20장. Running special container images
You can run some special types of container images. Some container images have built-in labels called runlabels that enable you to run those containers with preset options and arguments. The podman container runlabel <label> command, you can execute the command defined in the <label> for the container image. Supported labels are install, run and uninstall.
20.1. Opening privileges to the host 링크 복사링크가 클립보드에 복사되었습니다!
There are several differences between privileged and non-privileged containers. For example, the toolbox container is a privileged container. Here are examples of privileges that may or may not be open to the host from a container:
-
Privileges: A privileged container disables the security features that isolate the container from the host. You can run a privileged container by using the
podman run --privileged <image_name>command. You can, for example, delete files and directories mounted from the host that are owned by the root user. -
Process tables: You can use the
podman run --privileged --pid=host <image_name>command to use the host PID namespace for the container. Then you can use theps -ecommand within a privileged container to list all processes running on the host. You can pass a process ID from the host to commands that run in the privileged container (for example,kill <PID>). -
Network interfaces: By default, a container has only one external network interface and one loopback network interface. You can use the
podman run --net=host <image_name>command to access host network interfaces directly from within the container. -
Inter-process communications: The IPC facility on the host is accessible from within the privileged container. You can run commands such as
ipcsto see information about active message queues, shared memory segments, and semaphore sets on the host.