Building, running, and managing containers

Procedure

1. Install RHEL.

2. Register RHEL: Enter your user name and password. The user name and password are the same as your login credentials for Red Hat Customer Portal:

   # subscription-manager register
   Registering to: subscription.rhsm.redhat.com:443/subscription
   Username: <username>
   Password: <password>

3. Install the container-tools meta-package:

   # dnf install container-tools

   You can also install podman, buildah, and skopeo individually if you prefer.

4. Optional: Install the podman-docker package:

   # dnf install podman-docker

   The podman-docker package replaces the Docker command-line interface and docker-api with the matching Podman commands instead.

Procedure

1. Open a terminal, and enable the RHEL extensions repository:

   # subscription-manager repos --enable rhel-10-for-$(arch)-extensions-rpms

2. Enter your password when prompted.

3. Install Podman Desktop:

   # dnf install podman-desktop

4. Enter y to confirm the installed size.
5. Enter y to import the GPG key and complete the installation.

Verification

1. Enter Podman Desktop in the search box at the top of your home screen, and click the Podman Desktop application to open it.
2. Follow the prompts to complete a quick onboarding process with the application.

Procedure

1. Authenticate to the registry:

   # podman login quay.io

2. Search for the image:

   • To search for a particular image on a specific registry, enter:

     # podman search quay.io/postgresql-10
     INDEX       NAME                                           DESCRIPTION           STARS   OFFICIAL   AUTOMATED
     redhat.io   registry.redhat.io/rhel10/postgresql-10         This container image ...  0
     redhat.io   registry.redhat.io/rhscl/postgresql-10-rhel7   PostgreSQL is an  ...     0

   • Alternatively, to display all images provided by a particular registry, enter:

     # podman search quay.io/*

   • To search for the image name in all registries, enter:

     # podman search postgresql-10

     To display the full descriptions, pass the --no-trunc option to the command.

     For more information, see the podman-search(1) man page on your system.

Procedure

1. Log in to the registry.redhat.io registry:

   $ podman login registry.redhat.io
   Username: <username>
   Password: <password>
   Login Succeeded!

2. Pull the registry.redhat.io/ubi10/ubi container image:

   $ podman pull registry.redhat.io/ubi10/ubi

Procedure

1. Create the /var/lib/images/nginx directory:

   $ mkdir -p /var/lib/images/nginx

2. Copy the layers of the docker://docker.io/nginx:latest image to the newly created directory:

   $ skopeo copy docker://docker.io/nginx:latest dir:/var/lib/images/nginx

Procedure

1. List all images:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED      SIZE
   registry.redhat.io/ubi10/ubi          latest  3269c37eae33  7 weeks ago  208 MB

2. Assign the myubi name to the registry.redhat.io/ubi10/ubi image using one of the following options:

   • The image name:

     $ podman tag registry.redhat.io/ubi10/ubi myubi

   • The image ID:

     $ podman tag 3269c37eae33 myubi

     Both commands give you the same result.

3. List all images:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED       SIZE
   registry.redhat.io/ubi10/ubi          latest  3269c37eae33  2 months ago  208 MB
   localhost/myubi                      latest  3269c37eae33  2 months ago  208 MB

   Notice that the default tag is latest for both images. You can see all the image names are assigned to the single image ID 3269c37eae33.

4. Add the 10 tag to the registry.redhat.io/ubi10/ubi image using either:

   • The image name:

     $ podman tag registry.redhat.io/ubi10/ubi myubi:10

   • The image ID:

     $ podman tag 3269c37eae33 myubi:10

     Both commands give you the same result.

Verification

1. List all images:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED       SIZE
   registry.redhat.io/ubi10/ubi          latest  3269c37eae33  2 months ago  208 MB
   localhost/myubi                      latest  3269c37eae33  2 months ago  208 MB
   localhost/myubi                      10     3269c37eae33  2 months ago  208 MB

   Notice that the default tag is latest for both images. You can see all the image names are assigned to the single image ID 3269c37eae33.

2. After tagging the registry.redhat.io/ubi10/ubi image, you have three options to run the container:

   • by ID (3269c37eae33)
   • by name (localhost/myubi:latest)

   • by name (localhost/myubi:10)

     For more information, see podman-tag(1) man page on your system.

Procedure

1. Create Containerfiles for each architecture you want to support.

2. Build images for each architecture. For example:

   $ podman build --platform linux/arm64,linux/amd64 --manifest <registry>/<image> .

   • The --platform linux/arm64,linux/amd64 option specifies the target platforms for which the container image is being built.
   • The --manifest <registry>/<image> option creates a manifest list with the specified name, that is <registry>/<image>, and adds the newly-built images to them. A manifest list is a collection of image manifests, each one targeting a different architecture.

3. Push the manifest list to the registry:

   $ podman manifest push <registry>/<image>

   This manifest list acts as a single entry point for pulling the multi-architecture container.

   As a result, you can pull the appropriate container image for your platform, based on a single manifest list.

   You can also remove items from the manifest list by using the podman manifest remove <manifest_list> <digest_ID> command, where <digest_ID> is the SHA-256 checksum of the container image. For example: podman manifest remove <registry>/<image> sha256:cb8a924afdf…​.

Procedure

1. Save the registry.redhat.io/rhel10/support-tools image as a tarball:

   • In the default docker-archive format:

     $ podman save -o mysupport-tools.tar registry.redhat.io/rhel10/support-tools:latest

   • In the oci-archive format, using the --format option:

     $ podman save -o mysupport-tools-oci.tar --format=oci-archive registry.redhat.io/rhel10/support-tools

     The mysupport-tools.tar and mysupport-tools-oci.tar archives are stored in your current directory. The next steps are performed with the mysupport-tools.tar tarball.

2. Check the file type of mysupport-tools.tar:

   $ file mysupport-tools.tar
   mysupport-tools.tar: POSIX tar archive

3. To load the registry.redhat.io/rhel10/support-tools:latest image from the mysupport-tools.tar:

   $ podman load -i mysupport-tools.tar
   ...
   Loaded image(s): registry.redhat.io/rhel10/support-tools:latest

   For more information, see the podman-save(1) and podman-load(1) man pages on your system.

Procedure

1. Optional: Add an additional name to the ubi image:

   # podman tag registry.redhat.io/ubi10/ubi registry.example.com:5000/ubi10/ubi

2. Push the registry.example.com:5000/ubi10/ubi image from your local storage to a registry:

   # podman push registry.example.com:5000/ubi10/ubi

   Important

   While there are few restrictions on how you use these images, there are some restrictions about how you can refer to them. For example, you cannot call those images Red Hat certified or Red Hat supported unless you certify it through the Red Hat Partner Connect Program, either with Red Hat Container Certification or Red Hat OpenShift Operator Certification.

Procedure

1. List all images on your local system:

   $ podman images
   REPOSITORY                           TAG     IMAGE ID      CREATED      SIZE
   registry.redhat.io/rhel10/support-tools     latest  4b32d14201de  7 weeks ago  228 MB
   registry.redhat.io/ubi10/ubi          latest  3269c37eae33  7 weeks ago  208 MB
   localhost/myubi                      X.Y     3269c37eae33  7 weeks ago  208 MB

2. List all containers:

   $ podman ps -a
   CONTAINER ID  IMAGE                                    COMMAND          CREATED        STATUS            PORTS   NAMES
   7ccd6001166e  registry.redhat.io/rhel10/support-tools:latest  usr/bin/bash  6 seconds ago  Up 5 seconds ago          my-support-tools

   To remove the registry.redhat.io/rhel10/support-tools image, you have to stop all containers running from this image by using the podman stop command. You can stop a container by its ID or name.

3. Stop the my-support-tools container:

   $ podman stop my-support-tools
   7ccd6001166e9720c47fbeb077e0afd0bb635e74a1b0ede3fd34d09eaf5a52e9

4. Remove the registry.redhat.io/rhel10/support-tools image:

   $ podman rmi registry.redhat.io/rhel10/support-tools

   • To remove multiple images:

     $ podman rmi registry.redhat.io/rhel10/support-tools registry.redhat.io/ubi10/ubi

   • To remove all images from your system:

     $ podman rmi -a

   • To remove images that have multiple names (tags) associated with them, add the -f option to remove them:

     $ podman rmi -f 1de7d7b3f531
     1de7d7b3f531...

Procedure

1. Display the type of operating system of the container based on the registry.access.redhat.com/ubi10/ubi container image using the cat /etc/os-release command:

   $ podman run --rm registry.access.redhat.com/ubi10/ubi cat /etc/os-release
   NAME="Red Hat Enterprise Linux"
   ...
   ID="rhel"
   ...
   HOME_URL="https://www.redhat.com/"
   BUG_REPORT_URL="https://bugzilla.redhat.com/"
   
   REDHAT_BUGZILLA_PRODUCT=" Red Hat Enterprise Linux 10"
   ...

2. Optional: List all containers.

   $ podman ps
   CONTAINER ID  IMAGE   COMMAND  CREATED  STATUS  PORTS   NAMES

   Because of the --rm option you should not see any container. The container was removed.

Procedure

1. Run the container named myubi based on the registry.redhat.io/ubi10/ubi image:

   $ podman run --name=myubi -it registry.access.redhat.com/ubi10/ubi /bin/bash
   [root@6ccffd0f6421 /]#

   • The -i option creates an interactive session. Without the -t option, the shell stays open, but you cannot type anything to the shell.
   • The -t option opens a terminal session. Without the -i option, the shell opens and then exits.

2. Install the procps-ng package containing a set of system utilities (for example ps, top, uptime, and so on):

   [root@6ccffd0f6421 /]# dnf install procps-ng

3. Use the ps -ef command to list current processes:

   # ps -ef
   UID          PID    PPID  C STIME TTY          TIME CMD
   root           1       0  0 12:55 pts/0    00:00:00 /bin/bash
   root          31       1  0 13:07 pts/0    00:00:00 ps -ef

4. Enter exit to exit the container and return to the host:

   # exit

5. Optional: List all containers:

   $ podman ps -a
   CONTAINER ID  IMAGE                               COMMAND    CREATED         STATUS                     PORTS   NAMES
   1984555a2c27  registry.redhat.io/ubi10/ubi:latest  /bin/bash  21 minutes ago  Exited (0) 21 minutes ago          myubi

   You can see that the container is in Exited status.

