Build and run containers and Kubernetes

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Containers and Kubernetes — 7

Docker — build and run containers

docker builds images from a Dockerfile and runs them as containers. On RHEL, podman does the same without a daemon.

Used for: building images in CI, local development, Docker Compose stacks.

$docker build -t ghcr.io/s0sta/shop:1.4.0 .
$docker run -d --name shop -p 127.0.0.1:8080:8080 ghcr.io/s0sta/shop:1.4.0
$docker logs -f shop
$docker compose up -d

Security checklist:

The docker group = root on the host; prefer rootless Docker or podman.
No secrets in Dockerfiles or layers; use a .dockerignore.
Run as non-root (USER 1001), --read-only, --cap-drop ALL, pinned tags or digests.

3.2

kubectl — talk to Kubernetes

kubectl creates, reads, changes and debugs every object in a cluster through the API server.

Used for: everything in Kubernetes — and the main tool in the CKA, CKAD and CKS exams.

$kubectl get pods -A
$kubectl describe pod NAME -n shop
$kubectl logs NAME -n shop --previous
$kubectl rollout undo deployment/shop -n shop
$kubectl auth can-i create pods --as=system:serviceaccount:shop:ci -n shop

Security checklist:

Check the context before apply or delete.
A kubeconfig is a credential (chmod 600, never in Git).
Least-privilege RBAC for people and service accounts.

3.3

Helm — packages for Kubernetes

helm installs apps from charts (templates + values), keeps a release history and rolls back.

Used for: installing add-ons (ingress-nginx, cert-manager, Prometheus stack, Argo CD, Vault, Falco) and packaging your own apps.

$helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
$helm upgrade --install ingress ingress-nginx/ingress-nginx -n ingress-nginx --create-namespace --version 4.11.3 --atomic
$helm history ingress -n ingress-nginx
$helm template shop ./charts/shop > rendered.yaml && trivy config rendered.yaml

Security checklist:

Pin chart versions; read helm show values before you install.
No secrets in values files in Git.

3.4

k3s — a small real cluster

k3s is certified Kubernetes in one binary — perfect for the home lab and edge sites.

Used for: labs, CKA practice, small production clusters, IoT/edge.

#curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=v1.31.4+k3s1 sh -s - --secrets-encryption
#k3s kubectl get nodes
#k3s etcd-snapshot save --name before-upgrade

Security checklist:

Pin the version and read the install script.
/etc/rancher/k3s/k3s.yaml and the node token are secrets.

3.5

crictl — look at containers on a node

crictl talks to containerd or CRI-O directly — it works even when the API server is down.

Used for: node troubleshooting; finding why a control-plane static pod does not start (CKA).

#crictl ps -a --name kube-apiserver
#crictl logs CONTAINER_ID
#crictl pods --namespace shop

3.6

Kustomize — one base, many environments

kustomize changes plain YAML per environment with overlays (namespace, image tag, replicas, patches) — no templates.

Used for: dev/test/prod differences in GitOps repos; built into kubectl apply -k, Argo CD and Flux.

$kustomize build overlays/prod | less
$kubectl diff -k overlays/prod
$kustomize edit set image ghcr.io/s0sta/shop=ghcr.io/s0sta/shop:1.5.0

3.7

kind — throwaway clusters for tests

kind runs Kubernetes nodes as containers, so CI pipelines and laptops get a real cluster in a minute.

Used for: testing manifests, Helm charts and operators in CI; quick exam practice.

$kind create cluster --name lab --image kindest/node:v1.31.2
$kind load docker-image shop:dev --name lab
$kind delete cluster --name lab

At work

The pair to master first is docker + kubectl. Then helm for third-party apps and kustomize for your own apps.

All commands in this chapter