Understanding and Using Containers


What is a Container

  • A container is a self-contained ready-to-run application
  • This is what makes it different from a virtual machine!
  • Containers have all on board that is required to start the application
  • To start a container, a container runtime is required
  • The container runtime is running on a host platform and establishes communication between the local host kernel and the container
  • So, all containers, no matter what they do, run on top
    of the same local host kernel


Container Components

  • Images are read-only environments that contain the runtime environment, which includes the application and all libraries it requires
  • Containers are the isolated runtime environments where the application is running. By using namespaces the containers can be offered as a strictly isolated environment
  • Registries are used to store images. Docker Hub is a common registry, other registries exist (like quay.io) and private registries can be created also


Containers are Linux!

  • Containers are based on features offered by the Linux
    operating system
  • Linux Kernel Namespaces provide strict isolation between system components at different levels
    • network
    • file
    • users
    • processes
    • IPCs
  • Linux CGroups offer resource allocation and limitation


Container Runtimes

  • The container runtime allows for starting and running the container on top of the host OS
  • The container runtime is responsible for all parts of running the container which are not already a part of the running container program itself
  • Different container runtime solutions exist
    • docker
    • Ixc
    • runc
    • cri-o
    • containerd
  • These runtimes are included in the different container solutions



  • OCI is the Open Containers Initiative (https://opencontainers.org)
  • It standardizes the use of containers
    • The image-spec defines how to package a container in a “filesystem bundle”
    • The runtime-spec defines how to run that filesystem in a container
  • OCI standardization ensures compatibility between containers, no matter which environment they originally come from
  • The result is that for instance images made for Docker work without modifications in Red Hat Podman



  • Docker is important in the container landscape, but Docker is NOT the only way to run containers
  • When it started in 2013, Docker offered the following:
    • Container image format
    • Dockerfile, which is a method for building container images
    • A way to manage container images
    • A way to run containers
    • A way to manage container instances
    • A solution to share container images
  • Podman is the main alternative to Docker


Alternatives to Docker

  • With the launch of RHEL 8, Red Hat started offering Podman as an alternative to Docker
    • Podman runs containers without the need of having a daemon directly on top of the cri-o container runtime
    • Buildah is the related service that is used for managing container images
  • Other solutions for running containers also exist
    • LXC is a Linux-native container runtime
    • systemd-nspawn offers containers integrated in Systemd



  • Container registries are used to provide access to container images
  • Registries make distribution of containers easier: anyone can publish images on public registries
  • Docker Hub (hub.docker.com) is the biggest registry
  • Other registries exist as well, like quay.io
  • It’s also possible to create private registries


Accessing Registries

  • Access to registries is normally free
  • In some cases, additional authorization is required and you’ll need an account to access registry contents
  • On Docker Hub, an account gives access to additional features
    • Higher image pull limit
    • Web hooks connecting to GitHub
  • Use the browser-based login, or docker login from the command line


Starting Containers

  • Many environments are available, let’s look at Docker
  • To use containers on RHEL 8 and related distributions, you can use podman instead of docker
  • Use dnf install -y container-tools to install podman and related utilities


Installing Docker on Ubuntu

  • sudo apt-get update
  • sudo apt-get install apt-transport-https ca-certificates curl gnupg-agent software-properties-common
  • curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
  • sudo apt-key fingerprint OEBFCD88
  • sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(Isb_release -cs) stable"
  • sudo apt-get update
  • sudo apt-get install docker-ce docker-ce-cli containerd.io
  • sudo docker run hello-world


Running a Container

  • mkdir -p /var/www/html
  • echo hello from docker >> /var/www/html/index.html
  • docker run -d -p 8080:80 --name="myapache" -v /var/www/html:/var/www/html httpd
  • docker ps
  • ss -tunap | grep 8080
  • curl http://localhost:8080


Running Another Container

  • docker run -it busybox will start the busybox container with an interactive terminal to the entrypoint application
  • Ctrl-p, Ctrl-q to disconnect and keep it running
  • exit to stop the current container application
    • If you were connected to the entrypoint application, the container will stop
    • If you were connected to another shell session, the container will continue


Managing Containers – Common Commands

  • docker ps [-a]: shows currently [and past] running containers
  • docker start: starts a container from a locally stored image
  • docker stop: stops a container using Linux SIGTERM
  • docker restart: restarts a currently running container
  • docker kill: stops a container using Linux SIGKILL
  • docker rm: removes all container files from the host operating system


Inspecting Container Settings

  • docker ps will show the IDs of containers: pick one!
  • docker inspect <ID> | less
  • docker inspect --format='{{.NetworkSettings.IPAddress}}' containername
  • docker inspect --format ='{{.State.Pid}}' containername
  • Alternatively, use ps aux on the host to find the container PID


Managing Images

  • After fetching, the container images are stored on the host
  • Use docker images to get a list of images
  • Or use docker image --help to get an overview of all options related to managing container images


Container Logging

  • The container application does not connect to a STDOUT, which is why logs,
    by default, are written to the container
  • Use docker logs mycontainer to get access to the container log
  • Using docker logs is convenient for troubleshooting


Lab: Using Containers

  • Run the latest version of Ubuntu in a container
  • In interactive mode, start a bash shell and explore the /etc/os-release file, as well as the kernel version (uname -r)
  • Disconnect from the container without shutting it down

As we see the kernel version in the container is alwys the same like in the virtual machine.