Prerequisites

1. The container-tools meta-package is installed.

Procedure

1. Install Container Tools: Ensure the necessary container tools are installed on your RHEL system. The container-tools module provides Buildah, Podman, and Skopeo.

   $ sudo dnf install container-tools

2. Create a Containerfile: A Containerfile defines the instructions for building your container image. This file specifies the base image, any software to install, configurations to apply, and the application to run. For example:

   FROM registry.redhat.io/ubi10/ubi-minimal
   RUN microdnf -y update && microdnf -y install
   COPY index.html /var/www/html/
   EXPOSE 80
   CMD ["httpd", "-DFOREGROUND"]

3. Build the container image with Buildah: Use buildah bud (or podman build) to build the image after you navigate to the directory containing your Container file.

   $ cd /<path_to_container_file>
   
   $ buildah bud -t your_image_name:tag .

   • your_image_name: The name for your image.
   • tag: The tag for your image (e.g., latest, 1.0).
   • .: Indicates that the Containerfile is in the current directory.

4. Run the container: After you build the image, you can run a container from it using the podman run command.

   $ podman run -d -p 8080:80 my-web-app

   • -d: Runs the container in detached mode (in the background).
   • -p 8080:80: Maps port 8080 on the host to port 80 inside the container.

   • my-web-app: The name of the image to run.

     The heredocs syntax in container buildings

     You can use the heredoc syntax in Containerfile, with a Red Hat Enterprise Linux base image, ensuring you enable BuildKit. If the commands contain heredoc syntax, the Containerfile considers the next lines, until the line only contains a heredoc delimiter, as part of the same command. You can embed multi-line strings directly within instructions like RUN or COPY in Containerfile using heredocs. This is especially useful with RHEL-based images, as it removes the need to create separate script files for simple tasks and thus improves readability and maintainability.

     For Example, a common use case is running multiple shell commands in a single RUN instruction to create a single image layer, avoiding the && \ syntax:

Procedure

1. Run the container based the on registry.redhat.io/rhel10/support-tools image:

   $ podman run -dt registry.redhat.io/rhel10/support-tools

2. List all containers:

   • To list all running containers:

     $ podman ps
     CONTAINER ID IMAGE              COMMAND         CREATED       STATUS            PORTS NAMES
     74b1da000a11 rhel10/support-tools /usr/bin/bash 2 minutes ago Up About a minute       musing_brown

   • To list all containers, running or stopped:

     $ podman ps -a
     CONTAINER ID IMAGE         COMMAND    CREATED    STATUS                PORTS NAMES     IS INFRA
     d65aecc325a4 ubi10/ubi      /bin/bash  3 secs ago Exited (0) 5 secs ago peaceful_hopper false
     74b1da000a11 rhel10/support-tools /usr/bin/bash 2 mins ago Up About a minute     musing_brown    false

     If you do not remove containers that are not running, by using the --rm option, you can restart them.

     For more information, see the podman-images(1) man page on your system.

Procedure

1. Start the myubi container:

   • In the non interactive mode:

     $ podman start myubi

     Alternatively, you can use podman start 1984555a2c27.

   • In the interactive mode, use -a (--attach) and -i (--interactive) options to work with container bash shell:

     $ podman start -a -i myubi

     Alternatively, you can use podman start -a -i 1984555a2c27.

2. Enter exit to exit the container and return to the host:

   [root@6ccffd0f6421 /]# exit

   For more information, see the podman-start(1) man page on your system.

Procedure

1. Run the container named log_test and mount the host /dev/log device inside the container:

   # podman run --name="log_test" -v /dev/log:/dev/log --rm \
     registry.redhat.io/ubi10/ubi logger "Testing logging to the host"

2. Use the journalctl utility to display logs:

   # journalctl -b | grep Testing
   Dec 09 16:55:00 localhost.localdomain root[14634]: Testing logging to the host

   The --rm option removes the container when it exits.

Procedure

1. Run the container named mysyslog:

   # podman run -dt --name=mysyslog registry.redhat.io/rhel10/support-tools

2. Optional: List all containers:

   # podman ps -a
   CONTAINER ID  IMAGE                                    COMMAND          CREATED         STATUS                     PORTS   NAMES
   c56ef6a256f8  registry.redhat.io/rhel10/support-tools:latest  usr/bin/bash  20 minutes ago  Up 20 minutes ago                  mysyslog

3. Mount the mysyslog container:

   # podman mount mysyslog
   /var/lib/containers/storage/overlay/990b5c6ddcdeed4bde7b245885ce4544c553d108310e2b797d7be46750894719/merged

4. Display the content of the mount point using ls command:

   # ls /var/lib/containers/storage/overlay/990b5c6ddcdeed4bde7b245885ce4544c553d108310e2b797d7be46750894719/merged
   bin  boot  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

5. Display the OS version:

   # cat /var/lib/containers/storage/overlay/990b5c6ddcdeed4bde7b245885ce4544c553d108310e2b797d7be46750894719/merged/etc/os-release
   NAME="Red Hat Enterprise Linux"
   VERSION="10 (Ootpa)"
   ID="rhel"
   ID_LIKE="fedora"
   ...

   For more information, see the podman-mount(1) man page on your system.

Procedure

1. Set the container network interface to the IP address 10.88.0.44:

   # podman run -d --ip=10.88.0.44 registry.redhat.io/rhel10/support-tools
   efde5f0a8c723f70dd5cb5dc3d5039df3b962fae65575b08662e0d5b5f9fbe85

2. Check that the IP address is set properly:

   # podman inspect efde5f0a8c723 | grep 10.88.0.44
   "IPAddress": "10.88.0.44",

   For more information, see the podman-inspect(1) and podman-run(1) man pages on your system.

Procedure

1. Enter the rpm -qa command inside the my-support-tools container to list all installed packages:

   $ podman exec -it my-support-tools rpm -qa
   gpg-pubkey-fd431d51-4ae0493b
   gpg-pubkey-5a6340b3-6229229e
   libgcc-11.5.0-2.el9.x86_64
   setup-2.13.7-10.el9.noarch
   ...

2. Enter a /bin/bash command in the my-support-tools container:

   $ podman exec -it my-support-tools /bin/bash

3. Install the procps-ng package containing a set of system utilities (for example ps, top, uptime, and so on):

   # dnf install procps-ng

4. Inspect the container:

   • To list every process on the system:

     # ps -ef
     UID          PID    PPID  C STIME TTY          TIME CMD
     root           8       0  0 11:07 pts/0    00:00:00 /bin/bash
     root          47       8  0 11:13 pts/0    00:00:00 ps -ef

   • To display file system disk space usage:

     # df -h
     Filesystem      Size  Used Avail Use% Mounted on
     tmpfs           6.3G  448K  6.3G   1% /etc/hosts
     shm              63M     0   63M   0% /dev/shm
     overlay         953G   76G  877G   8% /
     tmpfs            64M     0   64M   0% /dev
     devtmpfs        4.0M     0  4.0M   0% /dev/tty
     ...

   • To display system information:

     # uname -r
     6.12.0-124.15.1.el10_1.x86_64

   • To display amount of free and used memory in megabytes:

     # free --mega
     total        used        free      shared  buff/cache   available
     Mem:       2818         615        1183          12         1020        1957
     Swap:      3124           0        3124

Procedure

1. Create a volume:

   $ podman volume create hostvolume

2. Display information about the volume:

   $ podman volume inspect hostvolume
   [
       {
           "name": "hostvolume",
           "labels": {},
           "mountpoint": "/home/username/.local/share/containers/storage/volumes/hostvolume/_data",
           "driver": "local",
           "options": {},
           "scope": "local"
       }
   ]

   Notice that it creates a volume in the volumes directory. You can save the mount point path to the variable for easier manipulation: $ mntPoint=$(podman volume inspect hostvolume --format {{.Mountpoint}}).

   Notice that if you run sudo podman volume create hostvolume, then the mount point changes to /var/lib/containers/storage/volumes/hostvolume/_data.

3. Create a text file inside the directory using the path that is stored in the mntPoint variable:

   $ echo "Hello from host" >> $mntPoint/host.txt

4. List all files in the directory defined by the mntPoint variable:

   $ ls $mntPoint/
   host.txt

5. Run the container named myubi1 and map the directory defined by the hostvolume volume name on the host to the /containervolume1 directory on the container:

   $ podman run -it --name myubi1 -v hostvolume:/containervolume1 registry.access.redhat.com/ubi10/ubi /bin/bash

   Note that if you use the volume path defined by the mntPoint variable (-v $mntPoint:/containervolume1), data can be lost when running podman volume prune command, which removes unused volumes. Always use -v hostvolume_name:/containervolume_name.

6. List the files in the shared volume on the container:

   # ls /containervolume1
   host.txt

   You can see the host.txt file which you created on the host.

7. Create a text file inside the /containervolume1 directory:

   # echo "Hello from container 1" >> /containervolume1/container1.txt

8. Detach from the container with CTRL+p and CTRL+q.

9. List the files in the shared volume on the host, you should see two files:

   $ ls $mntPoint
   container1.rxt  host.txt

   At this point, you are sharing files between the container and host. To share files between two containers, run another container named myubi2.

10. Run the container named myubi2 and map the directory defined by the hostvolume volume name on the host to the /containervolume2 directory on the container:

    $ podman run -it --name myubi2 -v hostvolume:/containervolume2 registry.access.redhat.com/ubi10/ubi /bin/bash

11. List the files in the shared volume on the container:

    # ls /containervolume2
    container1.txt host.txt

    You can see the host.txt file which you created on the host and container1.txt which you created inside the myubi1 container.

12. Create a text file inside the /containervolume2 directory:

    # echo "Hello from container 2" >> /containervolume2/container2.txt

13. Detach from the container with CTRL+p and CTRL+q.

14. List the files in the shared volume on the host, you should see three files:

    $ ls $mntPoint
    container1.rxt  container2.txt host.txt

    For more information, see the podman-volume(1) man page on your system.

