

3. Optional: Check the status of the mysleep.service:

   $ systemctl --user status mysleep.service
   ○ mysleep.service - The sleep container
   	 Loaded: loaded (/home/username/.config/containers/systemd/mysleep.container; generated)
   	 Active: inactive (dead)

4. Start the mysleep.service:

   $ systemctl --user start mysleep.service

Verification

1. Check the status of the mysleep.service:

   $ systemctl --user status mysleep.service
   ● mysleep.service - The sleep container
   	 Loaded: loaded (/home/username/.config/containers/systemd/mysleep.container; generated)
   	 Active: active (running) since Thu 2023-02-09 18:07:23 EST; 2s ago
      Main PID: 265651 (conmon)
         Tasks: 3 (limit: 76815)
   	 Memory: 1.6M
      	 CPU: 94ms
   	 CGroup: ...

2. List all containers:

   $ podman ps -a
   CONTAINER ID  IMAGE                            COMMAND               CREATED            STATUS                          PORTS   NAMES
   421c8293fc1b  registry.access.redhat.com/ubi9-minimal:latest               sleep 1000  30 seconds ago   Up 10 seconds ago systemd-mysleep

   Note that the name of the created container consists of the following elements:

   • a systemd- prefix

   • a name of the systemd unit, that is systemd-mysleep

     This naming helps to distinguish common containers from containers running in systemd units. It also helps to determine which unit a container runs in. If you want to change the name of the container, use the ContainerName field in the [Container] section.

Procedure

1. Reload systemd manager configuration:

   # systemctl --user daemon-reload

2. Enable the service container.service and start it at boot time:

   # systemctl --user enable container.service

3. Start the service immediately:

   # systemctl --user start container.service

4. Check the status of the service:

   $ systemctl --user status container.service
   ● container.service - Podman container.service
      Loaded: loaded (/home/user/.config/systemd/user/container.service; enabled; vendor preset: enabled)
      Active: active (running) since Wed 2020-09-16 11:56:57 CEST; 8s ago
        Docs: man:podman-generate-systemd(1)
     Process: 80602 ExecStart=/usr/bin/podman run --conmon-pidfile //run/user/1000/container.service-pid --cidfile //run/user/1000/container.service-cid -d ubi9-minimal:>
     Process: 80601 ExecStartPre=/usr/bin/rm -f //run/user/1000/container.service-pid //run/user/1000/container.service-cid (code=exited, status=0/SUCCESS)
    Main PID: 80617 (conmon)
      CGroup: /user.slice/user-1000.slice/user@1000.service/container.service
              ├─ 2870 /usr/bin/podman
              ├─80612 /usr/bin/slirp4netns --disable-host-loopback --mtu 65520 --enable-sandbox --enable-seccomp -c -e 3 -r 4 --netns-type=path /run/user/1000/netns/cni->
              ├─80614 /usr/bin/fuse-overlayfs -o lowerdir=/home/user/.local/share/containers/storage/overlay/l/YJSPGXM2OCDZPLMLXJOW3NRF6Q:/home/user/.local/share/contain>
              ├─80617 /usr/bin/conmon --api-version 1 -c cbc75d6031508dfd3d78a74a03e4ace1732b51223e72a2ce4aa3bfe10a78e4fa -u cbc75d6031508dfd3d78a74a03e4ace1732b51223e72>
              └─cbc75d6031508dfd3d78a74a03e4ace1732b51223e72a2ce4aa3bfe10a78e4fa
                └─80626 /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 1d

   You can check if the service is enabled using the systemctl is-enabled container.service command.

