Skip to main content

Container video series: Rootless containers, process separation, and OpenSCAP

Learn more about rootless containers, PID namespaces, and OpenSCAP in this exciting new video series.
Image
Yum respositories represented by clay pots of various shapes and sizes
Image by Queena Deng from Pixabay

Have you heard about rootless containers, but don't really know what they are? Do you wonder what prevents processes in one container from interacting with processes in another container? Would you like to learn how to scan container images with OpenSCAP?

If you answered yes to any of these questions, I've recently published a series of videos on containers and Podman that might help.

Rootless containers using Podman

Watch two videos covering running containers unprivileged, or "rootless" using Podman.

The first video is an overview of the options you have when choosing which user account to use to run Podman and which account to run processes as within container images. The video includes a demo of these various options in action.

The second video dives deep into how user namespaces work in rootless Podman, and demos the following topics:

  • Run a container with rootless Podman.
  • View user namespaces with the lsns command.
  • Use the /etc/subuid file, which defines subordinate UID ranges.
  • Use the /proc uid_map file, which shows the UID map for processes.
  • Calculate the UID number that a process runs as on the host.
  • Use the podman top command to view the user mapping between the container and the host.
  • Use the podman unshare command to run a command within a container user namespace.

Overview of PID namespaces

The next video, Overview of How Containers Use PID Namespaces to Provide Process Isolation, takes an in-depth look at how PID namespaces work. Namespaces, including PID namespaces, are one of the key technologies that enable containers to run in isolated environments.

PID namespaces also allow containers to have the same PID number running in each container (this is how every container running on a system can have their own PID #1). PID namespaces map the PID numbers between the container and the host, so a process running in your container will have a different PID number from the container's point of view versus the host's point of view, which is explained in the video.

After watching this video, you should have a solid understanding of how PID namespaces work and the benefits they provide.

Security compliance by scanning container images with OpenSCAP

The last video is named Scanning Containers for Vulnerabilities on RHEL 8.2 With OpenSCAP and Podman. In this video, I cover the new feature in RHEL 8.2 that allows container images to be scanned with OpenSCAP using the oscap-podman command. This video covers the following topics:

  • Scan container images for vulnerabilities with the oscap-podman command.
  • Assess a container image's security compliance with the PCI-DSS baseline by using the oscap-podman command.
  • Use Buildah to create a new image with one of the OpenSCAP findings remediated.

Conclusion

I hope you find these videos useful and educational. I want to make several more Red Hat Container Tools-related videos in the future, so keep an eye on the Enable Sysadmin blog and the Red Hat Videos YouTube channel!

[ Free book: Building modern apps with Linux containers. ]

What to read next

Topics:   Containers  
Author’s photo

Brian Smith

Brian is a Technical Account Manager (TAM) for Red Hat. He works with Public Sector customers, and lives in Colorado. More about me

Related Content

OUR BEST CONTENT, DELIVERED TO YOUR INBOX