Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:redhat:rh134:l108 [2024/10/24 03:51] – created admin | elearning:workbooks:redhat:rh134:l108 [2024/11/22 08:50] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| + | |||
| + | Version : **2024.01** | ||
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======RH13410 | + | ======RH13409 |
| - | =====Contenu du Module===== | + | =====Contenu du Cours===== |
| - | * **RH13410 | + | * **RH13409 |
| - | * Présentation | + | * Contenu du Cours |
| - | * Les Services | + | * Présentation |
| - | * Les Services RPC | + | * Historique |
| - | * Options | + | * Conteneurs vs Machines Virtuelles |
| - | * Commandes de Base | + | * Machines Virtuelles |
| - | * Installation | + | * Conteneurs |
| - | * Mise en Place | + | * Conteneurs Rootless |
| - | * Configuration | + | * Architecture à base de Conteneurs |
| - | * Configuration | + | * Outils de Gestion des Conteneurs |
| - | * Surveillance du Serveur | + | * Images et Registres des Conteneurs |
| - | * La Commande rpcinfo | + | * Podman |
| - | * La Commande nfsstat | + | * Présentation |
| + | * La Commande Podman | ||
| + | * LAB #1 - Configuration des Registres | ||
| + | * LAB #2 - Gestion des Images | ||
| + | * 2.1 - Télécharger une Image | ||
| + | * 2.2 - Créer une Image à l' | ||
| + | * LAB #3 - Gestion des Conteneurs | ||
| + | * 3.1 - Création d'un Conteneur | ||
| + | * 3.2 - Démarrage d'un Conteneur | ||
| + | * 3.3 - Exécution d'une Commande dans un Conteneur | ||
| + | * 3.4 - Suppression des Images et des Conteneurs | ||
| + | * LAB #4 - Gestion du Stockage et du Réseau | ||
| + | * 4.1 - Gestion | ||
| + | * 4.2 - Gestion | ||
| + | * LAB #5 - Gestion des Conteneurs en tant que Services Système | ||
| + | * 5.1 - Création du Gestionnaire de Conteneurs | ||
| + | * 5.2 - Création d'un Conteneur de Serveur Web | ||
| - | =====Présentation===== | ||
| - | Quand on parle de NFS, on parle d' | + | =====Présentation |
| - | Le Network File System (NFS) est le protocole de partage de fichiers historique sur des systèmes Unix. Lors de l'introduction de Samba, NFS a vu sa popularité diminuée, essentiellement parce que la connexion est non-sécurisée : | + | Un isolateur |
| - | * le partage ainsi que ses caractéristiques sont configurés par rapport à l' | + | ====Historique==== |
| - | * aucun mot de passe n'est demandé lors de la connexion d'un utilisateur à une ressource car le serveur NFS présume que l' | + | |
| - | Cependant | + | * **1979** - [[https:// |
| + | * **2000** - [[https:// | ||
| + | * **2004** - [[https:// | ||
| + | * **2005** - [[https:// | ||
| + | * **2008** - [[https:// | ||
| + | * **2013** - [[https:// | ||
| + | * **2014** - [[https:// | ||
| + | * **2018** - [[https:// | ||
| - | Il existe actuellement 3 versions de NFS : | + | ====Conteneurs vs Machines Virtuelles==== |
| - | ^ Version ^ Protocole Utilisé ^ Dépendance ^ | + | Les conteneurs |
| - | | **NFSv2** | TCP et UDP | portmap | | + | |
| - | | **NFSv3** | TCP et UDP | portmap | | + | |
| - | | **NFSv4** | TCP | Aucune - les fonctions de portmap | + | |
| - | La version utilisée | + | * **Architecture et Isolation** |
| + | * **Conteneurs** - Un conteneur virtualise uniquement le système d' | ||
| + | * **Machines Virtuelles** - Une VM virtualise le matériel physique. Chaque VM exécute un système d' | ||
| + | * **Poids et Performance** | ||
| + | * **Conteneurs** - Les conteneurs sont légers et démarrent rapidement car ils n’incluent pas d’OS complet. Ils consomment moins de ressources car ils partagent le noyau de l’OS hôte, ce qui les rend plus performants pour les déploiements rapides. | ||
| + | * **Machines Virtuelles** - Les VMs sont plus lourdes et demandent plus de ressources, car chaque VM nécessite son propre OS. Elles mettent plus de temps à démarrer et consomment plus de mémoire et de CPU. | ||
| + | * **Cas d’utilisation** | ||
| + | * **Conteneurs** - Idéaux pour les microservices, | ||
| + | * **Machines Virtuelles** - Conviennent aux applications nécessitant un niveau élevé d' | ||
| + | * **Sécurité** | ||
| + | * **Conteneurs** - Moins isolés que les VMs, car ils partagent le noyau de l'OS hôte. Bien que l' | ||
| + | | ||
| - | ====Les Services | + | En résumé, les conteneurs sont légers, rapides |
| - | La version NFSv3 utilise | + | Graphiquement, |
