Podman for DevOps: Containerization reimagined with Podman and its companion tools

Cover
Title
Copyright and Credits
Foreword
Table of Contents
Section 1: From Theory to Practice: Running Containers with Podman
Chapter 1: Introduction to Container Technology
	Technical requirements
	Book conventions
	What are containers?
		Resource usage with cgroups
		Running isolated processes
		Isolating mounts
		Container images to the rescue
		Security considerations
		Container engines and runtimes
		Containers versus virtual machines
	Why do I need a container?
		Open source
		Portability
		DevOps facilitators
		Cloud readiness
		Infrastructure optimization
		Microservices
		Chroot and Unix v7
		FreeBSD jails
		Solaris Containers (also known as Solaris Zones)
		Linux Containers (LXC)
		Docker
		rkt
		OCI and CRI-O
		Podman
	Where are containers used today?
	Summary
	Further reading
Chapter 2: Comparing Podman and Docker
	Technical requirements
	Docker container daemon architecture
		The Docker daemon
		Interacting with the Docker daemon
		The Docker REST API
		Docker client commands
		Docker images
		Docker registries
		What does a running Docker architecture look like?
		Containerd architecture
	Podman daemonless architecture
		Podman commands and REST API
		Podman building blocks
		The libpod library
		The runc and crun OCI container runtimes
		Conmon
		Rootless containers
		OCI images
	The main differences between Docker and Podman
		Command-line interface comparison
		Running a container
	Summary
	Further reading
Chapter 3: Running the First Container
	Technical requirements
	Choosing an operating system and installation method
		Choosing between Linux distributions and another OS
	Preparing your environment
		Customizing the container registries search list
		Optional – enable socket-based services
		Optional – customize Podman’s behavior
	Running your first container
		Interactive and pseudo-tty
		Detaching from a running container
		Network port publishing
		Configuration and environment variables
	Summary
	Further reading
Chapter 4: Managing Running Containers
	Technical requirements
	Managing container images
		Searching for images
		Pulling and viewing images
		Inspecting images' configurations and contents
		Deleting images
	Operations with running containers
		Viewing and handling container status
		Pausing and unpausing containers
		Inspecting processes inside containers
		Monitoring container stats
	Inspecting container information
	Capturing logs from containers
	Executing processes in a running container
	Running containers in pods
	Summary
Chapter 5: Implementing Storage for the Container's Data
	Technical requirements
	Why does storage matter for containers?
	Containers' storage features
		Storage driver
	Copying files in and out of a container
		Interacting with overlayfs
	Attaching host storage to a container
		Managing and attaching bind mounts to a container
		Managing and attaching volumes to a container
		SELinux considerations for mounts
		Attaching other types of storage to a container
	Summary
	Further reading
Section 2: Building Containers from Scratch with Buildah
Chapter 6: Meet Buildah – Building Containers from Scratch
	Technical requirements
	Basic image building with Podman
		Builds under the hood
		Dockerfile and Containerfile instructions
		Running builds with Podman
	Meet Buildah, Podman's companion tool for builds
	Preparing our environment
		Verifying the installation
		Buildah configuration files
	Choosing our build strategy
		Building a container image starting from an existing base image
		Building a container image starting from scratch
		Building a container image starting from a Dockerfile
	Building images from scratch
	Building images from a Dockerfile
	Summary
	Further reading
Chapter 7: Integrating with Existing Application Build Processes
	Technical requirements
	Multistage container builds
		Multistage builds with Dockerfiles
		Multistage builds with Buildah native commands
	Running Buildah inside a container
		Running rootless Buildah containers with volume stores
		Running Buildah containers with bind-mounted stores
		Running native Buildah commands inside containers
	Integrating Buildah in custom builders
		Including Buildah in our Go build tool
		Quarkus-native executables in containers
		A Buildah wrapper for the Rust language
	Summary
	Further readings
Chapter 8: Choosing the Container Base Image
	Technical requirements
	The Open Container Initiative image format
		OCI Image Manifest
	Where do container images come from?
		Docker Hub container registry service
		Quay container registry service
		Red Hat Ecosystem Catalog
	Trusted container image sources
		Managing trusted registries
	Introducing Universal Base Image
		The UBI Standard image
		The UBI Minimal image
		The UBI Micro image
		The UBI Init image
		Other UBI-based images
	Summary
	Further reading
Chapter 9: Pushing Images to a Container Registry
	Technical requirements
	What is a container registry?
		Repository management
		Pushing container images
		Tag management
		Pulling container images
		Authentication management
	Cloud-based and on-premise container registries
		On-premise container registries
		Cloud-based container registries
	Managing container images with Skopeo
		Installing Skopeo
		Verifying the installation
		Copying images across locations
		Inspecting remote images
		Synchronizing registries and local directories
		Deleting images
	Running a local container registry
		Running a containerized registry
		Customizing the registry configuration
		Using a local registry to sync repositories
		Managing registry garbage collection
	Summary
	Further reading
Section 3: Managing and Integrating Containers Securely
Chapter 10: Troubleshooting and Monitoring Containers
	Technical requirements
	Troubleshooting running containers
		Permission denied while using storage volumes
		Issues with the ping command in rootless containers
	Monitoring containers with health checks
	Inspecting your container build results
		Troubleshooting builds from Dockerfiles
		Troubleshooting builds with Buildah-native commands
	Advanced troubleshooting with nsenter
		Troubleshooting a database client with nsenter
	Summary
	Further reading
Chapter 11: Securing Containers
	Technical requirements
	Running rootless containers with Podman
		The Podman Swiss Army knife – subuid and subgid
	Do not run containers with UID 0
	Signing our container images
		Signing images with GPG and Podman
		Configuring Podman to pull signed images
		Testing signature verification failures
		Managing keys with Podman image trust commands
		Managing signatures with Skopeo
	Customizing Linux kernel capabilities
		Capabilities quickstart guide
		Capabilities in containers
		Customizing a container's capabilities
	SELinux interaction with containers
		Introducing Udica
	Summary
	Further reading
Chapter 12: Implementing Container Networking Concepts
	Technical requirements
	Container networking and Podman setup
		CNI configuration quick start
		Podman CNI walkthrough
		Netavark configuration quick start
		Podman Netavark walkthrough
		Managing networks with Podman
	Interconnecting two or more containers
		Container DNS resolution
		Running containers inside a Pod
	Exposing containers outside our underlying host
		Port Publishing
		Attaching a host network
		Host firewall configuration
	Rootless container network behavior
	Summary
	Further reading
Chapter 13: Docker Migration Tips and Tricks
	Technical requirements
	Migrating existing images and playing with a command's alias
	Podman commands versus Docker commands
		Behavioral differences between Podman and Docker
		Missing commands in Podman
		Missing commands in Docker
	Using Docker Compose with Podman
		Docker Compose quick start
		Configuring Podman to interact with docker-compose
		Running Compose workloads with Podman and docker-compose
		Using podman-compose
	Summary
	Further reading
Chapter 14: Interacting with systemd and Kubernetes
	Technical requirements
	Setting up the prerequisites for the host operating system
	Creating the systemd unit files
	Managing container-based systemd services
	Generating Kubernetes YAML resources
		Generating basic Pod resources from running containers
		Generating Pods and services from running containers
		Generating a composite application in a single Pod
		Generating composite applications with multiple Pods
	Running Kubernetes resource files in Podman
	Testing the results in Kubernetes
		Setting up minikube
		Starting minikube
		Running generated resource files in Kubernetes
	Summary
	Further reading
Index