In this video, I'll tell you about Potman and containers.
So what is a container?
Well, a container is really like an app on your smartphone.
It's a package that contains all that is
needed to run an application.
You don't have to install anything.
Just fetch it and run it.
And that makes containers the ultimate solution
for the dependency challenge.
Containers are started from container images.
And images are provided through image registries.
It's like a repository.
Containers rely on features that are provided
by the Linux operating system.
Control groups, or cgroups, set limits
to the amount of resources that can be used by a container.
So if you want your containerized application
to be able to use 4 megabytes of RAM and that's it, you got it.
cgroups will do it for you.
Namespaces provide isolation to ensure
that the container only has access to its own data
and configuration.
And then there is SELinux, an additional rel
which enforces security.
In Red Hat Enterprise Linux 10, Potman
is used for running containers.
And one of the most important features for Potman
is the rootless container.
Now, what is the rootless container about?
Well, that has to deal with the fact
that a container needs a user ID to be
started on the host computer.
Root containers are containers which
are started with root privileges.
And that makes the container potentially insecure.
Rootless containers are started as a non-root user.
And rootless containers can generate a UID dynamically
or be pre-configured to use a specific UID.
Because if user Bob wants to run a container,
then the application in the container
probably doesn't necessarily have to run as user Bob.
And that's why you need these dynamic UIDs.
Rootless containers do have a few considerations
if you compare them to other solutions, such as Docker.
Such as they have no unlimited access to the file system,
and they can't bind to privileged network ports.
Some people say that these are disadvantages.
I do not agree.
These make containers more secure.
So rootless containers are more secure.
They're good.
Now, in the context of containers,
you sometimes have to run complex applications.
A complex application typically is
composed of multiple containers.
Normally, one container runs one application.
And that offers the benefit of good manageability.
If you want to manage microservices,
which means that you are connecting different application
components together to build a new application,
typically you use an orchestration platform,
such as Kubernetes or Red Hat OpenShift.
So RHEL 10 is using Popman as a default container stack.
A long time ago, Docker was the default stack.
But Docker has been unsupported since RHEL 8.
Popman manages containers and container images.
It's a command that you will work with most of the time.
Well, for RHCSA, even all of the time.
There's also Builder, which is an advanced tool
to create container images.
And there's Scopio, which is an advanced tool
to manage, copy, delete, and sign images.
Don't worry about Builder and Scopio.
RHCSA is all about Popman.