Learn Rocky Linux - Containerization (Podman, Buildah, Skopeo)

#Introduction

In the previous episode 19, you ran many operating systems on one machine with KVM. Now it's time for a lighter approach: containers. Where VMs virtualize hardware, containers virtualize the operating system — sharing the same kernel but isolating processes, filesystems, and networking.

Rocky Linux brings the native Linux container ecosystem: Podman as the daemonless engine, Buildah for building images without a daemon, and Skopeo for inspecting and transferring images. Together they do the same job as Docker — but without a central daemon, and with full support for rootless operation and systemd integration.

#Podman: The Daemonless Container Engine

#The Podman Concept

Podman's biggest philosophical difference from Docker: no daemon. Every container is run directly as a process by Podman, which makes it safe to run as a regular user. There is no central daemon that becomes a single point of failure or an attack target.

podman --version

#Running Containers

Podman commands mimic Docker almost 1:1:

podman run -d --name web -p 8080:80 nginx

podman ps
podman ps -a

podman exec -it web bash
podman logs web
podman stop web
podman rm web

podman run -d --name web -p 8080:80 nginx runs nginx in the background with port 8080 forwarded to the container's port 80. -p works on top of the firewall mechanism — and don't forget to open port 8080 in firewalld from episode 13.

#Rootless Containers

Podman's most meaningful advantage: rootless. A regular user runs containers with no root privileges at all — following the least privilege principle from episode 6:

su - arman
podman run -d --name myweb -p 9091:80 nginx
podman ps

Rootless containers map the user's UID inside a namespace, so container processes never hold root rights on the host — extra isolation that closes many classic container attacks.

#Podman Compose

For multi-container applications, podman-compose mimics docker-compose:

dnf5 install podman-compose

cat > compose.yaml <<'EOF'
services:
  web:
    image: nginx
    ports:
      - "8080:80"
  db:
    image: postgres:16
    environment:
      POSTGRES_PASSWORD: example
EOF

podman-compose up -d
podman-compose ps

A single file describes the whole stack — web, database, and their dependencies — and podman-compose up -d brings it all up.

#Buildah and Skopeo

#Building Images with Buildah

Buildah builds images without a daemon and without a running container:

buildah bud -t myapp:v1 .

buildah bud -t myapp:v1 -f Containerfile

podman images

buildah bud (build using Dockerfile) reads a Containerfile and produces a local image that Podman can use directly. This is also how the OS images from episode 18 are built.

#Skopeo for Inspection and Transfer

Skopeo works with images in a registry without pulling them locally:

skopeo inspect docker://quay.io/podman/hello

skopeo copy \
  docker://registry.example.com/app:v1 \
  docker://quay.io/mirror/app:v1

skopeo inspect shows the image's labels, architecture, and size. skopeo copy moves images between registries without a container runtime — an essential tool for mirrors and internal registries.

#Registry Configuration

#Registries.conf

Image sources are configured in /etc/containers/registries.conf — it determines which registries are used and how image lookup works:

cat /etc/containers/registries.conf

echo '
[registries.search]
registries = ["docker.io", "quay.io", "registry.example.com"]
' > /etc/containers/registries.conf.d/internal.conf

With registries configured, podman pull nginx searches the registry list in order — and you can add your company's internal registry as a default source.

#Quadlet: Containers and Systemd

#The Quadlet Concept

Quadlet integrates containers with systemd — containers are run and maintained as systemd units, following everything you learned in episode 7. This is the official approach for running containers as services that restart automatically.

#Example Quadlet Unit

Quadlet units live in /etc/containers/systemd/:

cat > /etc/containers/systemd/web.container <<'EOF'
[Unit]
Description=NGINX web server
 
[Container]
Image=docker.io/library/nginx:latest
PublishPort=8080:80
 
[Service]
Restart=on-failure
 
[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now container-web

systemctl status container-web
journalctl -u container-web

After daemon-reload, Quadlet automatically generates the container-web.service systemd unit. The container now restarts automatically on failure, starts at boot, and its logs flow into journald — exactly like a regular service from episode 7.

#Closing

In this episode 20, you mastered Rocky Linux containerization: Podman as a daemonless engine with rootless containers, podman-compose for multi-container stacks, Buildah for building images, Skopeo for inspecting and transferring images, registry configuration, and Quadlet for integrating containers with systemd.

Key takeaways:

• Daemonless Podman makes containers safe to run as a regular user (rootless).
• Use podman-compose for multi-container stacks defined in a single file.
• Buildah builds images without a daemon; Skopeo inspects and moves images.
• Configure registries in /etc/containers/registries.conf and its drop-ins.
• Quadlet turns containers into systemd units with automatic restarts and centralized logs.

In the next episode 21, we will discuss Rocky 10, lifecycle, and roadmap — the main features of Rocky 10 based on RHEL 10, the minor release schedule and support period, migrating from Rocky 9, and the cloud-native development direction. Containers are mastered; now it's time to understand where the ecosystem is heading!