A root filesystem, or rootfs, is the directory tree presented as the container’s Linux root (/). A container image packages this tree with JSON metadata and a manifest list. section 1.2.3
Podman unpacks the image, combines its metadata with runtime defaults and user input, and builds an OCI specification. The OCI runtime mounts volumes, switches / to the rootfs, and launches the image command. section 1.2.3 section 6.2.5
Rootfs isolation establishes the container’s filesystem boundary:
- The mount namespace hides the host filesystem and exposes only content assigned to the container. section 10.7
- Podman bind-mounts volumes onto the rootfs before pivot_root changes the namespace’s root mount. section 6.2.5 section 10.7
- Dropping CAP_SYS_ADMIN limits processes’ ability to alter mounts, while SELinux adds protection against filesystem escape. section 10.7
Inspecting image rootfs metadata
Run podman inspect on an image to examine its command, environment variables, labels, architecture, and operating system metadata. section 1.2.3
$ podman inspect docker:/ /registry.access.redhat.com/ubi8
{
...
"created": "2022-01-27T16:00:30.397689Z", #1
"architecture": "amd64", #2
"os": "linux", #3
"config": {
"Env": [ #4
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"container=oci"
],
"Cmd": [ #5
"/bin/bash"
],
"Labels": { #6
"architecture": "x86_64",
"build-date": "2022-01-27T15:59:52.415605",
...
}
Inspect representative image metadata, including Cmd, Env, Labels, architecture, and operating system fields. section 1.2.3