Procedure

1. Create a container (for example myubi):

   $ podman create --name myubi registry.access.redhat.com/ubi9:latest sleep infinity
   0280afe98bb75a5c5e713b28de4b7c5cb49f156f1cce4a208f13fee2f75cb453

2. Use the container name or ID to generate the systemd unit file and direct it into the ~/.config/systemd/user/container-myubi.service file:

   $ podman generate systemd --name myubi > ~/.config/systemd/user/container-myubi.service

Procedure

1. Pull the image you want to use on your system. For example, to pull the httpd-24 image:

   # podman pull registry.access.redhat.com/ubi9/httpd-24

2. Optional: List all images available on your system:

   # podman images
   REPOSITORY                                TAG                  IMAGE ID      CREATED        SIZE
   registry.access.redhat.com/ubi9/httpd-24  latest               8594be0a0b57  2 weeks ago    462 MB

3. Create the httpd container:

   # podman create --name httpd -p 8080:8080 registry.access.redhat.com/ubi9/httpd-24
   cdb9f981cf143021b1679599d860026b13a77187f75e46cc0eac85293710a4b1

4. Optional: Verify the container has been created:

   # podman ps -a
   CONTAINER ID  IMAGE                                            COMMAND               CREATED        STATUS      PORTS                   NAMES
   cdb9f981cf14  registry.access.redhat.com/ubi9/httpd-24:latest  /usr/bin/run-http...  5 minutes ago  Created     0.0.0.0:8080->8080/tcp  httpd

5. Generate a systemd unit file for the httpd container:

   # podman generate systemd --new --files --name httpd
   /root/container-httpd.service

6. Display the content of the generated container-httpd.service systemd unit file:

   # cat /root/container-httpd.service
   # container-httpd.service
   # autogenerated by Podman 3.3.1
   # Wed Sep  8 20:41:44 CEST 2021
   
   [Unit]
   Description=Podman container-httpd.service
   Documentation=man:podman-generate-systemd(1)
   Wants=network-online.target
   After=network-online.target
   RequiresMountsFor=%t/containers
   
   [Service]
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Restart=on-failure
   TimeoutStopSec=70
   ExecStartPre=/bin/rm -f %t/%n.ctr-id
   ExecStart=/usr/bin/podman run --cidfile=%t/%n.ctr-id --sdnotify=conmon --cgroups=no-conmon --rm -d --replace --name httpd -p 8080:8080 registry.access.redhat.com/ubi9/httpd-24
   ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
   ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
   Type=notify
   NotifyAccess=all
   
   [Install]
   WantedBy=multi-user.target default.target

Procedure

1. Create an empty pod, for example named systemd-pod:

   $ podman pod create --name systemd-pod
   11d4646ba41b1fffa51c108cbdf97cfab3213f7bd9b3e1ca52fe81b90fed5577

2. Optional: List all pods:

   $ podman pod ps
   POD ID        NAME         STATUS   CREATED         # OF CONTAINERS  INFRA ID
   11d4646ba41b  systemd-pod  Created  40 seconds ago  1                8a428b257111
   11d4646ba41b1fffa51c108cbdf97cfab3213f7bd9b3e1ca52fe81b90fed5577

3. Create two containers in the empty pod. For example, to create container0 and container1 in systemd-pod:

   $ podman create --pod systemd-pod --name container0 registry.access.redhat.com/ubi9 top
   $ podman create --pod systemd-pod --name container1 registry.access.redhat.com/ubi9 top

4. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                   COMMAND  CREATED        STATUS         PORTS   NAMES               POD ID        PODNAME
   24666f47d9b2  registry.access.redhat.com/ubi9:latest  top      3 minutes ago  Created                container0          3130f724e229  systemd-pod
   56eb1bf0cdfe  k8s.gcr.io/pause:3.2                             4 minutes ago  Created                3130f724e229-infra  3130f724e229  systemd-pod
   62118d170e43  registry.access.redhat.com/ubi9:latest  top      3 seconds ago  Created                container1          3130f724e229  systemd-pod

5. Generate the systemd unit file for the new pod:

   $ podman generate systemd --files --name systemd-pod
   /home/user1/pod-systemd-pod.service
   /home/user1/container-container0.service
   /home/user1/container-container1.service

   Note that three systemd unit files are generated, one for the systemd-pod pod and two for the containers container0 and container1.

