Kubernetes is an open-source container orchestrator: it automates deployment, scaling, and management of containerized applications across multiple machines. Unlike Podman, which primarily runs applications on a single node, Kubernetes coordinates clusters of containerized microservices. section 1.1 section 8.0
Kubernetes occupies a distinct role in the container stack:
- Orchestrates containers across multiple nodes and communicates with container engines. section 1.1
- Uses CRI-O or containerd as purpose-built container-engine backends; Docker is being discouraged as the Kubernetes backend. section 1.1 section 8.0
- Provides the coordination Podman lacks when applications require multiple instances, nodes, databases, and connected microservices. section 8.0
Running Podman inside a Kubernetes pod
CI/CD workloads can run Podman inside Kubernetes, but the pod must provide suitable privileges or Linux capabilities and more than one UID. Rootful execution uses a privileged container; rootless execution adds SETUID and SETGID and specifies runAsUser: 1000. section 8.4.2
Figure 1.1 Different open source projects dealing with containers within the categories of orchestrators, engines, and runtimes.
Use the container-stack diagram to distinguish Kubernetes as an orchestrator from container engines and OCI runtimes. section 1.1
apiVersion: v1
kind: Pod
metadata:
name: podman-rootless
spec:
containers:
- name: rootless
image: quay.io/podman/stable
args:
- podman
- version
securityContext:
capabilities:
add:
- "SETUID"
- "SETGID"
runAsUser: 1000
Inspect the rootless pod specification to see how Kubernetes expresses Podman capabilities and an explicit numeric user ID. section 8.4.2
