►
From YouTube: Lessons Learned Adopting RHEL Container Tools: Podman, Buildah, Quay, Skopeo, Clair and S2I
Description
OpenShift Commons Gathering at Kubecon EU 2021
Title: Lessons Learned Adopting RHEL Container Tools: Podman, Buildah, Quay, Skopeo, Clair and S2I
Speakers:
Elif Mosessohn-Samedin (Take Off Labs)
Mihai Criveti (IBM)
Abstract:
A hands-on demonstration of lessons learned migrating from other container build tools to the RHEL container ecosystem. We aim to explore a set of command-line tools that are able to operate without a container daemon, and namely: Buildah, Podman, Quay and Skopeo. In a nutshell, Buildah builds, Podman runs, and Skopeo transfers container images and Quay provides private and public container registries. We also look at best practices for building images that can easily be integrated into a CI/CD pipeline and vulnerability scanning with Clair and replacing previous build tools in our workflows. Understanding the impact of SELinux, namespaces and cgroups. Building container images for OpenShift. Replacing docker-compose with pods and adopting podman for testing ansible playbooks.
A
A
To
be
honest,
some
of
the
cooler
things
that
I've
learned-
I've
learned
just
working
with
with
students
or
with
you
know,
young
development
teams
or
just
getting
started
with
this
container
ecosystem.
I
actually
have
two
groups
of
students
working
with
me
this
year
at
a
trinity
in
dublin
and
I've,
given
them
a
challenge.
I
wanted
them
to
build
an
application,
as
a
modern
development
team
would
and
select
whatever
application.
They
want
to
build
a
team
decided
to
build
an
application
to
perform
various
analytics
on
covet
statistics.
A
Another
team
decided
to
build
an
application
to
support
musicians
or
podcasters
or
vloggers
in
getting
full
audio
connecting
to
a
raspberry,
pi
and
performing
some
various
things.
What
did
these
two
teams
have
in
common
well,
they've,
both
selected
linux
as
their
operating
system,
and
they
both
decided
to
containerize
their
ci
cd
pipeline,
which
was
interesting
right.
It
doesn't
matter
what
kind
of
application
you're
building
at
some
point.
A
So
I'm
going
to
combine
the
experience
that
I've
had
working
with
clients
adopting
the
tools
myself,
but
also
working
with.
You
know,
students
for
volunteering
in
the
community,
and
here
with
me
I
also
have
alif
samadin
she's,
a
rahab
certified
architect
in
infrastructure
level.
2..
I
think
she's
recently
got
her.
You
know
podman
based
exam,
this
one
she
took
and
I'm
going
to
let
her
you
know
hopefully
she's
going
to
give
us
a
few
words
about
herself
as
well
so
ellie
floor
is
yours.
B
Thank
you
for
the
introduction
mikhai.
Well.
There
is
very
little
for
me
to
say
now
other
than
that.
Thank
you
for
having
guys
I'm
happy
to
have
this
presentation
with
you.
Thank
you
dan
for
having
us
as
well,
and
what
I
would
add
besides,
everything
is
that
I'm
really
passionate
and
I
hope
to
be
a
promoter
for
adopting
podman
and
friends.
A
That's
that's
awesome,
so,
let's
look
at
the
scenario
that
we're
going
to
work
on
together.
So
I'm
going
to
take
a
step
back
and
play
a
less
technical
role
in
the
presentation.
Today,
alif
is
going
to
do
all
the
heavy
lifting
and
hard
work
and
hands-on
components.
I'm
going
to
talk
to
you
about
the
end-to-end
process
of
building
of
building
containers,
pushing
them
towards
the
registry
and
how
this
would
look
like
from
an
ecosystem
perspective.
A
So,
first
we
have
podman
what's
podman
well,
my
guess
is
in
the
name
right.
It
starts
with
pod
and
it's
a
container
management
tool
designed
to
manage
pods
containers
and
oci
compliant
container
images,
and
it's
different
from
existing
container
technologies
that
first,
you
can
run
it
as
a
regular
user
without
requiring
root
or
without
requiring
a
daemon.
