Working with Containers on CentOS Stream 9

Now that the basics of Linux Containers have been covered in the previous chapter, this chapter will demonstrate how to create and manage containers using the Podman, Skopeo, and Buildah tools on CentOS Stream 9. By the end of this chapter, you will have a clearer understanding of how to create and manage containers on CentOS 9. In addition, you will have gained a knowledge foundation on which to continue exploring the power of Linux Containers.

Installing the Container Tools

Before starting with containers, the first step is to install all of the container tools outlined in the previous chapter using the following command:

# dnf install container-tools

Pulling a Container Image

The CentOS Stream 9 minimal image will be pulled from the registry for this example. Before pulling an image, however, information about the image repository can be obtained using the skopeo tool, for example:

# skopeo inspect docker://quay.io/centos/centos:stream9-minimal
{
    "Name": "quay.io/centos/centos",
    "Digest": "sha256:a6a7c23a654ea3264523c48aef7430422c89806dc494ea71009f90a083852dc7",
    "RepoTags": [
        "CentOS-7",
        "CentOS-7-x86_64",
        "5.11",
        "5",
        "6.10",
        "6.6",
        "6.7",
        "6.8",
        "6.9",
        "6",
.
.
        "centos8.1.1911",
        "centos8.2.2004",
        "centos8.3.2011",
        "8.3.2011",
        "centos8",
        "latest",
        "8",
        "8.4.2105",
        "stream9-development",
        "stream",
        "stream9",
        "stream9-minimal",
        "stream8"
    ],
    "Created": "2023-05-31T12:03:51.323828553Z",
    "DockerVersion": "",
    "Labels": {
        "io.buildah.version": "1.19.8",
        "org.label-schema.build-date": "20230531",
        "org.label-schema.license": "GPLv2",
        "org.label-schema.name": "CentOS Stream 9 Minimal Image",
        "org.label-schema.schema-version": "1.0",
        "org.label-schema.vendor": "CentOS"
    },
    "Architecture": "amd64",
    "Os": "linux",
    "Layers": [
        "sha256:6d4826ccb668a22b19d0a0ec0c8bdbfdbcb78da0e0051ae5d7f37e05bf8d8bfa"
    ],
    "LayersData": [
        {
            "MIMEType": "application/vnd.oci.image.layer.v1.tar+gzip",
            "Digest": "sha256:6d4826ccb668a22b19d0a0ec0c8bdbfdbcb78da0e0051ae5d7f37e05bf8d8bfa",
            "Size": 38056098,
            "Annotations": null
        }
    ],
    "Env": [
        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
    ]
}

This image is the CentOS Stream 9 base image for building minimal operating system containers and will be used as the basis for the example in this chapter.

Having verified that this is indeed the correct image, the following podman command will pull the image to the local system:

# podman pull quay.io/centos/centos:stream9-minimal
Trying to pull quay.io/centos/centos:stream9-minimal...
Getting image source signatures
Copying blob 6d4826ccb668 done
Copying config 1f8a640e20 done
Writing manifest to image destination
Storing signatures
1f8a640e202cd0bbc7e58e025af116173cca18fc696fb2d8e7ac0a769e957ea2

Verify that the image has been stored by asking podman to list all local images:

# podman images
REPOSITORY             TAG              IMAGE ID      CREATED     SIZE
quay.io/centos/centos  stream9-minimal  1f8a640e202c  2 days ago  98.7 MB

Details about a local image may be obtained by running the podman inspect command:

# podman inspect quay.io/centos/centos:stream9-minimal

Running the Image in a Container

The image pulled from the registry is a fully operational image ready to run in a container without modification. To run the image, use the podman run command. In this case, the –rm option will be specified to indicate that we want to run the image in a container, execute one command and then have the container exit. In this case, the cat tool will be used to output the content of the /etc/ passwd file located on the container root filesystem:

# podman run --rm quay.io/centos/centos:stream9-minimal cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin

Compare the content of the /etc/passwd file within the container with the /etc/passwd file on the host system. Note that it lacks all of the additional users on the host confirming that the cat command was executed within the container environment. Also, note that the container started, ran the command, and exited within seconds. Compare this to the amount of time it takes to start a full operating system, perform a task, and shut down a virtual machine, and you begin to appreciate the speed and efficiency of containers.