Procedure

1. Run the myubi container based on the registry.access.redhat.com/ubi10/ubi image:

   $ podman run -dt --name=myubi registry.access.redhat.com/10/ubi

2. Optional: List all containers:

   $ podman ps -a
   CONTAINER ID  IMAGE                                    COMMAND          CREATED     STATUS         PORTS   NAMES
   a6a6d4896142  registry.access.redhat.com/10:latest   /bin/bash        7 seconds ago  Up 7 seconds ago          myubi

3. Attach to the myubi container:

   $ podman attach myubi

4. Create a file named testfile:

   [root@a6a6d4896142 /]# echo "hello" > testfile

5. Detach from the container with CTRL+p and CTRL+q.

6. Export the file system of the myubi as a myubi-container.tar on the local machine:

   $ podman export -o myubi.tar a6a6d4896142

7. Optional: List the current directory content:

   $ ls -l
   -rw-r--r--. 1 user user 210885120 Apr  6 10:50 myubi-container.tar
   ...

8. Optional: Create a myubi-container directory, extract all files from the myubi-container.tar archive. List a content of the myubi-directory in a tree-like format:

   $ mkdir myubi-container
   $ tar -xf myubi-container.tar -C myubi-container
   $ tree -L 1 myubi-container
   ├── bin -> usr/bin
   ├── boot
   ├── dev
   ├── etc
   ├── home
   ├── lib -> usr/lib
   ├── lib64 -> usr/lib64
   ├── lost+found
   ├── media
   ├── mnt
   ├── opt
   ├── proc
   ├── root
   ├── run
   ├── sbin -> usr/sbin
   ├── srv
   ├── sys
   ├── testfile
   ├── tmp
   ├── usr
   └── var
   
   20 directories, 1 file

   You can see that the myubi-container.tar contains the container file system.

9. Import the myubi.tar and saves it as a filesystem image:

   $ podman import myubi.tar myubi-imported
   Getting image source signatures
   Copying blob 277cab30fe96 done
   Copying config c296689a17 done
   Writing manifest to image destination
   Storing signatures
   c296689a17da2f33bf9d16071911636d7ce4d63f329741db679c3f41537e7cbf

10. List all images:

    $ podman images
    REPOSITORY                              TAG     IMAGE ID      CREATED         SIZE
    docker.io/library/myubi-imported       latest  c296689a17da  51 seconds ago  211 MB

11. Display the content of the testfile file:

    $ podman run -it --name=myubi-imported myubi-imported cat testfile
    hello

    For more information, see the podman-export (1) and podman-import(1) man pages on your system.

Procedure

1. List all containers, running or stopped:

   $ podman ps -a
   CONTAINER ID IMAGE         COMMAND    CREATED    STATUS                PORTS NAMES     IS INFRA
   d65aecc325a4 ubi10/ubi      /bin/bash  3 secs ago Exited (0) 5 secs ago peaceful_hopper false
   74b1da000a11 rhel10/support-tools usr/bin/bash 2 mins ago Up About a minute     musing_brown    false

2. Remove the containers:

   • To remove the peaceful_hopper container:

     $ podman rm peaceful_hopper

     Notice that the peaceful_hopper container was in Exited status, which means it was stopped and it can be removed immediately.

   • To remove the musing_brown container, first stop the container and then remove it:

     $ podman stop musing_brown
     $ podman rm musing_brown

   • To remove multiple containers:

     $ podman rm clever_yonath furious_shockley

   • To remove all containers from your local system:

     $ podman rm -a

Procedure

1. Create a Containerfile with the following contents to a new directory:

   FROM registry.access.redhat.com/ubi10/ubi-init
   RUN dnf -y install httpd; dnf clean all; systemctl enable httpd;
   RUN echo "Successful Web Server Test" > /var/www/html/index.html
   RUN mkdir /etc/systemd/system/httpd.service.d/; echo -e '[Service]\nRestart=always' > /etc/systemd/system/httpd.service.d/httpd.conf
   EXPOSE 80
   CMD [ "/sbin/init" ]

   The Containerfile installs the httpd package, enables the httpd service to start at boot time, creates a test file (index.html), exposes the Web server to the host (port 80), and starts the systemd init service (/sbin/init) when the container starts.

2. Build the container:

   # podman build --format=docker -t mysysd .

3. Optional: If you want to run containers with systemd and SELinux is enabled on your system, you must set the container_manage_cgroup boolean variable:

   # setsebool -P container_manage_cgroup 1

4. Run the container named mysysd_run:

   # podman run -d --name=mysysd_run -p 80:80 mysysd

   The mysysd image runs as the mysysd_run container as a daemon process, with port 80 from the container exposed to port 80 on the host system.

   Note

   In rootless mode, you have to choose host port number >= 1024. For example:

   $ podman run -d --name=mysysd -p 8081:80 mysysd

   To use port numbers < 1024, you have to modify the net.ipv4.ip_unprivileged_port_start variable:

   # sysctl net.ipv4.ip_unprivileged_port_start=80

5. Check that the container is running:

   # podman ps
   a282b0c2ad3d  localhost/mysysd:latest  /sbin/init  15 seconds ago  Up 14 seconds ago  0.0.0.0:80->80/tcp  mysysd_run

6. Test the web server:

   # curl localhost/index.html
   Successful Web Server Test

Procedure

1. Pull and build the registry.access.redhat.com/ubi10/ubi-micro image:

   # microcontainer=$(buildah from registry.access.redhat.com/ubi10/ubi-micro)

2. Mount a working container root filesystem:

   # micromount=$(buildah mount $microcontainer)

3. Install the httpd service to the micromount directory:

   # dnf install \
       --installroot $micromount \
       --releasever=/ \
       --setopt install_weak_deps=false \
       --setopt=reposdir=/etc/yum.repos.d/ \
       --nodocs -y \
       httpd
   # dnf clean all \
       --installroot $micromount

4. Unmount the root file system on the working container:

   # buildah umount $microcontainer

5. Create the ubi-micro-httpd image from a working container:

   # buildah commit $microcontainer ubi-micro-httpd

Verification

1. Display details about the ubi-micro-httpd image:

   # podman images ubi-micro-httpd
   localhost/ubi-micro-httpd latest 7c557e7fbe9f  22 minutes ago  151 MB

Procedure

1. Pull and run the registry.access.redhat.com/ubi10/ubi image:

   $ podman run -it --name myubi registry.access.redhat.com/ubi10/ubi

2. Add a package to the myubi container.

   • To add a package that is in the UBI repository, disable all dnf repositories except for UBI repositories. For example, to add the bzip2 package:

     # dnf install --disablerepo==* --enablerepo=ubi-10-for-x86_64-appstream-rpms --enablerepo=ubi-10-for-x86_64-baseos-rpms bzip2

   • To add a package that is not in the UBI repository, do not disable any repositories. For example, to add the zsh package:

     # dnf install zsh

   • To add a package that is in a different host repository, explicitly enable the repository you need. For example, to install the python3-devel package from the codeready-builder-for-ubi-10-x86_64-rpms repository:

     # dnf install --enablerepo=codeready-builder-for-ubi-10-x86_64-rpms python3-devel

Verification

1. List all enabled repositories inside the container:

   # dnf repolist

2. Ensure that the required repositories are listed.

3. List all installed packages:

   # rpm -qa

4. Ensure that the required packages are listed.

Procedure

1. Pull and run the registry.access.redhat.com/ubi10/ubi-minimal image:

   $ podman run -it --name myubimin registry.access.redhat.com/ubi10/ubi-minimal

2. Add a package to the myubimin container:

   • To add a package that is in the UBI repository, do not disable any repositories. For example, to add the bzip2 package:

     # microdnf install bzip2 --setopt install_weak_deps=0

   • To add a package that is in a different host repository, explicitly enable the repository you need. For example, to install the python3-devel package from the codeready-builder-for-rhel-10z-x86_64-rpms repository:

     # microdnf install --enablerepo=codeready-builder-for-rhel-10-x86_64-rpms python3-devel --setopt install_weak_deps=0

     The --setopt install_weak_deps=false option disables the installation of weak dependencies. Weak dependencies include recommended or suggested packages that are not strictly required but are often installed by default.

Verification

1. List all enabled repositories inside the container:

   # microdnf repolist

2. Ensure that the required repositories are listed.

3. List all installed packages:

   # rpm -qa

4. Ensure that the required packages are listed.

Verification

1. List all enabled repositories:

   • To list all enabled repositories inside the containers based on UBI standard or UBI init images:

     #  dnf repolist

   • To list all enabled repositories inside the containers based on UBI minimal containers:

     # microdnf repolist

2. Ensure that the required repositories are listed.

3. List all installed packages:

   # rpm -qa

4. Ensure that the required packages are listed.

Procedure

1. Create a Containerfile:

   FROM registry.access.redhat.com/ubi10/ubi
   USER root
   LABEL maintainer="John Doe"
   # Update image
   RUN dnf update --disablerepo=* --enablerepo=ubi-10-appstream-rpms --enablerepo=ubi-10-baseos-rpms -y && rm -rf /var/cache/yum
   RUN dnf install --disablerepo=* --enablerepo=ubi-10-appstream-rpms --enablerepo=ubi-10-baseos-rpms httpd -y && rm -rf /var/cache/yum
   # Add default Web page and expose port
   RUN echo "The Web Server is Running" > /var/www/html/index.html
   EXPOSE 80
   # Start the service
   CMD ["-D", "FOREGROUND"]
   ENTRYPOINT ["/usr/sbin/httpd"]

2. Build the container image:

   # buildah bud -t johndoe/webserver .
   STEP 1: FROM registry.access.redhat.com/ubi10/ubi:latest
   STEP 2: USER root
   STEP 3: LABEL maintainer="John Doe"
   STEP 4: RUN dnf update --disablerepo=* --enablerepo=ubi-10-appstream-rpms --enablerepo=ubi-10-baseos-rpms -y
   ...
   Writing manifest to image destination
   Storing signatures
   --> f9874f27050
   f9874f270500c255b950e751e53d37c6f8f6dba13425d42f30c2a8ef26b769f2

Verification

1. Run the web server:

   # podman run -d --name=myweb -p 80:80 johndoe/webserver
   bbe98c71d18720d966e4567949888dc4fb86eec7d304e785d5177168a5965f64