| - | ^ Services ^ Fonction ^ | + | ====Conteneurs Rootless |
| - | | **nfs** | Démarre le service NFS ainsi que les processus RPC pour recevoir | + | |
| - | | **nfslock** | Démarre les processus RPC qui permettent aux clients de verrouiller les fichiers sur le serveur | + | |
| - | | **portmap** | Gestion des réservations des ports pour les services RPC locaux afin que les services RPC distants puissent se connecter | | + | |
| - | ===Les Services RPC=== | + | Sur l' |
| - | Les services RPC ( //Remote Procedure Calls// | + | Un conteneur Rootless n'est pas autorisé à utiliser les ressources du système qui sont habituellement réservées aux utilisateurs privilégiés comme l' |
| - | Lorsque le client veut faire une requête à un service RPC, il contacte en premier lieu le service **rpcbind** qui assigne | + | On peut exécuter les conteneurs directement en tant que root si nécessaire, mais ce scénario affaiblit la sécurité du système si un bogue permet |
| - | ====Options d'un Partage NFS==== | + | ====Architecture à base de Conteneurs==== |
| - | Certaines options, appliquées | + | Les conteneurs sont un moyen efficace de réutiliser les applications hébergées et de les rendre portables. Les conteneurs peuvent être facilement déplacés d'un environnement |
| - | ^ Option ^ Comportement ^ | + | Les conteneurs sont généralement temporaires ou éphémères. Vous pouvez enregistrer |
| - | | **ro** | Accès en lecture seule | | + | |
| - | | **rw** | Accès en lecture / écriture | | + | |
| - | | **sync** | Ecriture synchrone ( écriture immédiate sur disque ) | | + | |
| - | | **async** | Ecriture asynchrone ( écriture sur disque en utilisant une cache ) | | + | |
| - | | **root_squash** | Root perd ses prérogatives sur le partage concerné | | + | |
| - | | **no_root_squash** | Root garde ses prérogatives sur le partage concerné | | + | |
| - | | **no_lock** | Pas de verrous sur les fichiers accédés | | + | |
| - | | **all_squash** | Force la mapping de tous les utilisateurs vers l'utilisateur **nobody** | | + | |
| - | | **anonuid** | Fixe l' | + | |
| - | | **anongid** | Fixe le GID de l' | + | |
| - | <WRAP center round important> | + | On peut installer une application logicielle complexe avec plusieurs services dans un seul conteneur. Par exemple, un serveur web peut avoir besoin d' |
| - | **Important** : Si plusieurs options sont spécifiées, | + | |
| + | ====Outils de Gestion des Conteneurs==== | ||
| + | |||
| + | RHEL fournit un ensemble d' | ||
| + | |||
| + | * **podman** pour gérer les Conteneurs et les Images, | ||
| + | * **skopeo** pour inspecter, copier, supprimer et signer les Images, | ||
| + | * **buildah** pour créer des Images. | ||
| + | |||
| + | <WRAP center round important | ||
| + | **Important** : L' | ||
| </ | </ | ||
| - | ====Commandes de Base==== | + | ====Images et Registres des Conteneurs==== |
| - | Plusieurs commandes permettent | + | Pour exécuter des conteneurs, il faut utiliser une image de conteneur. Une image de conteneur est un fichier statique qui contient des étapes codifiées |
| - | ^ Commande ^ Comportement ^ | + | Les images des conteneurs sont construites conformément à des spécifications, |
| - | | **exportfs** | Affiche les partages actifs sur le serveur courant | | + | |
| - | | **nfsstat** | Affiche | + | |
| - | | **rpcinfo** | Affiche les démons gérés | + | |
| - | | **showmount** | Affiche les partages actifs sur un serveur distant | | + | |
| - | | **mount** | Permet de monter un partage distant sur un répertoire local | | + | |
| - | =====Installation===== | + | Un registre de conteneurs est un référentiel permettant de stocker et de récupérer des images de conteneurs. Un développeur pousse ou télécharge des images de conteneurs dans un registre de conteneurs. Ensuite le développeur extrait ou télécharge des images de conteneurs d'un registre vers un système local pour exécuter des conteneurs. |
| - | Installez | + | Il est possible d' |
| + | |||
| + | Red Hat distribue des images de conteneurs certifiées par le biais de deux registres de conteneurs principaux auxquels il est possible d' | ||
| + | |||
| + | * **registry.redhat.io** pour les conteneurs basés sur les produits officiels de Red Hat, | ||
| + | * **registry.connect.redhat.com** pour les conteneurs basés sur des produits tiers. | ||
