s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

Chapter 4Name in the course: Container images

Build and move container images

The container image is the package that goes from CI to production. A DevOps engineer builds it small and repeatable, tags it clearly, and moves it between registries. Docker is the best known tool; the Red Hat tools Podman, Buildah and Skopeo do the same work without a daemon.

  • 5 Lessons
  • 5 Commands

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

  • Container images — 4

4.1

Docker — build and run images

docker builds images from a Dockerfile and runs containers; docker compose runs a small stack.

  • Used for: local development, CI builds, simple servers.
docker build -t ghcr.io/acme/shop:1.4.0 .
docker run --rm -p 8080:8080 ghcr.io/acme/shop:1.4.0
docker compose up -d && docker compose logs -f
docker push ghcr.io/acme/shop:1.4.0

Good practice:

  • Multi-stage builds; small base images; a non-root USER.
  • Tag with the version or commit (:1.4.0, :a1b2c3d), not only latest.
  • .dockerignore keeps .git and secrets out of the build.

4.2

Podman — Docker without a daemon

podman runs containers rootless and without a background daemon; the commands are the same as docker.

  • Used for: RHEL servers, rootless containers, systemd services from containers.
podman run -d --name web -p 8080:8080 ghcr.io/acme/shop:1.4.0
podman ps
podman generate systemd --new --name web > ~/.config/systemd/user/web.service
systemctl --user enable --now web

4.3

Buildah — build images in CI safely

buildah builds images without a daemon and without root — no privileged docker-in-docker.

buildah build -t shop:1.4.0 .
buildah build --isolation chroot -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA .
buildah push shop:1.4.0 docker://ghcr.io/acme/shop:1.4.0

4.4

Skopeo — copy and inspect images

skopeo reads and copies images between registries without pulling them.

skopeo inspect docker://ghcr.io/acme/shop:1.4.0
skopeo copy docker://ghcr.io/acme/shop:1.4.0 docker://registry.internal/shop:1.4.0
skopeo list-tags docker://ghcr.io/acme/shop

Good practice:

  • Promote the same image (same digest) from staging to production with skopeo copy; do not rebuild.

4.5

Make images small and fast

Small images pull faster, start faster and have fewer things to patch.

  1. Order the Dockerfile from rarely to often changed: base, packages, dependencies, then code.
  2. Copy the lock file first and install dependencies before COPY . . — the layer cache does the rest.
  3. Multi-stage: compile in a big image, copy only the result into distroless, alpine or ubi-minimal.
  4. One process per container; logs to stdout.
  5. Rebuild often to get base image fixes.

Remember

An image name with a digest (shop@sha256:…) points to exactly one image forever; a tag can move.

All commands in this chapter