Run containers with Podman

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

المهارات في هذا الفصل

تشغيل الحاويات باستخدام Podman وتشغيلها كخدمات systemd

Know images, containers and registries

An image is a read-only template. A container is a running copy of an image. A registry stores images.

Word	Meaning
Image	Files + settings, in layers. Example: `registry.access.redhat.com/ubi10/ubi`
Container	A process (or a few) started from an image, with its own file system, network and PIDs
Registry	A server for images: `registry.redhat.io`, `registry.access.redhat.com`, `quay.io`
UBI	Universal Base Image: free RHEL-based images you may share
Rootless	Containers run as a normal user — no root rights on the host

#dnf install container-tools
$podman --version
$podman info --format '{{.Host.Security.Rootless}}'
true

17.2

Find and pull images

Search the registries, look at an image before you download it, then pull it.

$podman login registry.redhat.io
$podman search registry.access.redhat.com/ubi10
$skopeo inspect docker://registry.access.redhat.com/ubi10/httpd-24 | head -20
$podman pull registry.access.redhat.com/ubi10/ubi
$podman pull registry.access.redhat.com/ubi10/httpd-24
$podman images
REPOSITORY                                  TAG     IMAGE ID      CREATED      SIZE
registry.access.redhat.com/ubi10/httpd-24   latest  5c1d2e3f4a5b  2 weeks ago  320 MB
registry.access.redhat.com/ubi10/ubi        latest  9a8b7c6d5e4f  2 weeks ago  215 MB
$podman image inspect ubi10/httpd-24 --format '{{.Config.ExposedPorts}}'
map[8080/tcp:{} 8443/tcp:{}]
$podman rmi registry.access.redhat.com/ubi10/ubi

/etc/containers/registries.conf

unqualified-search-registries = ["registry.access.redhat.com", "registry.redhat.io", "docker.io"]

تذكّر

Always use the full name (registry/namespace/name:tag). A short name like httpd may pull a different image from a registry you did not plan.

ملاحظة

registry.access.redhat.com (UBI) needs no login. registry.redhat.io needs your Red Hat account (podman login).

17.3

Run a container

podman run creates and starts a container. -d runs it in the background, -p publishes a port, --name gives it a name.

$podman run --rm -it registry.access.redhat.com/ubi10/ubi cat /etc/os-release
$podman run -d --name web -p 8080:8080 registry.access.redhat.com/ubi10/httpd-24
$podman ps
CONTAINER ID  IMAGE                                             COMMAND               CREATED        STATUS        PORTS                   NAMES
1a2b3c4d5e6f  registry.access.redhat.com/ubi10/httpd-24:latest  /usr/bin/run-http...  5 seconds ago  Up 5 seconds  0.0.0.0:8080->8080/tcp  web
$curl -s http://localhost:8080/ | head -3
$podman run -d --name app -e APP_ENV=prod -e TZ=Asia/Riyadh registry.access.redhat.com/ubi10/ubi sleep infinity

Option	Meaning
`-d`	Detached: run in the background
`-it`	Interactive with a terminal (for a shell)
`--rm`	Delete the container when it stops
`--name NAME`	A name instead of a random one
`-p HOST:CONTAINER`	Publish a port: `8080:8080`
`-e VAR=value`	Set an environment variable
`-v HOSTDIR:DIR:Z`	Mount a host folder (with the right SELinux label)

انتبه

A rootless container can not use host ports below 1024. Publish 8080 instead of 80, or open port 80 in the firewall and forward it.

17.4

Manage running containers

Look into a container, read its logs, run a command in it, stop and remove it.

$podman ps -a
$podman logs web
$podman logs -f --tail 20 web
$podman exec -it web /bin/bash
$podman exec web cat /etc/httpd/conf/httpd.conf | grep ^Listen
Listen 0.0.0.0:8080
$podman top web
$podman stats --no-stream
$podman inspect web --format '{{.NetworkSettings.Ports}}'
$podman stop web
$podman start web
$podman restart web
$podman rm web
$podman rm -f app
$podman container prune

17.5

Keep data in a volume

A container's file system is lost when the container is removed. Keep data in a host folder (bind mount) or a named volume. On RHEL add :Z so SELinux labels the folder for the container.

$mkdir -p ~/web/html
$echo "Hello from Podman" > ~/web/html/index.html
$podman run -d --name web -p 8080:8080 -v ~/web/html:/var/www/html:Z registry.access.redhat.com/ubi10/httpd-24
$curl -s http://localhost:8080/
Hello from Podman
$ls -dZ ~/web/html
system_u:object_r:container_file_t:s0:c123,c456 /home/student/web/html
$podman volume create dbdata
$podman volume ls
$podman volume inspect dbdata --format '{{.Mountpoint}}'

تذكّر

Without :Z, SELinux blocks the container from the host folder and you get Permission denied — even with chmod 777.

17.6

Build your own image

A Containerfile (same format as a Dockerfile) lists the steps: base image, files, packages, the start command. podman build makes the image.

~/myweb/Containerfile

FROM registry.access.redhat.com/ubi10/httpd-24
COPY index.html /var/www/html/index.html
LABEL maintainer="s0sta" description="Small demo web site"
EXPOSE 8080

$cd ~/myweb
$echo "<h1>myweb version 1</h1>" > index.html
$podman build -t localhost/myweb:1.0 .
$podman images localhost/myweb
$podman run -d --name myweb -p 8081:8080 localhost/myweb:1.0
$curl -s http://localhost:8081/
$podman tag localhost/myweb:1.0 quay.io/s0sta/myweb:1.0
$podman push quay.io/s0sta/myweb:1.0

Instruction	Meaning
`FROM`	The base image
`RUN`	Run a command while building (for example `dnf -y install …`)
`COPY`	Copy files from the build folder into the image
`ENV`	Set an environment variable
`EXPOSE`	Document the port
`USER`	Run as this user
`CMD` / `ENTRYPOINT`	The command that starts when the container runs

17.7

Start a container at boot with Quadlet

Quadlet turns a small .container file into a systemd service. For a rootless container, put it in ~/.config/containers/systemd/.

~/.config/containers/systemd/myweb.container

[Unit]
Description=My web container
 
[Container]
Image=localhost/myweb:1.0
ContainerName=myweb
PublishPort=8081:8080
Volume=%h/web/html:/var/www/html:Z
 
[Service]
Restart=always
 
[Install]
WantedBy=default.target

$podman rm -f myweb
$systemctl --user daemon-reload
$systemctl --user start myweb.service
$systemctl --user status myweb.service
$podman ps
#loginctl enable-linger student
$journalctl --user -u myweb.service -n 20

daemon-reload makes the service myweb.service from the file. WantedBy=default.target starts it at boot — no systemctl enable needed (it does not work on generated units).
Linger keeps the user's services running without a login, also after a reboot.
For a container that runs as root, put the file in /etc/containers/systemd/ and use systemctl without --user.

نصيحة للامتحان

Check the result after a reboot: podman ps as the user must show the container running, without logging in first — that is what linger does.

ملاحظة

The old way podman generate systemd still exists but is deprecated. Use Quadlet.

تدرّب

معمل 17.1Run a rootless web container as a systemd serviceمتوسط · 45 دقيقةلم يبدأ

تدرّب

كل الأوامر في هذا الفصل