6. Display pod-systemd-pod.service unit file:

   $ cat pod-systemd-pod.service
   # pod-systemd-pod.service
   # autogenerated by Podman 3.3.1
   # Wed Sep  8 20:49:17 CEST 2021
   
   [Unit]
   Description=Podman pod-systemd-pod.service
   Documentation=man:podman-generate-systemd(1)
   Wants=network-online.target
   After=network-online.target
   RequiresMountsFor=
   Requires=container-container0.service container-container1.service
   Before=container-container0.service container-container1.service
   
   [Service]
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Restart=on-failure
   TimeoutStopSec=70
   ExecStart=/usr/bin/podman start bcb128965b8e-infra
   ExecStop=/usr/bin/podman stop -t 10 bcb128965b8e-infra
   ExecStopPost=/usr/bin/podman stop -t 10 bcb128965b8e-infra
   PIDFile=/run/user/1000/containers/overlay-containers/1dfdcf20e35043939ea3f80f002c65c00d560e47223685dbc3230e26fe001b29/userdata/conmon.pid
   Type=forking
   
   [Install]
   WantedBy=multi-user.target default.target

   • The Requires line in the [Unit] section defines dependencies on container-container0.service and container-container1.service unit files. Both unit files will be activated.
   • The ExecStart and ExecStop lines in the [Service] section start and stop the infra-container, respectively.

7. Display container-container0.service unit file:

   $ cat container-container0.service
   # container-container0.service
   # autogenerated by Podman 3.3.1
   # Wed Sep  8 20:49:17 CEST 2021
   
   [Unit]
   Description=Podman container-container0.service
   Documentation=man:podman-generate-systemd(1)
   Wants=network-online.target
   After=network-online.target
   RequiresMountsFor=/run/user/1000/containers
   BindsTo=pod-systemd-pod.service
   After=pod-systemd-pod.service
   
   [Service]
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Restart=on-failure
   TimeoutStopSec=70
   ExecStart=/usr/bin/podman start container0
   ExecStop=/usr/bin/podman stop -t 10 container0
   ExecStopPost=/usr/bin/podman stop -t 10 container0
   PIDFile=/run/user/1000/containers/overlay-containers/4bccd7c8616ae5909b05317df4066fa90a64a067375af5996fdef9152f6d51f5/userdata/conmon.pid
   Type=forking
   
   [Install]
   WantedBy=multi-user.target default.target

   • The BindsTo line line in the [Unit] section defines the dependency on the pod-systemd-pod.service unit file
   • The ExecStart and ExecStop lines in the [Service] section start and stop the container0 respectively.

8. Display container-container1.service unit file:

   $ cat container-container1.service

9. Copy all the generated files to $HOME/.config/systemd/user for installing as a non-root user:

   $ cp pod-systemd-pod.service container-container0.service container-container1.service $HOME/.config/systemd/user

10. Enable the service and start at user login:

    $ systemctl enable --user pod-systemd-pod.service
    Created symlink /home/user1/.config/systemd/user/multi-user.target.wants/pod-systemd-pod.service → /home/user1/.config/systemd/user/pod-systemd-pod.service.
    Created symlink /home/user1/.config/systemd/user/default.target.wants/pod-systemd-pod.service → /home/user1/.config/systemd/user/pod-systemd-pod.service.

    Note that the service stops at user logout.

Procedure

1. Start a myubi container based on the registry.access.redhat.com/ubi9/ubi-init image:

   # podman run --label "io.containers.autoupdate=image" \
   --name myubi -dt registry.access.redhat.com/ubi9/ubi-init top
   bc219740a210455fa27deacc96d50a9e20516492f1417507c13ce1533dbdcd9d

2. Optional: List containers that are running or have exited:

   # podman ps -a
   CONTAINER ID  IMAGE                                            COMMAND  CREATED         STATUS             PORTS   NAMES
   76465a5e2933  registry.access.redhat.com/9/ubi-init:latest  top      24 seconds ago  Up 23 seconds ago          myubi