To launch a container, keep it running, and access the shell, the following command can be used:

# podman run --name=mycontainer -it quay.io/centos/centos:stream9-minimal /bin/bash
[root@be4ba5f1d994 /]#

In this case, an additional command-line option has been used to assign the name “mycontainer” to the container. Though optional, this makes the container easier to recognize and reference as an alternative to using the automatically generated container ID.

While the container is running, run podman in a different terminal window to see the status of all containers on the system:

# podman ps -a
CONTAINER ID  IMAGE                                  COMMAND     CREATED             STATUS             PORTS       NAMES
be4ba5f1d994  quay.io/centos/centos:stream9-minimal  /bin/bash   About a minute ago  Up About a minute              mycontainer

To execute a command in a running container from the host, use the podman exec command, referencing the name of the running container and the command to be executed. The following command, for example, starts up a second bash session in the container named mycontainer:

# podman exec -it mycontainer /bin/bash
[root@be4ba5f1d994 /]#

Note that though the above example referenced the container name, the same result can be achieved using the container ID as listed by the podman ps -a command:

# podman exec -it be4ba5f1d994 /bin/bash
[root@be4ba5f1d994 /]#

Alternatively, the podman attach command will also attach to a running container and access the shell prompt:

# podman attach mycontainer
[root@be4ba5f1d994 /]#

Once the container is up and running, additional configuration changes can be made and packages installed like any other CentOS 9 system.

Managing a Container

Once launched, a container will continue to run until it is stopped via podman, or the command launched when the container was run exits. Running the following command on the host, for example, will cause the container to exit:

# podman stop mycontainer

Alternatively, pressing the Ctrl-D keyboard sequence within the last remaining bash shell of the container would cause both the shell and container to exit. Once it has exited, the status of the container will change accordingly:

# podman ps -a
CONTAINER ID  IMAGE                                  COMMAND     CREATED        STATUS                       PORTS       NAMES
be4ba5f1d994  quay.io/centos/centos:stream9-minimal  /bin/bash   9 minutes ago  Exited (127) 35 seconds ago              mycontainer

Although the container is no longer running, it still exists and contains all the configuration and file system changes. If you installed packages, made configuration changes, or added files, these changes will persist within “mycontainer”. To verify this, restart the container as follows:

# podman start mycontainer

After starting the container, use the podman exec command again to execute commands within the container as outlined previously. For example, to once again gain access to a shell prompt:

# podman exec -it mycontainer /bin/bash

A running container may also be paused and resumed using the podman pause and unpause commands as follows:

# podman pause mycontainer
# podman unpause mycontainer

Saving a Container to an Image

Once the container guest system is configured to your requirements, there is a good chance that you will want to create and run more than one container of this particular type. To do this, the container needs to be saved as an image to local storage to be used as the basis for additional container instances. This is achieved using the podman commit command combined with the name or ID of the container and the name by which the image will be stored, for example:

# podman commit mycontainer mycentos_image

Once the image has been saved, check that it now appears in the list of images in the local repository:

# podman images
REPOSITORY                TAG              IMAGE ID      CREATED         SIZE
localhost/mycentos_image  latest           f706402e1696  46 seconds ago  98.7 MB
quay.io/centos/centos     stream9-minimal  1f8a640e202c  5 days ago      98.7 MB

The saved image can now be used to create additional containers identical to the original:

# podman run --name=mycontainer2 -it localhost/mycentos_image /bin/bash

Removing an Image from Local Storage

To remove an image from local storage once it is no longer needed, run the podman rmi command, referencing either the image name or ID as output by the podman images command. For example, to remove the image named mycentos_image created in the previous section, run podman as follows:

# podman rmi localhost/mycentos_image

Before an image can be removed, any containers based on that image must first be removed.

Removing Containers

Even when a container has exited or been stopped, it still exists and can be restarted anytime. If a container is no longer needed, it can be deleted using the podman rm command as follows after the container has been stopped:

# podman rm mycontainer2

Building a Container with Buildah

Buildah allows new containers to be built from existing containers, an image, or entirely from scratch. Buildah also includes the ability to mount the file system of a container so that it can be accessed and modified from the host.