It
actually
uses
the
fork
exec
model.
So
if
you've,
you
know,
run
a
process
with
an
end
at
the
end
and
creates
a
fork.
A
A
child
process
you'll
see
that
in
actions
when
you
create
a
container
with
podman,
every
container
of
that
would
be
a
child
process
and
it
uses
name
spaces
and
c
groups
and
s
linux.
To
secure
your
container
and
isolate
it,
but
the
interesting
part
is
that
it
also
lets
you
create
kubernetes
definition
using
podman
generate
and
palm
play
and
alif
will
show
us
how
those
work
in
practice
as
well
before
you
start
wondering
hey.
Is
this
a
new
container
technology?
Well,
you
need
to
remember.
A
A
It's
also
designed
to
run
rootless,
of
course,
and
it
can
be
used
to
securely
build
containers
in
a
lockdown
environment
and
it's
a
bit
different
than
using
a
new,
simple
docker
file
to
build
a
container
it's
easier
to
script.
So
if
you
know
how
to
write
a
shell
script,
you
probably
know
how
to
use
build.
A
Scopio
he's
another
friend
of
postman
and
scorpio
is
a
very,
very
useful
command.
If
you've
ever
been
wondering
hey,
I
have
this
container.
I
built
it
on
my
machine.
How
do
I
log
into
another
container
registry
and
copy
it
here
or
inspect
it
or
sign
it
or
verify
the
image?
Signature
or
scorpio
is
the
key.
You
can
copy
images
from
well
pretty
much
any
container,
storage
or
star
file
to
any
container
storage
or
locally,
and
you
can
do
various
things
like
inspect
the
image
verify
the
image
sign.
A
It
verify
the
signature,
it's
a
very
powerful
and
useful
tool.
Speaking
of
container
registries,
let's
talk
about
some
of
the
sources
from
where
you're
going
to
be
able
to
get
container
images.
Now
I'm
guilty
of
this
myself
right.
I've
created
containers
that
I've
decided
to
use
for
myself
and
I've
published
them
onto
a
public
container
registry,
and
then
I've
never
updated
them.
I
know
they're
insecure.
I
don't
care
right.
I've
designed
them
for
a
single
use.
A
I've
used
them
a
couple
of
times
and
when
I
checked
my
image
it
had
something
like
30
000
downloads
I
was
like.
Well,
that's
not
me.
I
hope
whoever
downloaded
a
container
image
isn't
using
it
in
production
and
here's
where
this
container
sources
come
in
to
help
the
rad
software,
correct
collections,
library
or
rh
scl
is
this
design
for
developers
that
need
you
know
the
latest
and
greatest
you're
using
rail,
but
you
may
not
have
the
latest
tool
you
can
use
this
to
get
it.
The
rat
container
catalog
is
slightly
different.
A
It's
full
of
certified
created,
and
you
know,
verified
images
with
a
qa
process
in
place
that
are
upgraded
on
a
regular
basis
to
avoid
security
vulnerabilities.
So,
if
you're
looking
to
build
your
container
images
for
production,
that's
one
huge
lesson
learned
right.
Just
go
with
this.
Make
sure
that
you
have
a
trusted
and
maintained
container
image
as
your
source
and
quay
is
a
private
or
a
public
container
registry
that
you
you
can
use
as
well.
A
Now
I
know
that
in
a
lot
of
cases,
you're
you're
thinking,
okay,
but
what?
If
I'm
building
my
own
images?
Where
do
I
start,
and
I
would
advise
you
to
start
with
ubi,
which
is
a
oci
compliant
secure
base?
Image
is
based
on
rel,
so
you
can
get
ubi
in
version
7
or
version
8..
It's
really
distributable
and
it's
a
bit
more
than
just
a
base
image.
A
Another
example
would
be
migrating
or
you
know,
translating
a
legacy
application
which
happens
to
have
multiple
services
that
need
to
start
now.
