Learning AlmaLinux - Containers & Virtualization (Podman, KVM)

#Introduction

In the previous episode, Episode 17, we optimized system performance. Now we face the two main ways to run modern workloads: containers and virtual machines. AlmaLinux supports both natively — rootless containers with Podman without a daemon, and full virtualization with KVM.

This episode equips you with the Podman toolchain (Podman, Buildah, Skopeo), container integration into systemd with Quadlet, orchestration with podman-compose, then moves on to KVM/libvirt for virtualization.

#Containers with Podman

Podman is Red Hat's daemonless container engine — no centralized daemon like Docker. Every container is an ordinary process run by systemd, making it more secure and more integrated with the system.

Check that Podman is installed

podman --version

Podman	Function
`podman pull <image>`	Pulls an image from a registry
`podman run -d --name web -p 8080:80 nginx`	Runs a container
`podman ps`	Lists active containers
`podman stop/start/rm <name>`	Stop, start, remove a container
`podman images`	Lists local images

#Rootless Containers

Podman's main advantage: rootless — containers run as a regular user, without root privileges. This drastically shrinks the attack surface.

Run a container as a regular user

podman run -d --name web -p 8080:80 docker.io/library/nginx
podman ps

#Buildah and Skopeo

The Podman ecosystem is completed by two companion tools:

Buildah — builds images without requiring a daemon or even a running container.
Skopeo — moves and inspects images between registries without running them.

Inspect an image with Skopeo

skopeo inspect docker://docker.io/library/nginx:latest | head

Build an image with Buildah

buildah bud -t myapp:latest .

#Registries

Allowed registries

unqualified-search-registries = ["docker.io", "quay.io"]
 
[aliases]
almalinux = "quay.io/almalinux/almalinux"

Run an AlmaLinux image

podman run -it almalinux bash

#Quadlet: Containers as Systemd Services

Quadlet turns container files into systemd units — containers are managed exactly like services:

/etc/containers/systemd/myapp.container

[Unit]
Description=My containerized app
 
[Container]
Image=docker.io/library/nginx
PublishPort=8080:80
 
[Install]
WantedBy=default.target

Enable a Quadlet container

systemctl --user daemon-reload
systemctl --user enable --now myapp

#Orchestration with podman-compose

For multi-container workloads, use podman-compose — compatible with compose.yaml files:

Install podman-compose

sudo dnf5 install -y podman-compose

compose.yaml for an app + database

services:
  web:
    image: docker.io/library/nginx:latest
    ports:
      - "8080:80"
  db:
    image: docker.io/library/postgres:16
    environment:
      POSTGRES_PASSWORD: secret

Run the stack

podman-compose up -d
podman-compose ps

#Virtualization with KVM/libvirt

For total isolation, use KVM — a full hypervisor that leverages CPU hardware virtualization.

Install KVM and libvirt

sudo dnf5 install -y @virtualization
sudo systemctl enable --now libvirtd

#Creating a VM with virt-install

Create a VM from an ISO

sudo virt-install \
  --name web01 \
  --vcpus 2 --memory 2048 \
  --disk path=/var/lib/libvirt/images/web01.qcow2,size=20 \
  --os-variant almalinux9 \
  --network bridge=br0 \
  --location /mnt/iso/AlmaLinux-9-latest-x86_64-dvd.iso

Info

The bridge network (br0) we created in episode 9 lets VMs get an IP from the same physical network — not internal NAT. That's why bridge networking is important for realistic virtualization.

#Managing VMs with virsh

virsh is the libvirt management CLI tool:

Basic VM management

virsh list --all
virsh start web01
virsh console web01
virsh shutdown web01

#Storage Pools and Graphical Guests

View storage pools and undefine a VM

virsh pool-list
virsh undefine web01

Install virt-manager

sudo dnf5 install -y virt-manager

#Common Pitfalls

Running containers as root without a reason. Podman rootless is safer — use a regular user.
Ignoring podman-compose for multi-container stacks. Managing containers one by one is a recipe for mistakes.
Using NAT for production VMs. Bridge networking gives more realistic direct network access.
Forgetting to enable libvirtd. KVM won't work until the virtualization daemon is running.
Skipping Quadlet. Containers that need auto-restart and centralized logging should be wrapped in systemd units.

#Conclusion

In this episode 18 you've run modern workloads on AlmaLinux: rootless containers with Podman, building images with Buildah, registry inspection with Skopeo, container integration into systemd via Quadlet, orchestration with podman-compose, and full KVM virtualization with virt-install, virsh, and bridge networking.

Key takeaways:

Podman is a daemonless and rootless container engine — its commands resemble Docker.
Buildah builds images, Skopeo moves/inspects images — all without a daemon.
Quadlet (*.container) turns containers into systemd units.
podman-compose runs multi-container stacks from a compose.yaml file.
KVM + libvirt: virt-install creates VMs, virsh manages them, br0 provides direct networking.
Official AlmaLinux images are on Quay.io.

With containers and VMs running, you're ready to take them to the cloud. In the next episode, Episode 19, we'll cover Cloud, WSL & Raspberry Pi Images — GenericCloud deployment with cloud-init on AWS, Azure, and GCP, AlmaLinux on Windows WSL, and the ARM64 Raspberry Pi images. See you there!