The following buildah command, for example, will build a container from the CentOS Stream 9 image (if the image has not already been pulled from the registry, buildah will download it before creating the container):

# buildah from quay.io/centos/centos:stream9-minimal

The result of running this command will be a container named centos-working-container that is ready to run:

# buildah run centos-working-container cat /etc/passwd

Building a Container from Scratch

Building a container from scratch creates an empty container. Once created, packages may be installed to meet the requirements of the container. This approach is useful when creating a container that only needs the minimum of packages installed.

The first step in building from scratch is to run the following command to build the empty container:

# buildah from scratch 
working-container

After the build is complete, a new container will be created named working-container:

# buildah containers
CONTAINER ID  BUILDER  IMAGE ID     IMAGE NAME                       CONTAINER NAME
584b1b38d465     *     1f8a640e202c quay.io/centos/centos:stream9... 584b1b38d4650fa611e4ae08e3542108d60ef41fe4f0093561c9a35adb042a33
c38bc62e8f53     *                  scratch                          working-container

The empty container is now ready to have some packages installed. Unfortunately, this cannot be performed within the container because not even the bash or dnf tools exist. So instead, the container filesystem needs to be mounted on the host system, and the packages are installed using dnf with the system root set to the mounted container filesystem. Begin this process by mounting the container’s filesystem as follows:

# buildah mount working-container
/var/lib/containers/storage/overlay/cf7be138c550260edec833c280c5271c010b1420c991fb4cd7bedd958e266377/merged

If the file system was successfully mounted, buildah will output the mount point for the container file system. Now that we have access to the container filesystem, the dnf command can install packages into the container using the –installroot option to point to the mounted container file system. The following command, for example, installs the bash, CoreUtils, and dnf packages on the container filesystem (where <container_fs_mount> is the mount path output previously by the buildah mount command) :

# dnf install --releasever=9.1 --installroot <container_fs_mount> bash coreutils dnf

Note that the –releasever option indicates to dnf that the packages for CentOS 9.1 are to be installed within the container.

After the installation completes, unmount the scratch filesystem as follows:

# buildah umount working-container

Once dnf has performed the package installation, the container can be run, and the bash command prompt can be accessed as follows:

# buildah run working-container bash 
bash-5.1#

Container Bridge Networking

As outlined in the previous chapter, container networking is implemented using the Container Networking Interface (CNI) bridged network stack. The following command shows the typical network configuration on a host system on which containers are running:

# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:23:24:52:52:57 brd ff:ff:ff:ff:ff:ff
    altname enp0s25
    inet 192.168.86.35/24 brd 192.168.86.255 scope global dynamic noprefixroute eno1
       valid_lft 68525sec preferred_lft 68525sec
    inet6 fd7f:886f:716a:0:223:24ff:fe52:5257/64 scope global dynamic noprefixroute 
       valid_lft 1619sec preferred_lft 1619sec
    inet6 fe80::223:24ff:fe52:5257/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: veth15d7e073@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master podman0 state UP group default qlen 1000
    link/ether 3e:3a:54:b8:d8:e1 brd ff:ff:ff:ff:ff:ff link-netns netns-658a3069-5c69-185f-ef34-621107da5a71
    inet6 fe80::3c3a:54ff:feb8:d8e1/64 scope link 
       valid_lft forever preferred_lft forever
6: podman0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 3e:3a:54:b8:d8:e1 brd ff:ff:ff:ff:ff:ff
    inet 10.88.0.1/16 brd 10.88.255.255 scope global podman0
       valid_lft forever preferred_lft forever
    inet6 fe80::45e:83ff:fe68:4067/64 scope link 
       valid_lft forever preferred_lft forever

In the above example, the host has an interface named eno1 connected to the external network with an IP address of 192.168.86.35. In addition, a virtual interface has been created named podman0 and assigned the IP address of 10.88.0.1. Running the same ip command on a container running on the host might result in the following output:

# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether b6:fb:88:16:8b:5e brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.88.0.8/16 brd 10.88.255.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::b4fb:88ff:fe16:8b5e/64 scope link 
       valid_lft forever preferred_lft forever

In this case, the container has an IP address of 10.88.0.8. Running the ping command on the host will verify that the host and containers are indeed on the same subnet:

# ping 10.88.0.8
PING 10.88.0.8 (10.88.0.8) 56(84) bytes of data.
64 bytes from 10.88.0.28: icmp_seq=1 ttl=64 time=0.056 ms
64 bytes from 10.88.0.28: icmp_seq=2 ttl=64 time=0.039 ms
.
.

