liveBookmanning.com

What you will learn in Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more

Secure, rootless containers for Kubernetes, microservices, and more

by Daniel Walsh

Read it on liveBook Get the book at manning.com

Chapter by chapter

Concepts explained in this book

• PodmanPodman is a daemonless container engine that runs containers and builds images, including under an unprivileged user account.
• container imageA packaged filesystem and application artifact containing the code, dependencies, and runtime requirements needed to create a container.
• user ID namespaceA user namespace is a Linux namespace that isolates security-related identifiers and capabilities and maps host user and group identifiers to namespace identifiers.
• rootless modeA rootless container is a container whose engine and processes run without host-level root privileges.
• Linux capabilityA Linux capability is a discrete permission that divides traditionally privileged root powers into independently controllable units.
• podman system serviceThe Podman compatibility service is a background Podman endpoint that accepts Docker-compatible container-management requests.
• mount namespaceA mount namespace is a Linux namespace that isolates the filesystem mount view available to a process group.
• DockerDocker is a container platform that provides a daemon-based engine, client, and ecosystem for building and running containers.
• container registryA container registry is a service that stores, distributes, and serves container images.
• systemdsystemd is a Linux init system and service manager that starts, supervises, and stops system services.
• systemd unit fileA systemd unit file is a declarative configuration file describing a systemd-managed service or other unit.
• rootful modeA rootful container is a container whose engine or processes run with host-level root privileges.
• podman runpodman run is a Podman command that creates and starts a new container from an image.
• podA pod is a group of one or more containers that share storage and network resources and a runtime specification.
• KubernetesKubernetes is an open-source platform for orchestrating containerized workloads across clusters of machines.
• podman buildpodman build is a Podman command that constructs a container image from a Containerfile and build context.
• image tagA container image tag is a mutable textual label used to refer to a particular image version within an image repository.
• podman generate systemdpodman generate systemd --new is a Podman command that generates a systemd unit configured to create a container when the unit starts.
• linux namespaceA Linux kernel isolation mechanism that provides a process with a separate view of selected system resources.
• DockerfileA Containerfile or Dockerfile is a declarative build file that specifies how to construct a container image and its default runtime metadata.
• image layerAn image layer is an immutable filesystem change set that contributes to a container image and can be stacked with other layers.
• containers/storageLocal container storage is the on-host storage managed by a container engine for container images and related container data.
• cgroupA Linux kernel mechanism for grouping processes and limiting or accounting for their resource usage.
• network namespaceA network namespace is a Linux namespace that provides an isolated view of network devices and network configuration.
• socket activationA socket-activated service is a service that is started when a connection arrives on a listening socket and may exit while idle.
• YAMLYAML is a human-readable data-serialization standard commonly used for configuration and resource manifests.
• pid namespaceA PID namespace is a Linux namespace that isolates process identifiers and the visible process tree.
• namespaced capabilityA namespaced capability is a Linux capability whose authority is limited to resources and identifiers within a user namespace.
• container image trustImage trust is a policy decision about which signed container images and signing keys a container engine accepts.
• podman auto-updatepodman auto-update is a Podman command and feature that detects changed container images in a registry and recreates the associated containers.
• volumeA volume is persistent or separately managed storage that can be associated with a container.
• base imageA base image is a container image selected as the starting filesystem and metadata layer for building another container image.
• fork/exec modelThe fork/exec model is a process-launching pattern in which a parent process forks a child and the child replaces its program image by executing another program.
• Docker CLIThe Docker CLI is the command-line client through which users invoke Docker container operations.
• setuid bitSetuid is a Unix privilege mechanism that causes a process or executable operation to use a designated user identifier for access checks.
• /etc/subgidThe /etc/subgid file assigns subordinate group-ID ranges to user accounts for user-namespace mappings.
• /etc/subuidThe /etc/subuid file assigns subordinate user-ID ranges to user accounts for user-namespace mappings.
• sidecar processA sidecar container is an additional co-located container that supports or monitors a primary container or its execution environment.
• copy instructionThe COPY directive adds files, directories, or archive contents from the build host to the image filesystem.
• from instructionThe FROM directive specifies the base image or empty starting filesystem for a container image build.
• registry configuration fileA registry configuration file declares container registries and mappings used to resolve image references.
