Red Hat OpenShift Development I: Introduction to Containers with Podman

Because container images package software, developers often consider images as deployment artifacts. To keep images up to date, developers often map the image versions to the versions of the packaged software. Keeping images up to date also means updating the OS libraries within the image to receive improvements and security fixes.

One way to version images relative to their packaged software product is to use semantic versioning. Semantic version numbers form a string with the format MAJOR.MINOR.PATCH meaning:

Because versioning has no enforced structure, it is up to the image maintainers to follow good versioning practices. This is one reason why you should use trusted image registries and repositories.

Image versions can be used in the image name or in the image tag. An image tag is a string that you specify after the image name. Also, the same image can have multiple tags.

[<image repository>/<namespace>/]<image name>[:<tag>]

Using a tag in Podman is optional. When you do not specify a tag in a Podman command, Podman uses the latest tag by default.

[user@host ~]$ podman pull quay.io/argoproj/argocd
Trying to pull quay.io/argoproj/argocd:latest...
...output omitted...

Using the latest tag is considered a bad practice. Because the latest tag also represents the latest version of the image, it can include backwards-incompatible changes and cause containers that use the image to break.

To create additional tags for local images, use the podman image tag command.

[user@host ~]$ podman image tag LOCAL_IMAGE:TAG LOCAL_IMAGE:NEW_TAG

To search for images in different image registries, use a web browser to navigate to the registry URL and use the web UI.

Alternatively, use the podman search command to search for images in all the registries present in the unqualified-search-registries list in your registries.conf file. This enables you to search multiple registries.

[user@host ~]$ podman search nginx
NAME                                              DESCRIPTION
registry.fedoraproject.org/f29/nginx
...output omitted...
registry.access.redhat.com/ubi8/nginx-118       Platform for running nginx 1.18 or building...
...output omitted...
docker.io/library/nginx                         Official build of Nginx.
...output omitted...
quay.io/linuxserver.io/baseimage-alpine-nginx
...output omitted...

To retrieve an image, run podman image pull IMAGE_NAME, which downloads the image from a registry. Alternatively, podman pull IMAGE_NAME provides the same functionality.

[user@host ~]$ podman pull registry.redhat.io/rhel8/mariadb-103:1

When you pull an image as a non-root user, Podman stores container images in the ~/.local/share/containers directory.

To find which images your user has available locally, use the podman image ls or podman images command.

[user@host ~]$ podman image ls
REPOSITORY                                TAG    IMAGE ID     CREATED     SIZE
registry.redhat.io/rhel9/python-39        1-52   d336a3191d35 3 weeks ago 995 MB
registry.access.redhat.com/ubi8/python-39 latest 6b7a42c9d513 4 weeks ago 894 MB
...output omitted...

If an image is pulled by the root user, then it is stored in the /var/lib/containers directory. This image is only listed when podman image ls is run as root.

You can also build an image from a Containerfile, which describes the steps used to build an image. Run the podman build --file CONTAINERFILE --tag IMAGE_REFERENCE to build a container image.

For example, to build an image that you can later push to Red Hat Quay.io, execute the following command:

[user@host ~]$ podman build --file Containerfile \
  --tag quay.io/YOUR_QUAY_USER/IMAGE_NAME:TAG

After you build an image, share it by pushing it to a remote registry. To push an image, you must be logged in to the registry. Run the podman login REGISTRY to log in to the specified registry. Then, you can use the podman push IMAGE command to push a local image to the remote registry.

For example, to push an image to Quay.io, run the following command:

[user@host ~]$ podman push quay.io/YOUR_QUAY_USER/IMAGE_NAME:TAG
Getting image source signatures
Copying blob fb3154998920 done
...output omitted...
Writing manifest to image destination
Storing signatures

The podman image inspect command provides useful information about a locally available image in your system.

The following example usage shows information about a mariadb image.

[user@host ~]$ podman image inspect registry.redhat.io/rhel8/mariadb-103:1
 [
   {
    "Id": "6683...98ea",
    ...output omitted...
    "Config": {
      "User": "27", 
      "ExposedPorts": { 
           "3306/tcp": {}
      },
      "Env": [ 
           "PATH=/opt/app-root/src/bin:/opt/app-root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
            ...output omitted...
          ],
      "Entrypoint": [ 
           "container-entrypoint"
      ],
      "Cmd": [ 
           "run-mysqld"
      ],
      "WorkingDir": "/opt/app-root/src", 
      "Labels": { 
         ...output omitted...
         "release": "177.1654147959",
         "summary": "MariaDB 10.3 SQL database server",
         "url": "https://access.redhat.com/containers/#/registry.access.redhat.com/rhel8/mariadb-103/images/1-177.1654147959",
        ...output omitted...
    "Architecture": "amd64", 
    "Os": "linux",
    "Size": 573593952,
    ...output omitted...

The output from podman inspect is verbose, which makes it hard to find information. To select a specific part of the output use the Go templating feature in Podman by providing the --format option. Use the podman inspect output keys preceded by dots and surrounded by double curly braces.

--format="{{.Key.Subkey}}"

For example, the following command extracts the CMD instruction from the rhel8/mariadb-103 image:

[user@host ~]$ podman image \
  inspect registry.redhat.io/rhel8/mariadb-103:1 \
  --format="{{.Config.Cmd}}"
[run-mysqld]

To inspect a remote image, you can use the Skopeo tool.

You can delete local images that are no longer used by any container. Run the podman image rm or the podman rmi command to delete a container image.

[user@host ~]$ podman image rm REGISTRY/NAMESPACE/IMAGE_NAME:TAG

If the image is in use by a container, then Podman fails to remove it. You must first remove any containers using the image by running podman stop container-name. Alternatively, force Podman to remove the image by providing the -f option. This automatically stops and removes any containers that use the image and then removes the image.

[user@host ~]$ podman image rm -f REGISTRY/NAMESPACE/IMAGE_NAME:TAG

With the --all option, you can delete all images in the local storage.

[user@host ~]$ podman rmi --all

[user@host ~]$ podman image rm --all

Images without tags and that are not referenced by other images are considered dangling images. Use the podman image prune command to delete dangling images from your local storage. When executing the podman image prune command, Podman displays an interactive prompt to confirm image removal.

[user@host ~]$ podman image prune
WARNING! This command removes all dangling images.
Are you sure you want to continue? [y/N]

To delete both dangling and unused images, provide the --all or -a option.

[user@host ~]$ podman image prune -a
WARNING! This command removes all images without at least one container associated with them.
Are you sure you want to continue? [y/N]

You can include the -f option to force the removal and to avoid the interactive prompt.

[user@host ~]$ podman image prune -af