We can also use the podman network ls command to obtain a list of container networks currently available on the host system:

# podman network ls
NETWORK ID    NAME        DRIVER
2f259bab93aa  podman      bridge

The following command can be used to display detailed information about a container network, in this case, the above podman network:

# podman network inspect podman
[
     {
          "name": "podman",
          "id": "2f259bab93aaaaa2542ba43ef33eb990d0999ee1b4b557b7be53c0b7a1bb9",
          "driver": "bridge",
          "network_interface": "podman0",
          "created": "2023-04-11T08:49:20.489892751-04:00",
          "subnets": [
               {
                    "subnet": "10.88.0.0/16",
                    "gateway": "10.88.0.1"
               }
          ],
          "ipv6_enabled": false,
          "internal": false,
          "dns_enabled": false,
          "ipam_options": {
               "driver": "host-local"
          }
     }
]

New container networks are created using the following syntax:

podman network create <network name>

For example, to create a new network named demonet, the following command would be used:

# podman network create demonet

The presence of the new network may be verified using the podman network ls command:

# podman network ls
NETWORK ID    NAME        DRIVER
9692930055dc  demonet     bridge
2f259bab93aa  podman      bridge

Once a network has been created, it can be assigned to a container as follows:

# podman network connect demonet mycontainer

Conversely, a container can be disconnected from a network using the podman network disconnect command:

# podman network disconnect demonet mycontainer

When the new container network is created, a configuration file is generated in the /etc/containers/ networks directory with the name <network name>.json. In the case of the above example, a file named demonet.json that reads as follows will have been created:

{
     "name": "demonet",
     "id": "9692930055dc6ceea5cc4d0720df548daa521fe62e23ca3659a9815664bca2f6",
     "driver": "bridge",
     "network_interface": "podman1",
     "created": "2023-04-10T16:54:35.618056082-04:00",
     "subnets": [
          {
               "subnet": "10.89.0.0/24",
               "gateway": "10.89.0.1"
          }
     ],
     "ipv6_enabled": false,
     "internal": false,
     "dns_enabled": true,
     "ipam_options": {
          "driver": "host-local"
     }
}

Modifications can be made to this file to change settings such as the subnet address range, IPv6 support, and network type (set to bridge for this example) for implementing different network configurations.

Finally, we can use the following command to delete the custom network:

# podman network rm demonet

Managing Containers in Cockpit

In addition to the command-line tools outlined in this chapter, Linux containers may be created and managed using the Cockpit web interface. If Cockpit is installed and enabled on the system (a topic covered in Using Cockpit on CentOS Stream 9), sign into Cockpit and select the Podman Containers option. If the Podman module is not installed within Cockpit, open a terminal window and run the following command:

# dnf install cockpit-podman

If necessary, click the button to start the Podman service, at which point the screen should resemble Figure 28-1:

Click on the Show images link highlighted by the arrow in the figure above to display the CentOS Stream 9 minimal container image that was pulled from the registry earlier in the chapter:

To run the image as a container, click on the Create container button and configure the container in the resulting dialog:

Note that options are provided to map ports on the host to ports on the container (useful, for example, if the container is hosting a web server), to limit the memory allocated to the container, and to specify volumes to use as the container storage. An option is also available to specify the program to run when the container starts. Once configured, click the Create and run button to launch the container.

Once running, the container will appear in the Containers section, as illustrated in Figure 28-4 below:

The highlighted menu button allows actions such as starting, stopping, pausing, and saving the container to be performed. In addition, the container may also now be accessed and managed from the command line using the steps outlined earlier in the chapter.

Summary

This chapter has worked through creating and managing Linux Containers on CentOS Stream 9 using the podman, skopeo, and buildah tools together with the Cockpit web interface, including using container images obtained from a repository and creating a new image built entirely from scratch.