| + | |||
| + | Le **[[https:// | ||
| + | |||
| + | ====Podman==== | ||
| + | |||
| + | ===Présentation=== | ||
| + | |||
| + | Podman, créé en 2018, est un outil open-source de gestion de conteneurs développé par Red Hat. Il offre des fonctionnalités similaires à Docker mais se distingue par sa conception " | ||
| + | |||
| + | Podman est basé sur OCI (Open Container Initiative) pour la compatibilité avec les formats d' | ||
| + | |||
| + | Podman utilise à la fois les namespaces et les cgroups, qui sont des fonctionnalités centrales du noyau Linux pour isoler et limiter les ressources des conteneurs. | ||
| + | |||
| + | * **Namespaces** - Les namespaces sont utilisés pour isoler différents aspects de l' | ||
| + | * **Cgroups** (Control Groups) | ||
| + | |||
| + | La combinaison des namespaces et des cgroups permet à Podman de fournir une isolation forte entre les conteneurs et de contrôler la consommation des ressources, tout en restant conforme aux standards OCI pour l' | ||
| + | |||
| + | ===La Commande Podman=== | ||
| + | |||
| + | **Podman** est contenu dans le méta-paquet **container-tools**. Podman fournit plusieurs sous-commandes pour interagir avec les conteneurs et les images.La liste suivante présente les sous-commandes utilisées dans cette section : | ||
| + | |||
| + | ^ Commande ^ Description ^ | ||
| + | | **podman build** | Construire une image de conteneur avec un fichier de conteneur. | | ||
| + | | **podman run** | Exécuter une commande dans un nouveau conteneur. | | ||
| + | | **podman images** | Liste des images stockées localement. | | ||
| + | | **podman ps** | Imprimer des informations sur les conteneurs. | | ||
| + | | **podman inspect** | Affiche la configuration d'un conteneur, d'une image, d'un volume, d'un réseau ou d'un pod. | | ||
| + | | **podman pull** | Télécharger une image à partir d'un registre. | | ||
| + | | **podman cp** | Copier des fichiers ou des dossiers entre un conteneur et le système de fichiers local. | | ||
| + | | **podman exec** | Exécuter une commande dans un conteneur en cours d' | ||
| + | | **podman rm** | Supprimer un ou plusieurs conteneurs. | | ||
| + | | **podman rmi** | Supprimer une ou plusieurs images stockées localement. | | ||
| + | | **podman search** | Recherche d'une image dans un registre. | | ||
| + | |||
| + | =====LAB #1 - Configuration des Registres===== | ||
| + | |||
| + | La configuration par défaut des registres de conteneurs se trouve dans le fichier **/ | ||
| < | < | ||
| - | root@debian8:~# apt-get install nfs-kernel-server nfs-common | + | [trainee@redhat9 |
| - | Reading package lists... Done | + | # For more information on this configuration file, see containers-registries.conf(5). |
| - | Building dependency tree | + | # |
| - | Reading state information... Done | + | # NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES |
| - | nfs-common is already | + | # We recommend always using fully qualified image names including |
| - | The following NEW packages will be installed: | + | # server |
| - | nfs-kernel-server | + | # (e.g., registry.redhat.io/ubi8/ubi:latest). Pulling by digest (i.e., |
| - | 0 upgraded, 1 newly installed, 0 to remove | + | # quay.io/repository/ |
| - | Need to get 115 kB of archives. | + | # When using short names, there is always an inherent risk that the image being |
| - | After this operation, 515 kB of additional disk space will be used. | + | # pulled could be spoofed. For example, a user wants to pull an image named |
| - | Do you want to continue? [Y/n] y | + | # `foobar` from a registry |
| - | Get:1 http:// | + | # myregistry.com is not first in the search list, an attacker could place a |
| - | Fetched 115 kB in 0s (318 kB/s) | + | # different `foobar` image at a registry earlier in the search list. The user |
| - | Selecting previously unselected package nfs-kernel-server. | + | # would accidentally pull and run the attacker' |
| - | (Reading database ... 82450 files and directories currently installed.) | + | # intended content. We recommend only adding registries which are completely |
| - | Preparing | + | # trusted |
| - | Unpacking nfs-kernel-server | + | # create accounts with arbitrary names). This will prevent an image from being |