Ubi
and
upi
minimal
are
just
what
it
says
right:
it's
either
a
rel
or
a
minimal
image,
which
is
your
foundation
on
top
of
which
you
can
get.
You
know
language
runtimes.
You
can
get
your
ruby
or
python
your
php
or
perl,
whatever
language
runtime
of
choice
that
you
want
to
get
started
from
that
step.
On
and
again,
all
of
these
images
are
supported
by
relevant
openshift.
A
So
as
you're
building
your
foundation
for
your
images,
you
know
that
you
always
have
updates
and
you're
gonna
be
able
to
start
from
a
secure
image
from
the
get
go,
and
this
is
one
hard
to
learn
lesson
in
practice.
Right.
It's
easy
to
start
building
with
a
simple
image,
but
the
moment
that
you
start
putting
these
images
onto
container
platforms
that
you
need
to
look
at
security,
whether
or
not
you're
running
processes
as
root.
And
why
should
you
be
running
this
route?
Don't
mind
the
t-shirt?
A
A
Another
thing
we
found
to
be
quite
interesting
when
working
with
development
themes
is
typically
development
and
operations,
even
though
you
know
everybody's
saying
they're
doing
devops
tend
to
be
different.
Teams
right
in
development
teams
might
use
something
like
docker
compose
or
might
use
some
shell
scripts
could
to
quickly
put
together
an
environment
that
consists
of
more
than
one
pod.
A
You
know
take
the
typical
scenario:
wordpress
and
mysql
or
mariad
two
containers,
one
for
your
web
application,
one
for
your
database,
some
kind
of
a
yama
file
to
clue
it
together
with
docker
compose
and
you're
good
to
go,
but
that's
not
really
the
way
you're
going
to
deploy
and
manage
and
build
your
application
when
it
goes
to
production,
you're,
probably
going
to
put
it
on
openshift
or
some
other
kubernetes
platform.
So
why
would
you
want
to
maintain
two
systems
to
make
this
work?
A
A
But
if
you
don't
want
to
maintain
these
two
versions
separate,
then
you
can
use
the
podman
generate
importment
play
to
generate
and
create
kubernetes
definitions,
so
you're
still
creating
that
yaml
with
one
or
more
containers.
But
now
they
will
be
useful
for
you
not
just
in
development,
but
also
moving
forward
as
you
deploy
your
application
to
production.
So
if
you
just
want
to
use
admin
or
scopy
or
any
of
these
other
tools,
chances
are
they're
already
available
with
your
distribution.
A
B
B
Okay,
I'm
gonna
start
sharing
my
screen
now
so
as
mikhail
was
saying
before,
podman
enables
us
to
manage
container
images,
containers
and
even
pods.
What
I'm
going
to
do
next
is
to
give
you
some
examples
of
demonstrating
or
state
betters
at
stating
why
podman
provides
us
with
a
more
secure
approach
to
run
containers.
B
Another
aspect
I
want
you
to
to
keep
in
mind
is:
how
are
the
processes
inside
the
container
actually
running
what
is
interesting
or
what
podman
has
brought?
Is
it
made
possible
for
us
to
run
rootless
containers,
but
what
are
actually
these
and
we'll
explore
this
in
the
next
two
examples,
so
I
have
a
fedora
workstation.
B
B
Let's
start
the
container
and
I'm
going
to
take
mihai's
advice
and
start
even
with
an
ubi8
container
for
that
pod
mod
run.
I'm
gonna
start
this
in
the
touch
mode,
just
give
it
a
random
name.
For
example,
podmon01:
let's
choose
an
ubi8,
and
I
want
this
to
keep
running,
that's
good,
so
my
container
is
up.
Let's
check
that,
keep
in
mind
that
I
have
started
this
container
under
my
user.
The
question
is:
how
is
the
process
inside
the
container
actually
running
in
order
to
find
this
out?
I'm
gonna
connect
to
the
container.
B
B
B
B
B
A
They
always
end
up
looking
back
at
all
of
the
images
they've
previously
created
and
going.