3. Generate a systemd unit file for the myubi container:

   # podman generate systemd --new --files --name myubi /root/container-myubi.service

4. Copy unit files to /usr/lib/systemd/system for installing it as a root user:

   # cp -Z ~/container-myubi.service /usr/lib/systemd/system

5. Reload systemd manager configuration:

   # systemctl daemon-reload

6. Start and check the status of a container:

   # systemctl start container-myubi.service
   # systemctl status container-myubi.service

7. Auto-update the container:

   # podman auto-update

Procedure

1. Display the podman-auto-update.service unit file:

   # cat /usr/lib/systemd/system/podman-auto-update.service
   
   [Unit]
   Description=Podman auto-update service
   Documentation=man:podman-auto-update(1)
   Wants=network.target
   After=network-online.target
   
   [Service]
   Type=oneshot
   ExecStart=/usr/bin/podman auto-update
   
   [Install]
   WantedBy=multi-user.target default.target

2. Display the podman-auto-update.timer unit file:

   # cat /usr/lib/systemd/system/podman-auto-update.timer
   
   [Unit]
   Description=Podman auto-update timer
   
   [Timer]
   OnCalendar=daily
   Persistent=true
   
   [Install]
   WantedBy=timers.target

   In this example, the podman auto-update command is launched daily at midnight.

3. Enable the podman-auto-update.timer service at system start:

   # systemctl enable podman-auto-update.timer

4. Start the systemd service:

   # systemctl start podman-auto-update.timer

5. Optional: List all timers:

   # systemctl list-timers --all
   NEXT                         LEFT      LAST                         PASSED       UNIT                         ACTIVATES
   Wed 2020-12-09 00:00:00 CET  9h left   n/a                          n/a          podman-auto-update.timer     podman-auto-update.service

   You can see that podman-auto-update.timer activates the podman-auto-update.service.

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   - name: Configure Podman
     hosts: managed-node-01.example.com
     tasks:
       - name: Create a web application and a database
         ansible.builtin.include_role:
           name: rhel-system-roles.podman
         vars:
           podman_create_host_directories: true
           podman_firewall:
             - port: 8080-8081/tcp
               state: enabled
             - port: 12340/tcp
               state: enabled
           podman_selinux_ports:
             - ports: 8080-8081
               setype: http_port_t
           podman_kube_specs:
             - state: started
               run_as_user: dbuser
               run_as_group: dbgroup
               kube_file_content:
                 apiVersion: v1
                 kind: Pod
                 metadata:
                   name: db
                 spec:
                   containers:
                     - name: db
                       image:  quay.io/linux-system-roles/mysql:5.6
                       ports:
                         - containerPort: 1234
                           hostPort: 12340
                       volumeMounts:
                         - mountPath: /var/lib/db:Z
                           name: db
                   volumes:
                     - name: db
                       hostPath:
                         path: /var/lib/db
             - state: started
               run_as_user: webapp
               run_as_group: webapp
               kube_file_src: /path/to/webapp.yml

   The settings specified in the example playbook include the following:

   run_as_user and run_as_group

   Specify that containers are rootless.

   kube_file_content

   Contains a Kubernetes YAML file defining the first container named db. You can generate the Kubernetes YAML file using the podman kube generate command.

   • The db container is based on the quay.io/db/db:stable container image.
   • The db bind mount maps the /var/lib/db directory on the host to the /var/lib/db directory in the container. The Z flag labels the content with a private unshared label, therefore, only the db container can access the content.

   kube_file_src: <path>

   Defines the second container. The content of the /path/to/webapp.yml file on the controller node will be copied to the kube_file field on the managed node.

   volumes: <list>

   A YAML list to define the source of the data to provide in one or more containers. For example, a local disk on the host (hostPath) or other disk device.

   volumeMounts: <list>

   A YAML list to define the destination where the individual container will mount a given volume.

