So what do we need to know about container storage?
Well, we need to know that container storage, by nature,
is ephemeral.
Ephemeral means short living.
And if you do the wrong thing, it might be gone.
If you remove a container, for instance,
the ephemeral storage is removed as well.
And that is why you need to create persistent storage.
The default way to configure persistent storage
is to bind mount directory on the host to a directory
within the container.
So in essence, you use popman and run minus d
followed by all other options that you need.
And then it comes minus v slash hostdir colon slash
containerdir, where slash hostdir, obviously,
is on the host.
And containerdir is what is found within the container.
To do this, the container needs file system permissions
to access the host directory.
This is accomplished by the fact that the container uses
its own user ID, which is mapped to a user
ID on the host computer.
Oh, and apart from that, you also
need to take care of SE Linux.
Now, let me show you just a bind mount
without taking care of these permissions
so that you understand what is going to happen.
So I'm creating a directory, db files.
Not going to use my files because we already
did some work on that.
And then I'm going to use my MariaDB image.
Popman images is showing the MariaDB image
that I want to use, this one.
In fact, let me just use the command that we used before
because this is almost everything.
I don't want the name mydb.
I don't need a fixed name.
I do need the environment variable.
And I need minus v.
So minus v is going to be db files in the current directory.
And I'm going to map that to var lib mysql.
That's what a bind mount looks like.
So it's looking for db files in the current directory.
In fact, I don't like the current directory.
I want it to be a full directory name
so that if ever it moves, it would still work.
It would look for db files, and it would map to var lib mysql.
We try to run it.
And then popman ps minus a is showing that three seconds ago,
Intelligent Snider has failed.
Why?
Well, Popman logs on Intelligent Snider.
It's showing why.
We get some, let me see, where is it?
Yeah, there it is.
Cannot create the directory.
Var lib mysql data permission denied.
And why is that?
Well, we can even investigate that.
Let's get to Popman images.
And let's do a Popman inspect on the image
that we are running.
So I'm doing my copy and Popman image inspect on this image,
piping through less.
And there we go.
This is the parameter that matters.
This image is hardcoded to run as user 27.
And user 27 has no permissions.
Can we verify that?
Of course, you can verify that if you get out of here.
And I use Popman unshare ls minus ld on dbfiles.
Now we can see that dbfiles is owned by a root.
So from a container namespace perspective,
user 27 is trying to write to something
that is owned by user root.
That's not going to work.
And as I mentioned on the slide, apart from that,
SQLinux needs to be configured as well.
In the next video, you'll find out what you
need to do to make this work.
OK, I want to try to get you a visual of what is happening
with these bind mounts.
So you should note that there is the host operating system
environment.
This is where your container is running.
And there you have the container.
And this container is running in a namespace.
And this namespace is really as if it
is its own operating system.
Now, if you want to create persistent storage
to a container within the namespace,
then normally what you are doing in the home directory
of the user that runs the storage,
you create a directory with the name myfiles.
And the contents of this directory
is presented within the container.
And you call it whatever is needed there.
Let's say srv myfiles.
And it means that if your container is creating
any files, the files are created here.
But when you create them here, as in reality,
the bind mount directory is this location,
the files end up here as well.
And in order to make that working, you need permissions.
Now, this is where the story of Popman Unshare comes in.
So you need some user here within the container.
And this some user must have permissions
to write here.
And in order to do that, you are going
to use Popman Unshare some user.
Now, that is something that you do on the host operating
system.
But because of the user mapping between the host
and the container, well, you will see the appropriate user
right here.
And that's going to happen when you use an ls minus ld
on this directory.
If you would do that from within the container,
then you see that the user has been set.
Now, how do we do that from within the container?
By using Popman Unshare in front of it.
You don't have to actually connect to the container.
You just on your host would use Popman Unshare ls minus ld
on this directory.
Now, there is another perspective on this situation
as well.
And that is the perspective on the host operating system.
So what are you going to do to find out
if anything has happened on the host operating system?
Well, there you use good old ls minus ld on the directory.
And what will you see here?
Here you will see that some UID mapping has happened.
And depending on the user ID mapping that you have created,
you will see a specific owner on the directory on your host.
And that is what this bind mount and this Popman Unshare
is all about.