Oh,
we
can't
use
any
of
these
because
we've
built
them
in
an
insecure
way
or
we've
designed
them
to
run
only
with
root
or
to
bind
to
a
privileged
port.
So
what
alif
is
doing
here
is
really
awesome.
You're
gonna
learn
these
lessons
and
you're
going
to
learn
how
to
properly
build
images
in
a
secure
way
from
the
start.
So
you
don't
end
up
accumulating
all
of
this
technical
depth.
B
B
In
both
cases,
what
is
common
to
these
is
that
I
have
ran
podman
as
an
unprivileged
legend
user,
meaning
my
own
personal
user,
in
the
first
case,
the
processes
within
the
first
container,
and
that
would
be
the
first
case
we're
running
as
root
and
the
host
sees
this
process
running
under
my
username.
In
the
second
case,
the
process
within
the
container
was
under
sync
user,
and
the
host
sees
this
as
a
completely
different
uid.
B
So
the
second
case
demonstrates
that
we
are
able
to
run
containers
as
regular
users
and
the
container
runs
in
rootless
mode,
so
non-root
within
the
container,
so
mihai
no
longer
is
happy.
I
have
taken
out
his
privileges
now
well,
but
that
is
not
all.
The
second
side
would
be
the
fact
that
portman
allows
us
to
work
with
guess
what
pods
actually-
and
this
would
be
an
alternative
to
docker
compose
in
order
to
do
that,
let's
create
a
pot.
Currently,
I
have
none
so
we're
starting
from
a
clean
slate.
B
What
I'm
going
to
do
next
is
the
following:
I'm
going
to
start
the
pod,
I'm
going
to
expose
port
80
and
I'm
going
to
start
two
containers
within
the
spot,
a
database
container
and
the
wordpress
container,
and
then
we
have
our
wordpress
container.
Furthermore,
we're
going
to
use
this
to
generate
a
template
to
be
used
further
with
either
with
a
cuber
in
this
cluster
or
written
with
the
openshift
cluster.
So
let's
give
it
a
start.
B
Hey,
I'm
gonna
choose
a
pretty
dummy
name:
my
pod
map
port,
I'm
going
to
map
port
8080
of
the
host
to
port
80
of
the
pod.
What
is
interesting
that
doing
sport
mapping
at
this
point,
I
will
no
longer
be
needing
to
do
this
for
the
containers.
Let's
ensure
our
pod
is
up,
and
it
is
indeed,
I
have
only
the
previous
two
containers
up,
because
I
did
not
stop
them
oh
and
did,
and
it
is
actually
three
containers.
B
B
The
name
of
the
container
is
very
basically
mariadb.
The
flag.
Minus
minus
pod
allows
us
to
specify
that
I
want
this
container
to
run
within
the
pod
I
have
previously
created.
I
have
passed
the
regular
arguments
necessary
for
this
container
to
start
and
specified
the
image,
the
necessary
image,
so
the
container
should
be
now
running
and
it
is
indeed
and
the
next
one
would
be
the
wordpress
one.
B
Okay
same,
my
container
starts
within
this
pod.
What
is
interesting-
and
I
would
like
to
point
out,
is
the
fact
that
I
have
mesh.
I
have
specified
the
wordpress
b
host
to
be
localhost
in
this
manner.
The
wordpress
container
will
be
able
to
connect
to
the
database
one,
and
this
should
be
up
now,
and
indeed
it
is
so
what
would
be
the
first
blog
post,
mihai.
A
B
Well,
I'm
gonna
pass
this
wordpress
to
you
to
give
you
this
joy
and
well.
Are
you
I
I'm
not
weird,
I'm
not
able
to
write
so
much
yaml
without
having
typos
I'm
one
of
the
persons
who
does
typos
almost
every
time,
and
this
is
why
I
am
in
love
with
the
future
of
generating
templates
using
podman,
and
for
that-
and
I
hope,
you'll
find
this
useful
as
well.
I'm
gonna
generate
that
podman
generate
cube.
Is
one
of
my
favorite
commands
using
poldman,
let's
say
wordpress,
for
example,.