   podman_create_host_directories: true

   Creates the directory on the host. This instructs the role to check the kube specification for hostPath volumes and create those directories on the host. If you need more control over the ownership and permissions, use podman_host_directories.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.podman/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check --ask-vault-pass ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook --ask-vault-pass ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   - name: Configure Podman
     hosts: managed-node-01.example.com
     tasks:
       - name: Start Apache server on port 8080
         ansible.builtin.include_role:
           name: rhel-system-roles.podman
     vars:
       podman_firewall:
         - port: 8080/tcp
           state: enabled
       podman_kube_specs:
         - state: started
           kube_file_content:
             apiVersion: v1
             kind: Pod
             metadata:
               name: ubi8-httpd
             spec:
               containers:
                 - name: ubi8-httpd
                   image: registry.access.redhat.com/ubi8/httpd-24
                   ports:
                     - containerPort: 8080
                       hostPort: 8080
                   volumeMounts:
                     - mountPath: /var/www/html:Z
                       name: ubi8-html
               volumes:
                 - name: ubi8-html
                   persistentVolumeClaim:
                     claimName: ubi8-html-volume

   The settings specified in the example playbook include the following:

   kube_file_content

   Contains a Kubernetes YAML file defining the first container named db. You can generate the Kubernetes YAML file using the podman kube generate command.

   • The ubi8-httpd container is based on the registry.access.redhat.com/ubi8/httpd-24 container image.
   • The ubi8-html-volume maps the /var/www/html directory on the host to the container. The Z flag labels the content with a private unshared label, therefore, only the ubi8-httpd container can access the content.
   • The pod mounts the existing persistent volume named ubi8-html-volume with the mount path /var/www/html.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.podman/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Display the contents of the certificate and private key files:

   $ cat ~/certificate.pem
   -----BEGIN CERTIFICATE-----
   ...
   -----END CERTIFICATE-----
   
   $ cat ~/key.pem
   -----BEGIN PRIVATE KEY-----
   ...
   -----END PRIVATE KEY-----

   You require this information in a later step.

2. Store your sensitive variables in an encrypted file:

   1. Create the vault:

      $ ansible-vault create vault.yml
      New Vault password: <vault_password>
      Confirm New Vault password: <vault_password>

   2. After the ansible-vault create command opens an editor, enter the sensitive data in the <key>: <value> format:

      root_password: <root_password>
      certificate: |-
        -----BEGIN CERTIFICATE-----
        ...
        -----END CERTIFICATE-----
      key: |-
        -----BEGIN PRIVATE KEY-----
        ...
        -----END PRIVATE KEY-----

      Ensure that all lines in the certificate and key variables start with two spaces.

   3. Save the changes, and close the editor. Ansible encrypts the data in the vault.

3. Create a playbook file, for example ~/playbook.yml, with the following content:

   - name: Deploy a wordpress CMS with MySQL database
     hosts: managed-node-01.example.com
     vars_files:
       - vault.yml
     tasks:
     - name: Create and run the container
       ansible.builtin.include_role:
         name: rhel-system-roles.podman
       vars:
         podman_create_host_directories: true
         podman_activate_systemd_unit: false
         podman_quadlet_specs:
           - name: quadlet-demo
             type: network
             file_content: |
               [Network]
               Subnet=192.168.30.0/24
               Gateway=192.168.30.1
               Label=app=wordpress
           - file_src: quadlet-demo-mysql.volume
           - template_src: quadlet-demo-mysql.container.j2
           - file_src: envoy-proxy-configmap.yml
           - file_src: quadlet-demo.yml
           - file_src: quadlet-demo.kube
             activate_systemd_unit: true
         podman_firewall:
           - port: 8000/tcp
             state: enabled
           - port: 9000/tcp
             state: enabled
         podman_secrets:
           - name: mysql-root-password-container
             state: present
             skip_existing: true
             data: "{{ root_password }}"
           - name: mysql-root-password-kube
             state: present
             skip_existing: true
             data: |
               apiVersion: v1
               data:
                 password: "{{ root_password | b64encode }}"
               kind: Secret
               metadata:
                 name: mysql-root-password-kube
           - name: envoy-certificates
             state: present
             skip_existing: true
             data: |
               apiVersion: v1
               data:
                 certificate.key: {{ key | b64encode }}
                 certificate.pem: {{ certificate | b64encode }}
               kind: Secret
               metadata:
                 name: envoy-certificates

   The procedure creates a WordPress content management system paired with a MySQL database. The podman_quadlet_specs role variable defines a set of configurations for the Quadlet, which refers to a group of containers or services that work together in a certain way. It includes the following specifications:

