18.7. Using Podman events for auditing

Procedure

1. Modify the ~/.config/containers/containers.conf file and add the events_container_create_inspect_data=true option to the [engine] section:

   $ cat ~/.config/containers/containers.conf
   [engine]
   events_container_create_inspect_data=true

   For the system-wide configuration, modify the /etc/containers/containers.conf or /usr/share/container/containers.conf file.

2. Create the container:

   $ podman create registry.access.redhat.com/ubi10/ubi:latest
   19524fe3c145df32d4f0c9af83e7964e4fb79fc4c397c514192d9d7620a36cd3

3. Display the Podman events:

   • Using the podman events command:

     $ now=$(date --iso-8601=seconds)
     $ podman events --since $now --stream=false --format "{{.ContainerInspectData}}" | jq ".Config.CreateCommand"
     [
       "/usr/bin/podman",
       "create",
       "registry.access.redhat.com/ubi10"
     ]

     • The --format "{{.ContainerInspectData}}" option displays the inspect data.
     • The jq ".Config.CreateCommand" transforms the JSON data into a more readable format and displays the parameters for the podman create command.

   • Using the journalctl command:

     $ journalctl --user -r PODMAN_EVENT=create --all -o json | jq ".PODMAN_CONTAINER_INSPECT_DATA | fromjson" | jq ".Config.CreateCommand"
     [
       "/usr/bin/podman",
       "create",
       "registry.access.redhat.com/ubi10"
     ]

     The output data for the podman events and journalctl commands are the same.

     For more information, see the podman-events(1) and containers.conf(5) man pages on your system.