2. Test the web server:

   # curl http://localhost/index.html
   The Web Server is Running

Procedure

1. Use the skopeo copy command to copy the source container image to a local directory:

   $ skopeo copy \
   docker://registry.access.redhat.com/ubi10:8.1-397-source \
   dir:$HOME/TEST
   ...
   Copying blob 477bc8106765 done
   Copying blob c438818481d3 done
   ...
   Writing manifest to image destination
   Storing signatures

2. Use the skopeo inspect command to inspect the source container image:

   $ skopeo inspect dir:$HOME/TEST
   {
       "Digest": "sha256:7ab721ef3305271bbb629a6db065c59bbeb87bc53e7cbf88e2953a1217ba7322",
       "RepoTags": [],
       "Created": "2020-02-11T12:14:18.612461174Z",
       "DockerVersion": "",
       "Labels": null,
       "Architecture": "amd64",
       "Os": "linux",
       "Layers": [
           "sha256:1ae73d938ab9f11718d0f6a4148eb07d38ac1c0a70b1d03e751de8bf3c2c87fa",
           "sha256:9fe966885cb8712c47efe5ecc2eaa0797a0d5ffb8b119c4bd4b400cc9e255421",
           "sha256:61b2527a4b836a4efbb82dfd449c0556c0f769570a6c02e112f88f8bbcd90166",
           ...
           "sha256:cc56c782b513e2bdd2cc2af77b69e13df4ab624ddb856c4d086206b46b9b9e5f",
           "sha256:dcf9396fdada4e6c1ce667b306b7f08a83c9e6b39d0955c481b8ea5b2a465b32",
           "sha256:feb6d2ae252402ea6a6fca8a158a7d32c7e4572db0e6e5a5eab15d4e0777951e"
       ],
       "Env": null
   }

3. Unpack all the content:

   $ cd $HOME/TEST
   $ for f in $(ls); do tar xvf $f; done

4. Check the results:

   $ find blobs/ rpm_dir/
   blobs/
   blobs/sha256
   blobs/sha256/10914f1fff060ce31388f5ab963871870535aaaa551629f5ad182384d60fdf82
   rpm_dir/
   rpm_dir/gzip-1.9-4.el8.src.rpm

   If the results are correct, the image is ready to be used.

   Note

   It could take several hours after a container image is released for its associated source container to become available.

   For more information, see the skopeo-copy (1) and skopeo-inspect(1) man pages on your system.

Procedure

1. Create an empty pod:

   $ podman pod create --name mypod
   223df6b390b4ea87a090a4b5207f7b9b003187a6960bd37631ae9bc12c433aff
   The pod is in the initial state Created.

   The pod is in the initial state Created.

2. Optional: List all pods:

   $ podman pod ps
   POD ID         NAME    STATUS    CREATED                  # OF CONTAINERS   INFRA ID
   223df6b390b4   mypod   Created   Less than a second ago   1                 3afdcd93de3e

   Notice that the pod has one container in it.

3. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                 COMMAND  CREATED                 STATUS   PORTS  NAMES               POD
   3afdcd93de3e  registry.access.redhat.com/ubi10/pause            Less than a second ago  Created         223df6b390b4-infra  223df6b390b4

   You can see that the pod ID from podman ps command matches the pod ID in the podman pod ps command. The default infra container is based on the registry.access.redhat.com/ubi10/pause image.

4. Run a container named myubi in the existing pod named mypod:

   $ podman run -dt --name myubi --pod mypod registry.access.redhat.com/ubi10/ubi /bin/bash
   5df5c48fea87860cf75822ceab8370548b04c78be9fc156570949013863ccf71

5. Optional: List all pods:

   $ podman pod ps
   POD ID         NAME    STATUS    CREATED                  # OF CONTAINERS   INFRA ID
   223df6b390b4   mypod   Running   Less than a second ago   2                 3afdcd93de3e

   You can see that the pod has two containers in it.

6. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                       COMMAND    CREATED                 STATUS                     PORTS  NAMES               POD
   5df5c48fea87  registry.access.redhat.com/ubi10/ubi:latest  /bin/bash  Less than a second ago  Up Less than a second ago         myubi               223df6b390b4
   3afdcd93de3e  registry.access.redhat.com/ubi10/pause                                   Less than a second ago  Up Less than a second ago         223df6b390b4-infra  223df6b390b4

Procedure

1. Stop the pod mypod:

   $ podman pod stop mypod

2. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                               COMMAND    CREATED             STATUS                    PORTS   NAMES               POD ID        PODNAME
   5df5c48fea87  registry.redhat.io/ubi10/ubi:latest  /bin/bash  About a minute ago  Exited (0) 7 seconds ago          myubi               223df6b390b4  mypod
   
   3afdcd93de3e  registry.access.redhat.com/10/pause                           About a minute ago  Exited (0) 7 seconds ago          8a4e6527ac9d-infra  223df6b390b4  mypod

   You can see that the pod mypod and container myubi are in "Exited" status.

Procedure

1. Remove the pod mypod, type:

   $ podman pod rm mypod
   223df6b390b4ea87a090a4b5207f7b9b003187a6960bd37631ae9bc12c433aff

   Note that removing the pod automatically removes all containers inside it.

2. Optional: Check that all containers and pods were removed:

   $ podman ps
   $ podman pod ps

   For more information, see the podman-pod-rm(1) man page on your system.

Procedure

1. List all networks:

   # podman network ls
   NETWORK ID    NAME        VERSION     PLUGINS
   2f259bab93aa  podman      0.4.0       bridge,portmap,firewall,tuning
   11c844f95e28  mynet       0.4.0       bridge,portmap,firewall,tuning,dnsname

2. Remove the mynet network:

   # podman network rm mynet
   mynet

   Note

   If the removed network has associated containers with it, you have to use the podman network rm -f command to delete containers and pods.

Procedure

1. Optional: If you want to use the pasta network mode, install the passt package:

   $ {PackageManager} install passt

2. Run the container based on the registry.access.redhat.com/ubi10/ubi image:

   $ podman run --network=<netwok_mode> -d --name=myubi registry.access.redhat.com/ubi10/ubi

   The <netwok_mode> is the required network mode. Alternatively, you can use the default_rootless_network_cmd option in the containers.conf file to switch the default network mode.

   Note

   The default network mode for rootless containers is pasta.

Procedure

1. Display the IP address of a container:

   # podman inspect --format='{{.NetworkSettings.IPAddress}}' <containerName>

2. Display all networks to which container is connected:

   # podman inspect --format='{{.NetworkSettings.Networks}}' <containerName>

3. Display port mappings:

   # podman inspect --format='{{.NetworkSettings.Ports}}' <containerName>

Procedure

1. Start the container named web-container:

   # podman run -dt --name=web-container docker.io/library/httpd

2. List all containers:

   # podman ps -a
   
   CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES
   b8c057333513  docker.io/library/httpd:latest  httpd-foreground  4 seconds ago  Up 5 seconds ago              web-container

3. Inspect the container and display the IP address:

   # podman inspect --format='{{.NetworkSettings.IPAddress}}' web-container
   
   10.88.0.2

4. Run the myubi container and verify that web server is running:

   # podman run -it --name=myubi ubi10/ubi curl 10.88.0.2:80

Procedure

1. Verify that the bridge is configured:

   # podman network inspect podman | grep bridge
   
       "type": "bridge"

2. Display the host network configuration:

   # ip addr show cni-podman0
   
   6: podman0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
       link/ether 62:af:a1:0a:ca:2e brd ff:ff:ff:ff:ff:ff
       inet 10.88.0.1/16 brd 10.88.255.255 scope global podman0
          valid_lft forever preferred_lft forever
       inet6 fe80::60af:a1ff:fe0a:ca2e/64 scope link
          valid_lft forever preferred_lft forever

   You can see that the web-container has an IP of the podman0 subnet and the network is bridged to the host.

3. Inspect the web-container and display its IP address:

   # podman inspect --format='{{.NetworkSettings.IPAddress}}' web-container
   
   10.88.0.2

4. Access the web-container directly from the host:

   $ curl 10.88.0.2:80

Procedure

1. Run the unpublished container:

   # podman run -dt --name=web1 ubi10/httpd-24

2. Run the automatically published container:

   # podman run -dt --name=web2 -P ubi10/httpd-24

3. Run the manually published container and publish container port 8080:

   # podman run -dt --name=web3 -p 8888:8080 ubi10/httpd-24

4. List all containers:

   # podman ps
   
   CONTAINER ID  IMAGE                                            COMMAND               CREATED         STATUS         PORTS                                             NAMES
   db23e8dabc74  registry.access.redhat.com/ubi10/httpd-24:latest  /usr/bin/run-http...  23 seconds ago  Up 23 seconds  8080/tcp, 8443/tcp                                web1
   1824b8f0a64b  registry.access.redhat.com/ubi10/httpd-24:latest  /usr/bin/run-http...  18 seconds ago  Up 18 seconds  0.0.0.0:33127->8080/tcp, 0.0.0.0:37679->8443/tcp  web2
   39de784d917a  registry.access.redhat.com/ubi10/httpd-24:latest  /usr/bin/run-http...  5 seconds ago  Up 5 seconds  0.0.0.0:8888->8080/tcp, 8443/tcp                  web3

   You can see that:

   • Container web1 has no published ports and can be reached only by container network or a bridge.

   • Container web2 has automatically mapped ports 43595 and 42423 to publish the application ports 8080 and 8443, respectively.

     Note

     The automatic port mapping is possible because the registry.access.redhat.com/10/httpd-24 image has the EXPOSE 8080 and EXPOSE 8443 commands in the Containerfile.

   • Container web3 has a manually published port. The host port 8888 is mapped to the container port 8080.