   • The Wordpress network is defined by the quadlet-demo network unit.
   • The volume configuration for MySQL container is defined by the file_src: quadlet-demo-mysql.volume field.
   • The template_src: quadlet-demo-mysql.container.j2 field is used to generate a configuration for the MySQL container.
   • Two YAML files follow: file_src: envoy-proxy-configmap.yml and file_src: quadlet-demo.yml. Note that .yml is not a valid Quadlet unit type, therefore these files will just be copied and not processed as a Quadlet specification.
   • The Wordpress and envoy proxy containers and configuration are defined by the file_src: quadlet-demo.kube field. The kube unit refers to the previous YAML files in the [Kube] section as Yaml=quadlet-demo.yml and ConfigMap=envoy-proxy-configmap.yml.

4. Validate the playbook syntax:

   $ ansible-playbook --syntax-check --ask-vault-pass ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

5. Run the playbook:

   $ ansible-playbook --ask-vault-pass ~/playbook.yml

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Podman containers in the main menu.
3. In the Images table, click the overflow menu in the upper-right corner and select Download new image.
4. The Search for an image dialog box appears.
5. In the Search for field, enter the name of the image or specify its description.
6. In the in drop-down list, select the registry from which you want to pull the image.
7. Optional: In the Tag field, enter the tag of the image.
8. Click Download.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Podman containers in the main menu.
3. In the Images table, click the overflow menu in the upper-right corner and select Prune unused images.
4. The pop-up window with the list of images appears. Click Prune to confirm your choice.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Podman containers in the main menu.
3. In the Images table, select the image you want to delete and click the overflow menu and select Delete.
4. The window appears. Click Delete tagged images to confirm your choice.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Podman containers in the main menu.
3. Click Create container.
4. In the Name field, enter the name of your container.

5. Provide desired info in the Details tab.

   • Available only with the administrative access: Select the Owner of the container: System or User.

   • In the Image drop down list select or search the container image in selected registries.

     • Optional: Check the Pull latest image checkbox to pull the latest container image.

   • The Command field specifies the command. You can change the default command if you need.

     • Optional: Check the With terminal checkbox to run your container with a terminal.
   • The Memory limit field specifies the memory limit for the container. To change the default memory limit, check the checkbox and specify the limit.
   • Available only for system containers: In the CPU shares field, specify the relative amount of CPU time. Default value is 1024. Check the checkbox to modify the default value.

   • Available only for system containers: In the Restart policy drop down menu, select one of the following options:

     • No (default value): No action.
     • On Failure: Restarts a container on failure.
     • Always: Restarts a container when exits or after rebooting the system.

6. Provide the required information in the Integration tab.

   • Click Add port mapping to add port mapping between the container and host system.

     • Enter the IP address, Host port, Container port and Protocol.

   • Click Add volume to add volume.

     • Enter the host path, Container path. You can check the Writable option checkbox to create a writable volume. In the SELinux drop down list, select one of the following options: No Label, Shared or Private.

   • Click Add variable to add environment variable.

     • Enter the Key and Value.

7. Provide the required information in the Health check tab.

   • In the Command fields, enter the 'healthcheck' command.

   • Specify the healthcheck options:

     • Interval (default is 30 seconds)
     • Timeout (default is 30 seconds)
     • Start period
     • Retries (default is 3)

     • When unhealthy: Select one of the following options:

       • No action (default): Take no action.
       • Restart: Restart the container.
       • Stop: Stop the container.
       • Force stop: Force stops the container, it does not wait for the container to exit.
8. Click Create and run to create and run the container.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Podman containers in the main menu.

3. In the Containers table, select the container you want to modify and click the overflow menu and select the action you want to perform:

   • Start
   • Stop
   • Force stop
   • Restart
   • Force restart
   • Pause
   • Rename

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Podman containers in the main menu.
3. In the Containers table, select the container you want to modify and click the overflow menu and select Commit.

4. In the Commit container form, add the following details:

   • In the New image name field, enter the image name.
   • Optional: In the Tag field, enter the tag.
   • Optional: In the Author field, enter your name.
   • Optional: In the Command field, change command if you need.

