Container video series: Rootless containers, process separation, and OpenSCAP

Have you heard about rootless containers, but don't really know what they are? Do you wonder what prevents processes in one container from interacting with processes in another container? Would you like to learn how to scan container images with OpenSCAP?

If you answered yes to any of these questions, I've recently published a series of videos on containers and Podman that might help.

Rootless containers using Podman

Watch two videos covering running containers unprivileged, or "rootless" using Podman.

The first video is an overview of the options you have when choosing which user account to use to run Podman and which account to run processes as within container images. The video includes a demo of these various options in action.

The second video dives deep into how user namespaces work in rootless Podman, and demos the following topics:

• Run a container with rootless Podman.
• View user namespaces with the lsns command.
• Use the /etc/subuid file, which defines subordinate UID ranges.
• Use the /proc uid_map file, which shows the UID map for processes.
• Calculate the UID number that a process runs as on the host.
• Use the podman top command to view the user mapping between the container and the host.
• Use the podman unshare command to run a command within a container user namespace.

Overview of PID namespaces

The next video, Overview of How Containers Use PID Namespaces to Provide Process Isolation, takes an in-depth look at how PID namespaces work. Namespaces, including PID namespaces, are one of the key technologies that enable containers to run in isolated environments.

PID namespaces also allow containers to have the same PID number running in each container (this is how every container running on a system can have their own PID #1). PID namespaces map the PID numbers between the container and the host, so a process running in your container will have a different PID number from the container's point of view versus the host's point of view, which is explained in the video.

After watching this video, you should have a solid understanding of how PID namespaces work and the benefits they provide.

Security compliance by scanning container images with OpenSCAP

The last video is named Scanning Containers for Vulnerabilities on RHEL 8.2 With OpenSCAP and Podman. In this video, I cover the new feature in RHEL 8.2 that allows container images to be scanned with OpenSCAP using the oscap-podman command. This video covers the following topics:

• Scan container images for vulnerabilities with the oscap-podman command.
• Assess a container image's security compliance with the PCI-DSS baseline by using the oscap-podman command.
• Use Buildah to create a new image with one of the OpenSCAP findings remediated.

Running a container inside a container (Podman in Podman)

This video covers an overview of Podman in Podman, or in other words, running a container within a container.  This is a technology preview feature in Red Hat Enterprise Linux (RHEL) 8.3.

The video covers an overview of:

• From the RHEL 8.3 host, starting a container using the registry.redhat.io/rhel8/podman container image (with the --privileged option)
• Within that container, building a new container image using podman build
• Running a container (while in a container) using the newly created container image (Podman in Podman)

Please note that Podman in Podman functionality is currently only available when starting the container as root.

Conclusion

I hope you find these videos useful and educational. I want to make several more Red Hat Container Tools-related videos in the future, so keep an eye on the Enable Sysadmin blog and the Red Hat Videos YouTube channel!

[ Free book: Building modern apps with Linux containers. ]