RH134 Ch 11: Running Containers with Podman

A container is a process isolated with namespaces and cgroups, started from an image that holds the application and its files. Podman runs containers without a central daemon and lets ordinary users run rootless containers in their own storage.

Images. Registries are configured in /etc/containers/registries.conf. Authenticate with podman login registry.redhat.io, then:

bash podman search httpd skopeo inspect docker://registry.access.redhat.com/ubi10/ubi-minimal podman pull registry.access.redhat.com/ubi10/ubi-minimal podman images

Running.

bash podman run -d --name docs -p 8080:8000 -v /srv/docs:/var/www:Z \ -e APPENV=training localhost/webasha/pyweb:1.0 podman ps -a podman logs docs podman exec -it docs /bin/bash podman stop docs; podman rm docs

-d detaches, -p host:container publishes a port, -v host:container mounts persistent storage (:Z gives it a private SELinux label) and -e sets environment variables. Containers are disposable: keep data in volumes, not inside the container.

Containers as services. To start a container at boot, let systemd manage it. The recommended way is Quadlet: write a .container file and systemd generates the service.

/etc/containers/systemd/webdocs.container (rootless: ~/.config/containers/systemd/) [Container] Image=localhost/webasha/pyweb:1.0 ContainerName=webdocs PublishPort=8081:8000 Volume=/srv/docs:/var/www:Z

[Install] WantedBy=multi-user.target default.target for user services

Then systemctl daemon-reload && systemctl start webdocs. For a rootless service, the user runs systemctl --user daemon-reload / start, and root runs loginctl enable-linger <user so the user's services start at boot without a login. The older podman generate systemd --new --files --name web still works but is deprecated.

Common exam mistakes - Running the service as root when the task asks for a rootless container for a user (or the reverse). - Forgetting enable-linger, so a user service stops at logout. - Logging in with su and getting an empty systemctl --user session — log in over ssh user@localhost instead. - Not making a mounted host directory writable/labelled for the container.

In this lab the container's own kernel has no user session manager, so the systemd exercise uses a system-level Quadlet; on a real RHEL 10 host the rootless version works as described.