5. Display the IP addresses of web1 and web3 containers:

   # podman inspect --format='{{.NetworkSettings.IPAddress}}' web1
   # podman inspect --format='{{.NetworkSettings.IPAddress}}' web3

6. Reach web1 container using <IP>:<port> notation:

   # curl 10.88.0.2:8080
   ...
   <title>Test Page for the HTTP Server on Red Hat Enterprise Linux</title>
   ...

7. Reach web2 container using localhost:<port> notation:

   # curl localhost:43595
   ...
   <title>Test Page for the HTTP Server on Red Hat Enterprise Linux</title>
   ...

8. Reach web3 container using <IP>:<port> notation:

   # curl 10.88.0.4:8080
   ...
   <title>Test Page for the HTTP Server on Red Hat Enterprise Linux</title>
   ...

Procedure

1. Run a receiver container attached to the mynet network:

   # podman run -d --net mynet --name receiver ubi10 sleep 3000

2. Run a sender container and reach the receiver container by its name:

   # podman run -it --rm --net mynet --name sender alpine ping receiver
   
   PING rcv01 (10.89.0.2): 56 data bytes
   64 bytes from 10.89.0.2: seq=0 ttl=42 time=0.041 ms
   64 bytes from 10.89.0.2: seq=1 ttl=42 time=0.125 ms
   64 bytes from 10.89.0.2: seq=2 ttl=42 time=0.109 ms

   Exit using the CTRL+C.

   You can see that the sender container can ping the receiver container using its name.

Procedure

1. Create a pod named web-pod:

   $ podman pod create --name=web-pod

2. Run the web container named web-container in the pod:

   $ podman container run -d --pod web-pod --name=web-container docker.io/library/httpd

3. List all pods and containers associated with them:

   $ podman ps --pod
   
   CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES               POD ID        PODNAME
   58653cf0cf09  k8s.gcr.io/pause:3.5                              4 minutes ago  Up 3 minutes ago              4e61a300c194-infra  4e61a300c194  web-pod
   b3f4255afdb3  docker.io/library/httpd:latest  httpd-foreground  3 minutes ago  Up 3 minutes ago              web-container  4e61a300c194  web-pod

4. Run the container in the web-pod based on the docker.io/library/fedora image:

   $ podman container run -it --rm --pod web-pod docker.io/library/fedora curl localhost

   You can see that the container can reach the web-container.

Procedure

1. Create a pod named web-pod:

   # podman pod create --name=web-pod-publish -p 80:80

2. List all pods:

   # podman pod ls
   
   POD ID        NAME         STATUS   CREATED        INFRA ID      # OF CONTAINERS
   26fe5de43ab3  publish-pod  Created  5 seconds ago  7de09076d2b3  1

3. Run the web container named web-container inside the web-pod:

   # podman container run -d --pod web-pod-publish --name=web-container docker.io/library/httpd

4. List containers

   # podman ps
   
   CONTAINER ID  IMAGE                    COMMAND           CREATED             STATUS             PORTS               NAMES
   7de09076d2b3  k8s.gcr.io/pause:3.5                       About a minute ago  Up 23 seconds ago  0.0.0.0:80->80/tcp  26fe5de43ab3-infra
   088befb90e59  docker.io/library/httpd  httpd-foreground  23 seconds ago      Up 23 seconds ago  0.0.0.0:80->80/tcp  web-container

5. Verify that the web-container can be reached:

   $ curl localhost:80

Procedure

1. Create a network named pod-net:

   # podman network create pod-net
   
   /etc/cni/net.d/pod-net.conflist

2. Create a pod web-pod:

   # podman pod create --net pod-net --name web-pod

3. Run a container named web-container inside the web-pod:

   # podman run -d --pod webt-pod --name=web-container docker.io/library/httpd

4. Optional: Display the pods the containers are associated with:

   # podman ps -p
   
   CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES               POD ID        PODNAME
   b7d6871d018c   registry.access.redhat.com/ubi10/pause:latest                             9 minutes ago  Up 6 minutes ago              a8e7360326ba-infra  a8e7360326ba  web-pod
   645835585e24  docker.io/library/httpd:latest  httpd-foreground  6 minutes ago  Up 6 minutes ago              web-container    a8e7360326ba  web-pod

Procedure

1. Enable the DHCP proxy by using the systemd socket:

   systemctl enable --now netavark-dhcp-proxy.socket
   Created symlink /etc/systemd/system/sockets.target.wants/netavark-dhcp-proxy.socket → /usr/lib/systemd/system/netavark-dhcp-proxy.socket.

2. Optional: Display the socket unit file:

   # cat /usr/lib/systemd/system/netavark-dhcp-proxy.socket
   [Unit]
   Description=Netavark DHCP proxy socket
   
   [Socket]
   ListenStream=%t/podman/nv-proxy.sock
   SocketMode=0660
   
   [Install]
   WantedBy=sockets.target

3. Create a macvlan network and specify your host interface with it. Typically, it is your external interface:

   # podman network create -d macvlan --interface-name <LAN_INTERFACE> mv1
   mv1

4. Run the container by using newly created network:

   # podman run --rm --network mv1 -d --name test alpine top
   894ae3b6b1081aca2a5d90a9855568eaa533c08a174874be59569d4656f9bc45

Verification

1. Confirm the container has an IP on your local subnet:

   # podman exec test ip addr
   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
       link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
       inet 127.0.0.1/8 scope host lo
          valid_lft forever preferred_lft forever
       inet6 ::1/128 scope host
          valid_lft forever preferred_lft forever
   2: eth0@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
       link/ether 5a:30:72:bf:13:76 brd ff:ff:ff:ff:ff:ff
       inet 192.168.188.36/24 brd 192.168.188.255 scope global eth0
          valid_lft forever preferred_lft forever
       inet6 fe80::5830:72ff:febf:1376/64 scope link
          valid_lft forever preferred_lft forever

2. Inspect the container to verify it uses correct IP addresses:

   # podman container inspect test --format {{.NetworkSettings.Networks.mv1.IPAddress}}
   192.168.188.36

Procedure

1. Create the mysleep.container unit file:

   $ cat $HOME/.config/containers/systemd/mysleep.container
   [Unit]
   Description=The sleep container
   After=local-fs.target
   
   [Container]
   Image=registry.access.redhat.com/ubi10-minimal:latest
   Exec=sleep 1000
   
   [Install]
   # Start by default on boot
   WantedBy=multi-user.target default.target

   In the [Container] section you must specify:

   • Image - container mage you want to tun

   • Exec - the command you want to run inside the container

     This enables you to use all other fields specified in a systemd unit file.

2. Create the mysleep.service based on the mysleep.container file:

   $ systemctl --user daemon-reload

3. Optional: Check the status of the mysleep.service:

   $ systemctl --user status mysleep.service
   ○ mysleep.service - The sleep container
   	 Loaded: loaded (/home/username/.config/containers/systemd/mysleep.container; generated)
   	 Active: inactive (dead)

4. Start the mysleep.service:

   $ systemctl --user start mysleep.service

Verification

1. Check the status of the mysleep.service:

   $ systemctl --user status mysleep.service
   ● mysleep.service - The sleep container
   	 Loaded: loaded (/home/username/.config/containers/systemd/mysleep.container; generated)
   	 Active: active (running) since Thu 2023-02-09 18:07:23 EST; 2s ago
      Main PID: 265651 (conmon)
         Tasks: 3 (limit: 76815)
   	 Memory: 1.6M
      	 CPU: 94ms
   	 CGroup: ...

2. List all containers:

   $ podman ps -a
   CONTAINER ID  IMAGE                            COMMAND               CREATED            STATUS                          PORTS   NAMES
   421c8293fc1b  registry.access.redhat.com/ubi10-minimal:latest               sleep 1000  30 seconds ago   Up 10 seconds ago systemd-mysleep

   Note that the name of the created container consists of the following elements:

   • a systemd- prefix

   • a name of the systemd unit, that is systemd-mysleep

     This naming helps to distinguish common containers from containers running in systemd units. It also helps to determine which unit a container runs in. If you want to change the name of the container, use the ContainerName field in the [Container] section.

     For more information, see the podman-systemd.unit(5) man page on your system.

Procedure

1. Reload systemd manager configuration:

   # systemctl --user daemon-reload

2. Enable the service container.service and start it at boot time:

   # systemctl --user enable container.service

3. Start the service immediately:

   # systemctl --user start container.service

4. Check the status of the service:

   $ systemctl --user status container.service
   ● container.service - Podman container.service
      Loaded: loaded (/home/user/.config/systemd/user/container.service; enabled; vendor preset: enabled)
      Active: active (running) since Wed 2020-09-16 11:56:57 CEST; 8s ago
        Docs: man:podman-generate-systemd(1)
     Process: 80602 ExecStart=/usr/bin/podman run --conmon-pidfile //run/user/1000/container.service-pid --cidfile //run/user/1000/container.service-cid -d ubi10-minimal:>
     Process: 80601 ExecStartPre=/usr/bin/rm -f //run/user/1000/container.service-pid //run/user/1000/container.service-cid (code=exited, status=0/SUCCESS)
    Main PID: 80617 (conmon)
      CGroup: /user.slice/user-1000.slice/user@1000.service/container.service
              ├─ 2870 /usr/bin/podman
              ├─80612 /usr/bin/slirp4netns --disable-host-loopback --mtu 65520 --enable-sandbox --enable-seccomp -c -e 3 -r 4 --netns-type=path /run/user/1000/netns/cni->
              ├─80614 /usr/bin/fuse-overlayfs -o lowerdir=/home/user/.local/share/containers/storage/overlay/l/YJSPGXM2OCDZPLMLXJOW3NRF6Q:/home/user/.local/share/contain>
              ├─80617 /usr/bin/conmon --api-version 1 -c cbc75d6031508dfd3d78a74a03e4ace1732b51223e72a2ce4aa3bfe10a78e4fa -u cbc75d6031508dfd3d78a74a03e4ace1732b51223e72>
              └─cbc75d6031508dfd3d78a74a03e4ace1732b51223e72a2ce4aa3bfe10a78e4fa
                └─80626 /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 1d

   You can check if the service is enabled by using the systemctl is-enabled container.service command.