| - | Processing triggers for man-db (2.7.0.2-5) ... | + | # spoofed, squatted or otherwise made insecure. If it is necessary to use one |
| - | Processing triggers for systemd (215-17+deb8u4) ... | + | # of these registries, it should be added at the end of the list. |
| - | Setting up nfs-kernel-server (1:1.2.8-9) ... | + | # |
| + | # # An array of host[:port] registries to try when pulling an unqualified image, in order. | ||
| - | Creating config file / | + | unqualified-search-registries = [" |
| - | Creating config file /etc/default/nfs-kernel-server | + | # [[registry]] |
| - | Processing triggers | + | # # The " |
| + | # # (only) the TOML table with the longest match for the input image name | ||
| + | # # (taking into account namespace/repo/tag/digest separators) is used. | ||
| + | # # | ||
| + | # # The prefix can also be of the form: *.example.com for wildcard subdomain | ||
| + | # # matching. | ||
| + | # # | ||
| + | # # If the prefix field is missing, it defaults to be the same as the " | ||
| + | # prefix = " | ||
| + | # | ||
| + | # # If true, unencrypted HTTP as well as TLS connections with untrusted | ||
| + | # # certificates are allowed. | ||
| + | # insecure = false | ||
| + | # | ||
| + | # # If true, pulling images with matching names is forbidden. | ||
| + | # blocked = false | ||
| + | # | ||
| + | # # The physical location of the " | ||
| + | # # | ||
| + | # # By default, this is equal to " | ||
| + | # # and the [[registry]] TOML table can only specify " | ||
| + | # # | ||
| + | # # Example: Given | ||
| + | # # | ||
| + | # # | ||
| + | # # requests for the image example.com/ | ||
| + | # # internal-registry-for-example.net/ | ||
| + | # | ||
| + | # # The location can be empty iff prefix is in a | ||
| + | # # wildcarded format: " | ||
| + | # # be used as-is without any rewrite. | ||
| + | # location = internal-registry-for-example.com/ | ||
| + | # | ||
| + | # # (Possibly-partial) mirrors for the " | ||
| + | # # | ||
| + | # # The mirrors are attempted in the specified order; the first one that can be | ||
| + | # # contacted and contains the image will be used (and if none of the mirrors contains the image, | ||
| + | # # the primary location specified by the " | ||
| + | # # user-specified reference, is tried last). | ||
| + | # # | ||
| + | # # Each TOML table in the " | ||
| + | # # as if specified in the [[registry]] TOML table directly: | ||
| + | # # - location | ||
| + | # # - insecure | ||
| + | # [[registry.mirror]] | ||
| + | # location = " | ||
| + | # [[registry.mirror]] | ||
| + | # location = " | ||
| + | # insecure = true | ||
| + | # # Given the above, a pull of example.com/ | ||
| + | # # 1. example-mirror-0.local/ | ||
| + | # # 2. example-mirror-1.local/ | ||
| + | # # 3. internal-registry-for-example.net/ | ||
| + | # # in order, and use the first one that exists. | ||
| + | short-name-mode = " | ||
| </ | </ | ||
| - | =====Mise en Place===== | + | Commencez par vous connecter au registre **registry.access.redhat.com** : |
| - | ====Configuration du Serveur==== | + | < |
| + | [trainee@redhat9 ~]$ podman login registry.access.redhat.com | ||
| + | Username: < | ||
| + | Password: < | ||
| + | Login Succeeded! | ||
| + | </ | ||
| + | |||
| + | Pour vérifier si vous êtes connecté au registre **registry.access.redhat.com**, | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman login registry.access.redhat.com --get-login | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | Notez que vous devez vous connecter à chaque registre séparément : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman login registry.redhat.io --get-login | ||
| + | Error: not logged into registry.redhat.io | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman login registry.redhat.io | ||
| + | Username: < | ||
| + | Password: < | ||
| + | Login Succeeded! | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman login registry.redhat.io --get-login | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | Les directives dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ mkdir .config/ | ||
| + | |||
| + | [trainee@redhat9 ~]$ vi .config/ | ||
| + | |||
| + | [trainee@redhat9 ~]$ cat .config/ | ||
| + | unqualified-search-registries | ||
| + | |||
| + | [[registry]] | ||
| + | location | ||
| + | insecure | ||
| + | blocked | ||
| + | </ | ||
| + | |||
| + | