Podman is a daemon-less engine for developing, managing, and running Open Container Initiative-compliant containers on Linux systems.
[ Download now: Podman basics cheat sheet. ]
Here are three things I really like about it.
1. Using rootless mode for non-root users
As a systems administrator, I care about operating systems like Red Hat Enterprise Linux (RHEL) and their security. Part of my job is to provide tools and concepts for application teams and developers to enable them to run their applications and microservices on these operating systems.
Podman's rootless mode makes it possible to provide the necessary tooling for developing, managing, and running OCI containers and container volumes with a non-root user. There are several benefits:
- Application teams and developers can do their work without breaking the operating system by mistake because of being root.
- They can pull, run, and create containers as well as pods. They don't even need
sudoto do so. - An exploit can't use a daemon process to become root when there is no daemon process.
Application teams and developers are happy because they can do their job. I'm happy because there is only a minimal risk that my operating system breaks because of container operations.
2. Generating systemd unit files with Podman
Most modern Linux systems services are controlled and managed by systemd and the systemctl command.
[ Get the systemd cheat sheet. ]
Podman allows you to create systemd unit files for your running container instances or even pods, including multiple container instances. How to run pods as systemd services with Podman by Valentin Rothberg covers this topic in more detail.
These service units can be installed and managed in a non-root user context. There is no need to give root permissions to your application teams or developers.
3. Joining the forces of Ansible and Podman
Ansible and the containers.podman collection enable you to automate container deployments. It's easy to create a role that contains all (environment) variables, Podman volumes, and container images needed to build your service.
For example, look at my project to deploy a containerized Nextcloud with MariaDB in a pod. You'll find it on Ansible Galaxy and my GitHub account.
[ Get started with MySQL and MariaDB. ]
And when your developers tell you that their containerized app is ready for production, the containers.podman collection has all the modules necessary to orchestrate the deployment.
This example might be a corner case, as you would probably use Kubernetes for cases like this. However, there are many scenarios where a full Kubernetes cluster might be more than you need.
[ Learn the difference between Red Hat OpenShift and Kubernetes. ]
Wrap up
There are plenty of great Podman features but these are my three favorites.
- Podman's rootless mode lets your team work with a dedicated non-root user while still being able to create containerized workloads.
- With
podman-generate-systemd(1), you can create systemd unit files and manage containers and pods like every other system service. - With Ansible and the containers.podman collection, you can automate and orchestrate your container deployments.
If you are not already using it, explore the possibilities of Podman.
关于作者
Jörg has been a Sysadmin for over ten years now. His fields of operation include Virtualization (VMware), Linux System Administration and Automation (RHEL), Firewalling (Forcepoint), and Loadbalancing (F5). He is a member of the Red Hat Accelerators Community and author of his personal blog at https://www.my-it-brain.de.