5. Optional: To stop container.service, enter:

   # systemctl --user stop container.service

Procedure

1. Create a container (for example myubi):

   $ podman create --name myubi registry.access.redhat.com/ubi10:latest sleep infinity
   0280afe98bb75a5c5e713b28de4b7c5cb49f156f1cce4a208f13fee2f75cb453

2. Use the container name or ID to generate the systemd unit file and direct it into the ~/.config/systemd/user/container-myubi.service file:

   $ podman generate systemd --name myubi > ~/.config/systemd/user/container-myubi.service

Procedure

1. Pull the image you want to use on your system. For example, to pull the httpd-24 image:

   # podman pull registry.access.redhat.com/ubi10/httpd-24

2. Optional: List all images available on your system:

   # podman images
   REPOSITORY                                TAG                  IMAGE ID      CREATED        SIZE
   registry.access.redhat.com/ubi10/httpd-24  latest               8594be0a0b57  2 weeks ago    462 MB

3. Create the httpd container:

   # podman create --name httpd -p 8080:8080 registry.access.redhat.com/ubi10/httpd-24
   cdb9f981cf143021b1679599d860026b13a77187f75e46cc0eac85293710a4b1

4. Optional: Verify the container has been created:

   # podman ps -a
   CONTAINER ID  IMAGE                                            COMMAND               CREATED        STATUS      PORTS                   NAMES
   cdb9f981cf14  registry.access.redhat.com/ubi10/httpd-24:latest  /usr/bin/run-http...  5 minutes ago  Created     0.0.0.0:8080->8080/tcp  httpd

5. Generate a systemd unit file for the httpd container:

   # podman generate systemd --new --files --name httpd
   /root/container-httpd.service

6. Display the content of the generated container-httpd.service systemd unit file:

   # cat /root/container-httpd.service
   # container-httpd.service
   # autogenerated by Podman 3.3.1
   # Wed Sep  8 20:41:44 CEST 2021
   
   [Unit]
   Description=Podman container-httpd.service
   Documentation=man:podman-generate-systemd(1)
   Wants=network-online.target
   After=network-online.target
   RequiresMountsFor=%t/containers
   
   [Service]
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Restart=on-failure
   TimeoutStopSec=70
   ExecStartPre=/bin/rm -f %t/%n.ctr-id
   ExecStart=/usr/bin/podman run --cidfile=%t/%n.ctr-id --sdnotify=conmon --cgroups=no-conmon --rm -d --replace --name httpd -p 8080:8080 registry.access.redhat.com/ubi10/httpd-24
   ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
   ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
   Type=notify
   NotifyAccess=all
   
   [Install]
   WantedBy=multi-user.target default.target

   Note

   Unit files generated by using the --new option do not expect containers and pods to exist. Therefore, they perform the podman run command when starting the service (see the ExecStart line) instead of the podman start command. For example, see section Generating a systemd unit file using Podman.

   • The podman run command uses the following command-line options:

     • The --conmon-pidfile option points to a path to store the process ID for the conmon process running on the host. The conmon process terminates with the same exit status as the container, which allows systemd to report the correct service status and restart the container if needed.
     • The --cidfile option points to the path that stores the container ID.
     • The %t is the path to the run time directory root, for example /run/user/$UserID.
     • The %n is the full name of the service.

7. Copy unit files to /etc/systemd/system for installing them as a root user:

   # cp -Z container-httpd.service /etc/systemd/system

8. Enable and start the container-httpd.service:

   # systemctl daemon-reload
   # systemctl enable --now container-httpd.service
   Created symlink /etc/systemd/system/multi-user.target.wants/container-httpd.service → /etc/systemd/system/container-httpd.service.
   Created symlink /etc/systemd/system/default.target.wants/container-httpd.service → /etc/systemd/system/container-httpd.service.

Procedure

1. Create an empty pod, for example named systemd-pod:

   $ podman pod create --name systemd-pod
   11d4646ba41b1fffa51c108cbdf97cfab3213f7bd9b3e1ca52fe81b90fed5577

2. Optional: List all pods:

   $ podman pod ps
   POD ID        NAME         STATUS   CREATED         # OF CONTAINERS  INFRA ID
   11d4646ba41b  systemd-pod  Created  40 seconds ago  1                8a428b257111
   11d4646ba41b1fffa51c108cbdf97cfab3213f7bd9b3e1ca52fe81b90fed5577

3. Create two containers in the empty pod. For example, to create container0 and container1 in systemd-pod:

   $ *podman create --pod systemd-pod --name container0 registry.access.redhat.com/ubi*10 top
   $ *podman create --pod systemd-pod --name container1 registry.access.redhat.com/ubi*10 top

4. Optional: List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                   COMMAND  CREATED        STATUS         PORTS   NAMES               POD ID        PODNAME
   24666f47d9b2  registry.access.redhat.com/ubi10:latest  top      3 minutes ago  Created                container0          3130f724e229  systemd-pod
   56eb1bf0cdfe  k8s.gcr.io/pause:3.2                             4 minutes ago  Created                3130f724e229-infra  3130f724e229  systemd-pod
   62118d170e43  registry.access.redhat.com/ubi10:latest  top      3 seconds ago  Created                container1          3130f724e229  systemd-pod

5. Generate the systemd unit file for the new pod:

   $ podman generate systemd --files --name systemd-pod
   /home/user1/pod-systemd-pod.service
   /home/user1/container-container0.service
   /home/user1/container-container1.service

   Note that three systemd unit files are generated, one for the systemd-pod pod and two for the containers container0 and container1.

6. Display pod-systemd-pod.service unit file:

   $ cat pod-systemd-pod.service
   # pod-systemd-pod.service
   # autogenerated by Podman 3.3.1
   # Wed Sep  8 20:49:17 CEST 2021
   
   [Unit]
   Description=Podman pod-systemd-pod.service
   Documentation=man:podman-generate-systemd(1)
   Wants=network-online.target
   After=network-online.target
   RequiresMountsFor=
   Requires=container-container0.service container-container1.service
   Before=container-container0.service container-container1.service
   
   [Service]
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Restart=on-failure
   TimeoutStopSec=70
   ExecStart=/usr/bin/podman start bcb128965b8e-infra
   ExecStop=/usr/bin/podman stop -t 10 bcb128965b8e-infra
   ExecStopPost=/usr/bin/podman stop -t 10 bcb128965b8e-infra
   PIDFile=/run/user/1000/containers/overlay-containers/1dfdcf20e35043939ea3f80f002c65c00d560e47223685dbc3230e26fe001b29/userdata/conmon.pid
   Type=forking
   
   [Install]
   WantedBy=multi-user.target default.target

   • The Requires line in the [Unit] section defines dependencies on container-container0.service and container-container1.service unit files. Both unit files will be activated.
   • The ExecStart and ExecStop lines in the [Service] section start and stop the infra-container, respectively.

7. Display container-container0.service unit file:

   $ cat container-container0.service
   # container-container0.service
   # autogenerated by Podman 3.3.1
   # Wed Sep  8 20:49:17 CEST 2021
   
   [Unit]
   Description=Podman container-container0.service
   Documentation=man:podman-generate-systemd(1)
   Wants=network-online.target
   After=network-online.target
   RequiresMountsFor=/run/user/1000/containers
   BindsTo=pod-systemd-pod.service
   After=pod-systemd-pod.service
   
   [Service]
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Restart=on-failure
   TimeoutStopSec=70
   ExecStart=/usr/bin/podman start container0
   ExecStop=/usr/bin/podman stop -t 10 container0
   ExecStopPost=/usr/bin/podman stop -t 10 container0
   PIDFile=/run/user/1000/containers/overlay-containers/4bccd7c8616ae5909b05317df4066fa90a64a067375af5996fdef9152f6d51f5/userdata/conmon.pid
   Type=forking
   
   [Install]
   WantedBy=multi-user.target default.target

   • The BindsTo line line in the [Unit] section defines the dependency on the pod-systemd-pod.service unit file
   • The ExecStart and ExecStop lines in the [Service] section start and stop the container0 respectively.

8. Display container-container1.service unit file:

   $ cat container-container1.service

9. Copy all the generated files to $HOME/.config/systemd/user for installing as a non-root user:

   $ cp pod-systemd-pod.service container-container0.service container-container1.service $HOME/.config/systemd/user

10. Enable the service and start at user login:

    $ systemctl enable --user pod-systemd-pod.service
    Created symlink /home/user1/.config/systemd/user/multi-user.target.wants/pod-systemd-pod.service → /home/user1/.config/systemd/user/pod-systemd-pod.service.
    Created symlink /home/user1/.config/systemd/user/default.target.wants/pod-systemd-pod.service → /home/user1/.config/systemd/user/pod-systemd-pod.service.

    Note that the service stops at user logout.

Procedure

1. Start a myubi container based on the registry.access.redhat.com/ubi10/ubi-init image:

   # podman run --label "io.containers.autoupdate=image" \
   --name myubi -dt registry.access.redhat.com/ubi10/ubi-init top
   bc219740a210455fa27deacc96d50a9e20516492f1417507c13ce1533dbdcd9d

2. Optional: List containers that are running or have exited:

   # podman ps -a
   CONTAINER ID  IMAGE                                            COMMAND  CREATED         STATUS             PORTS   NAMES
   76465a5e2933  registry.access.redhat.com/10/ubi-init:latest  top      24 seconds ago  Up 23 seconds ago          myubi

3. Generate a systemd unit file for the myubi container:

   # podman generate systemd --new --files --name myubi
   /root/container-myubi.service

4. Copy unit files to /usr/lib/systemd/system for installing it as a root user:

   # cp -Z ~/container-myubi.service /usr/lib/systemd/system

5. Reload systemd manager configuration:

   # systemctl daemon-reload

6. Start and check the status of a container:

   # systemctl start container-myubi.service
   # systemctl status container-myubi.service

7. Auto-update the container:

   # podman auto-update

   For more information, see the podman-generate-systemd(1) and systemctl(1) man pages on your system.

Procedure

1. Display the podman-auto-update.service unit file:

   # cat /usr/lib/systemd/system/podman-auto-update.service
   
   [Unit]
   Description=Podman auto-update service
   Documentation=man:podman-auto-update(1)
   Wants=network.target
   After=network-online.target
   
   [Service]
   Type=oneshot
   ExecStart=/usr/bin/podman auto-update
   
   [Install]
   WantedBy=multi-user.target default.target

2. Display the podman-auto-update.timer unit file:

   # cat /usr/lib/systemd/system/podman-auto-update.timer
   
   [Unit]
   Description=Podman auto-update timer
   
   [Timer]
   OnCalendar=daily
   Persistent=true
   
   [Install]
   WantedBy=timers.target

   In this example, the podman auto-update command is launched daily at midnight.

