From Terminal to Container: Tracing Podman Run
summary
Traces a single podman run from CLI through image pull, libpod create, storage overlay and OCI runtime to a running bash, contrasting root and rootless paths: rootless uses unshare plus newuidmap/newgidmap reading /etc/subuid to build a user namespace, mounts the filesystem with fuse-overlayfs, and tunnels networking via slirp4netns and CNI shims. Describes conmon daemonization, runC create/start sequence, cgroup differences (v1 vs v2), where exit codes are written, and podman container cleanup and removal.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:11About me
- 0:30Podman
- 1:07Architecture
- 1:55Username Space
- 4:58Pulling the Image
- 6:19Creating the Container
- 8:33Preparing to Start the Container
- 12:05Container Monitor
- 13:16OCI Create
- 15:42Attach
- 17:30Container Cleanup
- 18:27Questions
related talks
34mPodman 101 and Beyond!
39mPodman - create, run and secure Linux containers
34mPod Through a Magnifying Glass
30mPodman 6.0 — The Next Evolution of Rootless Containerization
35mThe Reality of Rootless Containers
38mUnderstanding root inside and outside a container
32mSeals to the Rescue of Whales - Discovering Podman
29mHow to Use Podman Quadlets