Understand containers, images and registries

$ run as a normal user# run as root (or with sudo)

Compare containers and VMs

A VM has its own kernel and a full OS. A container shares the host's kernel and only carries the app and its libraries.

	Virtual machine	Container
Starts in	Minutes	Seconds or less
Size	GBs	MBs
Kernel	Own	Shared with the host
Isolation	Strong (hypervisor)	Kernel features (namespaces, cgroups, SELinux)
Good for	Different OSes, strong separation	Many small services, CI, fast deploys

1.2

Know the Linux features behind it

Containers are built from kernel features, not magic.

Feature	Gives the container
Namespaces	Own PIDs, network, mounts, host name, users
cgroups	Limits for CPU, memory, I/O, number of processes
Capabilities	Only some root powers, not all
seccomp	A filter on system calls
SELinux / AppArmor	Labels that stop escapes to host files
Overlay file system	Image layers + one writable layer

1.3

Understand images and layers

An image is a stack of read-only layers (one per build step) plus metadata (start command, ports, user). A container adds one thin writable layer on top.

$docker pull nginx:1.27
$docker image history nginx:1.27
$docker image inspect nginx:1.27 --format '{{.Config.ExposedPorts}} {{.Config.User}}'
$podman pull registry.access.redhat.com/ubi10/ubi

Remember

Delete a container and its writable layer is gone. Data that must stay goes into a volume: Keep data with volumes.

1.4

Know registries and names

A full image name is REGISTRY/NAMESPACE/NAME:TAG (or @sha256:DIGEST).

Registry	Example
Docker Hub	`docker.io/library/nginx:1.27`
GitHub Container Registry	`ghcr.io/s0sta/shop:1.0`
Red Hat	`registry.access.redhat.com/ubi10/ubi`
Azure Container Registry	`acrshop2026.azurecr.io/shop:1.0`
Quay	`quay.io/s0sta/web-bootc:1.0`

Watch out

latest is just a tag name, not "the newest". It can change any time. Use fixed tags or digests in production.

1.5

Know the standards and tools

The OCI (Open Container Initiative) standards make images and runtimes work across tools.

Tool	Role
Docker Engine (`docker`)	Daemon + CLI, the most known tool
Podman (`podman`)	Daemonless, rootless, RHEL default (command page)
Buildah	Build images without a daemon
Skopeo	Inspect and copy images in registries (command page)
containerd / CRI-O	Runtimes used by Kubernetes
runc / crun	The low-level runtime that starts the process

$docker version
$podman info --format '{{.Host.OCIRuntime.Name}}'

At work

On RHEL, dnf install podman-docker gives a docker command that runs Podman — most scripts work unchanged.

All commands in this chapter