3. Enable the podman-auto-update.timer service at system start:

   # systemctl enable podman-auto-update.timer

4. Start the systemd service:

   # systemctl start podman-auto-update.timer

5. Optional: List all timers:

   # systemctl list-timers --all
   NEXT                         LEFT      LAST                         PASSED       UNIT                         ACTIVATES
   Wed 2020-12-09 00:00:00 CET  9h left   n/a                          n/a          podman-auto-update.timer     podman-auto-update.service

   You can see that podman-auto-update.timer activates the podman-auto-update.service.

Procedure

1. List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                       COMMAND    CREATED                 STATUS                     PORTS  NAMES               POD
   5df5c48fea87  registry.access.redhat.com/ubi10/ubi:latest  /bin/bash  Less than a second ago  Up Less than a second ago         myubi               223df6b390b4
   3afdcd93de3e  k8s.gcr.io/pause:3.1                                   Less than a second ago  Up Less than a second ago         223df6b390b4-infra  223df6b390b4

2. Use the pod name or ID to generate the Kubernetes YAML file:

   $ podman generate kube mypod > mypod.yaml

   Note that the podman generate command does not reflect any Logical Volume Manager (LVM) logical volumes or physical volumes that might be attached to the container.

3. Display the mypod.yaml file:

   $ cat mypod.yaml
   # Generation of Kubernetes YAML is still under development!
   #
   # Save the output of this file and use kubectl create -f to import
   # it into Kubernetes.
   #
   # Created with podman-1.6.4
   apiVersion: v1
   kind: Pod
   metadata:
     creationTimestamp: "2020-06-09T10:31:56Z"
     labels:
   app: mypod
     name: mypod
   spec:
     containers:
     - command:
           - /bin/bash
           env:
           - name: PATH
                 value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
           - name: TERM
                 value: xterm
           - name: HOSTNAME
           - name: container
                 value: oci
           image: registry.access.redhat.com/ubi10/ubi:latest
           name: myubi
           resources: {}
           securityContext:
                 allowPrivilegeEscalation: true
                 capabilities: {}
                 privileged: false
                 readOnlyRootFilesystem: false
           tty: true
           workingDir: /
   status: {}

Procedure

1. Create the pod and the container from the mypod.yaml file:

   $ podman play kube mypod.yaml
   Pod:
   b8c5b99ba846ccff76c3ef257e5761c2d8a5ca4d7ffa3880531aec79c0dacb22
   Container:
   848179395ebd33dd91d14ffbde7ae273158d9695a081468f487af4e356888ece

2. List all pods:

   $ podman pod ps
   POD ID         NAME    STATUS    CREATED          # OF CONTAINERS   INFRA ID
   b8c5b99ba846   mypod   Running   19 seconds ago   2                 aa4220eaf4bb

3. List all pods and containers associated with them:

   $ podman ps -a --pod
   CONTAINER ID  IMAGE                                       COMMAND    CREATED             STATUS                 PORTS  NAMES               POD
   848179395ebd  registry.access.redhat.com/ubi10/ubi:latest  /bin/bash  About a minute ago  Up About a minute ago         myubi               b8c5b99ba846
   aa4220eaf4bb  k8s.gcr.io/pause:3.1                                   About a minute ago  Up About a minute ago         b8c5b99ba846-infra  b8c5b99ba846

   The pod IDs from podman ps command matches the pod ID from the podman pod ps command.

   For more information, see the podman-play-kube(1) man page on your system.

Procedure

1. Display the mariadb-conf/Containerfile file:

   $ cat mariadb-conf/Containerfile
   FROM docker.io/library/mariadb
   COPY my.cnf /etc/mysql/my.cnf

2. Display the mariadb-conf/my.cnf file:

   [client-server]
   # Port or socket location where to connect
   port = 3306
   socket = /run/mysqld/mysqld.sock
   
   # Import all .cnf files from the configuration directory
   [mariadbd]
   skip-host-cache
   skip-name-resolve
   bind-address = 127.0.0.1
   
   !includedir /etc/mysql/mariadb.conf.d/
   !includedir /etc/mysql/conf.d/

3. Build the docker.io/library/mariadb image by using mariadb-conf/Containerfile:

   $ cd mariadb-conf
   $ podman build -t mariadb-conf .
   $ cd ..
   STEP 1: FROM docker.io/library/mariadb
   Trying to pull docker.io/library/mariadb:latest...
   Getting image source signatures
   Copying blob 7b1a6ab2e44d done
   ...
   Storing signatures
   STEP 2: COPY my.cnf /etc/mysql/my.cnf
   STEP 3: COMMIT mariadb-conf
   --> ffae584aa6e
   Successfully tagged localhost/mariadb-conf:latest
   ffae584aa6e733ee1cdf89c053337502e1089d1620ff05680b6818a96eec3c17

4. Optional: List all images:

   $ podman images
   LIST IMAGES
   REPOSITORY                                                       TAG         IMAGE ID      CREATED             SIZE
   localhost/mariadb-conf                                           latest      b66fa0fa0ef2  57 seconds ago      416 MB

5. Create the pod named wordpresspod and configure port mappings between the container and the host system:

   $ podman pod create --name wordpresspod -p 8080:80

6. Create the mydb container inside the wordpresspod pod:

   $ podman run --detach --pod wordpresspod \
       -e MYSQL_ROOT_PASSWORD=1234 \
       -e MYSQL_DATABASE=mywpdb \
       -e MYSQL_USER=mywpuser \
       -e MYSQL_PASSWORD=1234 \
       --name mydb localhost/mariadb-conf

7. Create the myweb container inside the wordpresspod pod:

   $ podman run --detach --pod wordpresspod \
       -e WORDPRESS_DB_HOST=127.0.0.1 \
       -e WORDPRESS_DB_NAME=mywpdb \
       -e WORDPRESS_DB_USER=mywpuser \
       -e WORDPRESS_DB_PASSWORD=1234 \
       --name myweb docker.io/wordpress

8. Optional: List all pods and containers associated with them:

   $ podman ps --pod -a
   CONTAINER ID  IMAGE                               COMMAND               CREATED                 STATUS                     PORTS                 NAMES               POD ID        PODNAME
   9ea56f771915  k8s.gcr.io/pause:3.5                                      Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  4b7f054a6f01-infra  4b7f054a6f01  wordpresspod
   60e8dbbabac5  localhost/mariadb-conf:latest       mariadbd              Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  mydb                4b7f054a6f01  wordpresspod
   045d3d506e50  docker.io/library/wordpress:latest  apache2-foregroun...  Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  myweb               4b7f054a6f01  wordpresspod

Procedure

1. List all pods and containers associated with them:

   $ podman ps --pod -a
   CONTAINER ID  IMAGE                               COMMAND               CREATED                 STATUS                     PORTS                 NAMES               POD ID        PODNAME
   9ea56f771915  k8s.gcr.io/pause:3.5                                      Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  4b7f054a6f01-infra  4b7f054a6f01  wordpresspod
   60e8dbbabac5  localhost/mariadb-conf:latest       mariadbd              Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  mydb                4b7f054a6f01  wordpresspod
   045d3d506e50  docker.io/library/wordpress:latest  apache2-foregroun...  Less than a second ago  Up Less than a second ago  0.0.0.0:8080->80/tcp  myweb               4b7f054a6f01  wordpresspod

2. Use the pod name or ID to generate the Kubernetes YAML file:

   $ podman generate kube wordpresspod >> wordpresspod.yaml

1. a directory with the same name as the image used in YAML file exists
2. that directory contains a Containerfile

Procedure

1. To repeat the whole scenario from the beginning, delete locally stored images:

   $ podman rmi localhost/mariadb-conf
   $ podman rmi docker.io/library/wordpress
   $ podman rmi docker.io/library/mysql

2. Create the wordpress pod by using the wordpress.yaml file:

   $ podman play kube wordpress.yaml
   STEP 1/2: FROM docker.io/library/mariadb
   STEP 2/2: COPY my.cnf /etc/mysql/my.cnf
   COMMIT localhost/mariadb-conf:latest
   --> 428832c45d0
   Successfully tagged localhost/mariadb-conf:latest
   428832c45d07d78bb9cb34e0296a7dc205026c2fe4d636c54912c3d6bab7f399
   Trying to pull docker.io/library/wordpress:latest...
   Getting image source signatures
   Copying blob 99c3c1c4d556 done
   ...
   Storing signatures
   Pod:
   3e391d091d190756e655219a34de55583eed3ef59470aadd214c1fc48cae92ac
   Containers:
   6c59ebe968467d7fdb961c74a175c88cb5257fed7fb3d375c002899ea855ae1f
   29717878452ff56299531f79832723d3a620a403f4a996090ea987233df0bc3d

   The podman play kube command:

   • Automatically build the localhost/mariadb-conf:latest image based on docker.io/library/mariadb image.
   • Pull the docker.io/library/wordpress:latest image.
   • Create a pod named wordpresspod with two containers named wordpresspod-mydb and wordpresspod-myweb.

3. List all containers and pods:

   $ podman ps --pod -a
   CONTAINER ID  IMAGE                               COMMAND               CREATED        STATUS                    PORTS                 NAMES               POD ID        PODNAME
   a1dbf7b5606c  k8s.gcr.io/pause:3.5                                      3 minutes ago  Up 2 minutes ago          0.0.0.0:8080->80/tcp  3e391d091d19-infra  3e391d091d19  wordpresspod
   6c59ebe96846  localhost/mariadb-conf:latest       mariadbd              2 minutes ago  Exited (1) 2 minutes ago  0.0.0.0:8080->80/tcp  wordpresspod-mydb   3e391d091d19  wordpresspod
   29717878452f  docker.io/library/wordpress:latest  apache2-foregroun...  2 minutes ago  Up 2 minutes ago          0.0.0.0:8080->80/tcp  wordpresspod-myweb  3e391d091d19  wordpresspod

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configure Podman registries with RHEL system roles
     hosts: managed-node-01.example.com
     vars:
       podman_registries_conf:
         unqualified-search-registries:
           - "registry.access.redhat.com"
           - "docker.io"
           - "my-company-registry.com"
         registry:
           - location: "my-company-registry.com"
           - location: "my-local-registry:5000"
             insecure: true
     tasks:
       - name: Include the podman system role
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.podman

   The settings specified in the example playbook include the following:

   • unqualified-search-registries: Extends the list of registries Podman searches when you use a short image name (for example, podman pull <my-image>). Podman searches for images in my-company-registry.com after the default registries.
   • [registry]: Defines specific properties for a given registry. For example, you can enable an insecure connection by setting insecure=true to a local registry running at my-local-registry:5000.