   • Optional: Check the Options you need:

     • Pause container when creating image: The container and its processes are paused while the image is committed.
     • Use legacy Docker format: if you do not use the Docker image format, the OCI format is used.
5. Click Commit.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Podman containers in the main menu.
3. In the Containers table, select the container you want to modify and click the overflow icon menu and select Checkpoint.

4. Optional: In the Checkpoint container form, check the options you need:

   • Keep all temporary checkpoint files: keep all temporary log and statistics files created by CRIU during checkpointing. These files are not deleted if checkpointing fails for further debugging.
   • Leave running after writing checkpoint to disk: leave the container running after checkpointing instead of stopping it.
   • Support preserving established TCP connections
5. Click Checkpoint.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Podman containers in the main menu.
3. In the Containers table, select the container you want to modify and click the overflow menu and select Restore.

4. Optional: In the Restore container form, check the options you need:

   • Keep all temporary checkpoint files: Keep all temporary log and statistics files created by CRIU during checkpointing. These files are not deleted if checkpointing fails for further debugging.
   • Restore with established TCP connections
   • Ignore IP address if set statically: If the container was started with IP address the restored container also tries to use that IP address and restore fails if that IP address is already in use. This option is applicable if you added port mapping in the Integration tab when you create the container.
   • Ignore MAC address if set statically: If the container was started with MAC address the restored container also tries to use that MAC address and restore fails if that MAC address is already in use.
5. Click Restore.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Podman containers in the main menu.
3. In the Containers table, select the container you want to delete and click the overflow menu and select Delete.
4. The pop-up window appears. Click Delete to confirm your choice.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Podman containers in the main menu.
3. Click Create pod.

4. Provide desired information in the Create pod form:

   • Available only with the administrative access: Select the Owner of the container: System or User.
   • In the Name field, enter the name of your container.

   • Click Add port mapping to add port mapping between container and host system.

     • Enter the IP address, Host port, Container port and Protocol.

   • Click Add volume to add volume.

     • Enter the host path, Container path. You can check the Writable checkbox to create a writable volume. In the SELinux drop down list, select one of the following options: No Label, Shared or Private.
5. Click Create.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Podman containers in the main menu.
3. Click Create container in pod.
4. In the Name field, enter the name of your container.

5. Provide the required information in the Details tab.

   • Available only with the administrative access: Select the Owner of the container: System or User.

   • In the Image drop down list select or search the container image in selected registries.

     • Optional: Check the Pull latest image checkbox to pull the latest container image.

   • The Command field specifies the command. You can change the default command if you need.

     • Optional: Check the With terminal checkbox to run your container with a terminal.
   • The Memory limit field specifies the memory limit for the container. To change the default memory limit, check the checkbox and specify the limit.
   • Available only for system containers: In the CPU shares field, specify the relative amount of CPU time. Default value is 1024. Check the checkbox to modify the default value.

   • Available only for system containers: In the Restart policy drop down menu, select one of the following options:

     • No (default value): No action.
     • On Failure: Restarts a container on failure.
     • Always: Restarts container when exits or after system boot.

6. Provide the required information in the Integration tab.

   • Click Add port mapping to add port mapping between the container and host system.

     • Enter the IP address, Host port, Container port and Protocol.

   • Click Add volume to add volume.

     • Enter the host path, Container path. You can check the Writable option checkbox to create a writable volume. In the SELinux drop down list, select one of the following options: No Label, Shared, or Private.

   • Click Add variable to add environment variable.

     • Enter the Key and Value.

7. Provide the required information in the Health check tab.

   • In the Command fields, enter the healthcheck command.

   • Specify the healthcheck options:

     • Interval (default is 30 seconds)
     • Timeout (default is 30 seconds)
     • Start period
     • Retries (default is 3)

     • When unhealthy: Select one of the following options:

       • No action (default): Take no action.
       • Restart: Restart the container.
       • Stop: Stop the container.
       • Force stop: Force stops the container, it does not wait for the container to exit.