• containers.confcontainers.conf is a configuration file format used to define default settings for Podman and related container tools.
• rootThe root user is the Unix-like operating-system account with unrestricted administrative authority over the host.
• storage.confstorage.conf is a configuration file that defines container storage locations and storage-driver settings for Podman and related container tools.
• type enforcementType enforcement is an SELinux access-control technique that restricts interactions according to the security types assigned to processes and resources.
• remote modeRemote mode is an operating mode in which a Podman client sends container-management requests to a Podman service running on another system or through a local service socket.
• podman generate kubepodman generate kube is a Podman command that generates Kubernetes YAML manifests from running containers and pods.
• kernel filesystemA kernel filesystem is a filesystem interface exposed by the operating-system kernel for representing kernel-managed information or resources.
• remote Podman clientA Podman client is the command-line or programmatic client component that sends container-management requests to a Podman service.
• agent orchestrationA container orchestrator is a system that schedules and manages container workloads across one or more machines.
• dangling imageA dangling image is a container image whose tag and repository reference are both absent after being superseded by another image.
• client-server architectureA client-server application is software organized into clients that request services from a separate server process.
• SELinuxAn SELinux system is an operating system environment with SELinux mandatory access-control enforcement enabled.
• context directoryA context directory is a directory containing the files and build instructions made available to a container image build.
• podman createpodman create is a Podman subcommand that creates and configures a container without starting it.
• short nameA short name is a container image reference that omits the registry and other fully qualified naming components.
• CAP_SYS_ADMINCAP_SYS_ADMIN is a Linux capability that includes permission to perform filesystem mounts and many other system-administration operations.
• Open Container InitiativeThe Open Container Initiative is an open-governance project that develops open standards for container image formats and container runtimes.
• podman-pyThe python-podman package is a distributable package that installs the podman-py Python client library.
• Kubernetes manifestA Kubernetes YAML file is a YAML-formatted resource description that declares how Kubernetes should create and manage application objects such as pods and containers.
• seccompA seccomp filter is a policy configuration that determines which system calls a process and its descendants may invoke.
• --userns=auto--userns=auto is a Podman option that automatically assigns a container a private user namespace with subordinate identity mappings.
• infra containerAn infra container is a pod container that keeps the pod's namespaces and cgroups open while other containers start and stop.
• podman.socketpodman.socket is a systemd socket unit that listens for Podman service connections and activates the corresponding service.
• stop signalA stop signal is the signal configuration that a container engine sends to request orderly termination of the container's main process.
• conmonconmon is a lightweight C program that monitors a container, manages attached I/O streams, and reports the container's exit status.
• policy.jsonpolicy.json is a JSON configuration file that defines image trust and signature-verification policies for container image operations.
• root filesystemA root filesystem is the filesystem tree presented as the top-level directory hierarchy to an operating-system environment or container.
• cmd directiveA container image build directive that specifies the default command or arguments for a container.
• entrypoint instructionA container image build directive that specifies the executable or command behavior used when a container starts.
• env directiveThe ENV directive defines default environment variables in a container image.
• EXPOSE instructionA container image build directive that documents the network ports intended to be exposed by a container.
• run instructionThe RUN directive executes a command in an intermediate container during image construction.
• virtual machineA virtual machine is a software-emulated computer that provides an isolated environment with virtualized hardware for running an operating system and its workloads.
• command-line interfaceA command-line interface is a text-based interface for invoking software operations by entering commands.
• storage driverA storage driver is a software component that implements the filesystem and metadata operations used to store container images and container filesystems.
• docker-pydocker-py is a Python client library that provides bindings for the Docker API and compatible container-management APIs.
• Docker ComposeDocker Compose is a tool for defining and running multi-container applications.
• inter-process communication namespaceAn IPC namespace is a Linux namespace that isolates System V IPC objects, POSIX message queues, and the /dev/shm shared-memory filesystem.
• Docker user groupThe Docker user group is a Unix group whose membership can grant users access to the Docker daemon socket, potentially providing host-root-equivalent control.
• RESTA REST API is a network interface that exposes resources and operations through HTTP using representational state transfer conventions.

These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.