   The podman_use_new_toml_formatter variable generates TOML-compliant configuration files that are compatible with Podman. This variable enhances the Podman role by supporting all TOML features, including tables and inline tables, through a true TOML formatter instead of the Jinja template used previously.

   The new formatter is disabled by default to maintain compatibility with the previous formatter’s behavior. To enable the new formatter, set podman_use_new_toml_formatter: true in your configuration:

   podman_use_new_toml_formatter: true
   podman_containers_conf:
     containers:
       annotations:
         - environment=production
         - status=tier2

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. Run the podman info command on the host:

   $ ansible managed-node-01.example.com -m command -a 'podman info'

2. Verify the registeries section:

   registries:
     my-company-registry.com:
       Blocked: false
       Insecure: false
       Location: my-company-registry.com
       MirrorByDigestOnly: false
       Mirrors: null
       Prefix: my-company-registry.com
       PullFromMirror: ""
     my-local-registry:5000:
       Blocked: false
       Insecure: true
       Location: my-local-registry:5000
       MirrorByDigestOnly: false
       Mirrors: null
       Prefix: my-local-registry:5000
       PullFromMirror: ""
     search:
     - registry.access.redhat.com
     - docker.io
     - my-company-registry.com

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   - name: Configure Podman
     hosts: managed-node-01.example.com
     tasks:
       - name: Create a web application and a database
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.podman
         vars:
           podman_create_host_directories: true
           podman_firewall:
             - port: 8080-8081/tcp
               state: enabled
             - port: 12340/tcp
               state: enabled
           podman_selinux_ports:
             - ports: 8080-8081
               setype: http_port_t
           podman_kube_specs:
             - state: started
               run_as_user: dbuser
               run_as_group: dbgroup
               kube_file_content:
                 apiVersion: v1
                 kind: Pod
                 metadata:
                   name: db
                 spec:
                   containers:
                     - name: db
                       image:  quay.io/rhel-system-roles/mysql:5.6
                       ports:
                         - containerPort: 1234
                           hostPort: 12340
                       volumeMounts:
                         - mountPath: /var/lib/db:Z
                           name: db
                   volumes:
                     - name: db
                       hostPath:
                         path: /var/lib/db
             - state: started
               run_as_user: webapp
               run_as_group: webapp
               kube_file_src: /path/to/webapp.yml

   The settings specified in the example playbook include the following:

   run_as_user and run_as_group

   Specify that containers are rootless.

   kube_file_content

   Contains a Kubernetes YAML file defining the first container named db. You can generate the Kubernetes YAML file by using the podman kube generate command.

   • The db container is based on the quay.io/db/db:stable container image.
   • The db bind mount maps the /var/lib/db directory on the host to the /var/lib/db directory in the container. The Z flag labels the content with a private unshared label, therefore, only the db container can access the content.

   kube_file_src: <path>

   Defines the second container. The content of the /path/to/webapp.yml file on the controller node will be copied to the kube_file field on the managed node.

   volumes: <list>

   A YAML list to define the source of the data to provide in one or more containers. For example, a local disk on the host (hostPath) or other disk device.

   volumeMounts: <list>

   A YAML list to define the destination where the individual container will mount a given volume.

   podman_create_host_directories: true

   Creates the directory on the host. This instructs the role to check the kube specification for hostPath volumes and create those directories on the host. If you need more control over the ownership and permissions, use podman_host_directories.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.podman/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check --ask-vault-pass ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook --ask-vault-pass ~/playbook.yml

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   - name: Configure Podman
     hosts: managed-node-01.example.com
     tasks:
       - name: Start Apache server on port 8080
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.podman
     vars:
       podman_firewall:
         - port: 8080/tcp
           state: enabled
       podman_kube_specs:
         - state: started
           kube_file_content:
             apiVersion: v1
             kind: Pod
             metadata:
               name: ubi10-httpd
             spec:
               containers:
                 - name: ubi10-httpd
                   image: registry.access.redhat.com/ubi10/httpd-24
                   ports:
                     - containerPort: 8080
                       hostPort: 8080
                   volumeMounts:
                     - mountPath: /var/www/html:Z
                       name: ubi10-html
               volumes:
                 - name: ubi10-html
                   persistentVolumeClaim:
                     claimName: ubi10-html-volume

   The settings specified in the example playbook include the following:

   kube_file_content

   Contains a Kubernetes YAML file defining the first container named db. You can generate the Kubernetes YAML file by using the podman kube generate command.

   • The ubi10-httpd container is based on the registry.access.redhat.com/ubi10/httpd-24 container image.
   • The ubi10-html-volume maps the /var/www/html directory on the host to the container. The Z flag labels the content with a private unshared label, therefore, only the ubi10-httpd container can access the content.
   • The pod mounts the existing persistent volume named ubi10-html-volume with the mount path /var/www/html.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.podman/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Display the contents of the certificate and private key files:

   $ cat ~/certificate.pem
   -----BEGIN CERTIFICATE-----
   ...
   -----END CERTIFICATE-----
   
   $ cat ~/key.pem
   -----BEGIN PRIVATE KEY-----
   ...
   -----END PRIVATE KEY-----

   You require this information in a later step.

2. Store your sensitive variables in an encrypted file:

   1. Create the vault:

      $ ansible-vault create ~/vault.yml
      New Vault password: <vault_password>
      Confirm New Vault password: <vault_password>

   2. After the ansible-vault create command opens an editor, enter the sensitive data in the <key>: <value> format:

      root_password: <root_password>
      certificate: |-
        -----BEGIN CERTIFICATE-----
        ...
        -----END CERTIFICATE-----
      key: |-
        -----BEGIN PRIVATE KEY-----
        ...
        -----END PRIVATE KEY-----

      Ensure that all lines in the certificate and key variables start with two spaces.

   3. Save the changes, and close the editor. Ansible encrypts the data in the vault.

3. Create a playbook file, for example, ~/playbook.yml, with the following content:

   - name: Deploy a wordpress CMS with MySQL database
     hosts: managed-node-01.example.com
     vars_files:
       - ~/vault.yml
     tasks:
     - name: Create and run the container
       ansible.builtin.include_role:
         name: redhat.rhel_system_roles.podman
       vars:
         podman_create_host_directories: true
         podman_activate_systemd_unit: false
         podman_quadlet_specs:
           - name: quadlet-demo
             type: network
             file_content: |
               [Network]
               Subnet=192.168.30.0/24
               Gateway=192.168.30.1
               Label=app=wordpress
           - file_src: quadlet-demo-mysql.volume
           - template_src: quadlet-demo-mysql.container.j2
           - file_src: envoy-proxy-configmap.yml
           - file_src: quadlet-demo.yml
           - file_src: quadlet-demo.kube
             activate_systemd_unit: true
         podman_firewall:
           - port: 8000/tcp
             state: enabled
           - port: 9000/tcp
             state: enabled
         podman_secrets:
           - name: mysql-root-password-container
             state: present
             skip_existing: true
             data: "{{ root_password }}"
           - name: mysql-root-password-kube
             state: present
             skip_existing: true
             data: |
               apiVersion: v1
               data:
                 password: "{{ root_password | b64encode }}"
               kind: Secret
               metadata:
                 name: mysql-root-password-kube
           - name: envoy-certificates
             state: present
             skip_existing: true
             data: |
               apiVersion: v1
               data:
                 certificate.key: {{ key | b64encode }}
                 certificate.pem: {{ certificate | b64encode }}
               kind: Secret
               metadata:
                 name: envoy-certificates

   The procedure creates a WordPress content management system paired with a MySQL database. The podman_quadlet_specs role variable defines a set of configurations for the Quadlet, which refers to a group of containers or services that work together in a certain way. It includes the following specifications:

   • The Wordpress network is defined by the quadlet-demo network unit.
   • The volume configuration for MySQL container is defined by the file_src: quadlet-demo-mysql.volume field.
   • The template_src: quadlet-demo-mysql.container.j2 field is used to generate a configuration for the MySQL container.
   • Two YAML files follow: file_src: envoy-proxy-configmap.yml and file_src: quadlet-demo.yml. Note that .yml is not a valid Quadlet unit type, therefore these files will just be copied and not processed as a Quadlet specification.

   • The Wordpress and envoy proxy containers and configuration are defined by the file_src: quadlet-demo.kube field. The kube unit refers to the previous YAML files in the [Kube] section as Yaml=quadlet-demo.yml and ConfigMap=envoy-proxy-configmap.yml.

     For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.podman/README.md file on the control node.

4. Validate the playbook syntax:

   $ ansible-playbook --syntax-check --ask-vault-pass ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

5. Run the playbook:

   $ ansible-playbook --ask-vault-pass ~/playbook.yml

Procedure

1. Log in to the RHEL 10 web console.
2. Click Podman containers in the main menu.
3. In the Images table, click the overflow menu in the upper-right corner and select Download new image.
4. The Search for an image dialog box appears.
5. In the Search for field, enter the name of the image or specify its description.
6. In the in drop-down list, select the registry from which you want to pull the image.
7. Optional: In the Tag field, enter the tag of the image.
8. Click Download.

Procedure

1. Log in to the RHEL 10 web console.
2. Click Podman containers in the main menu.
3. In the Images table, click the overflow menu in the upper-right corner and select Prune unused images.
4. The window with the list of images appears. Click Prune to confirm your choice.

Procedure

1. Log in to the RHEL 10 web console.
2. Click the Podman containers button in the main menu.
3. In the Images table, select the image you want to delete and click the overflow menu and select Delete.
4. In the following dialog, click Delete tagged images to confirm your choice.

Procedure

1. Log in to the RHEL 10 web console.
2. Click Podman containers in the main menu.
3. In the Containers table, select the container you want to modify and click the overflow icon menu and select Checkpoint.

4. Optional: In the Checkpoint container form, check the options you need:

   • Keep all temporary checkpoint files: keep all temporary log and statistics files created by CRIU during checkpointing. These files are not deleted if checkpointing fails for further debugging.
   • Leave running after writing checkpoint to disk: leave the container running after checkpointing instead of stopping it.
   • Support preserving established TCP connections
5. Click Checkpoint.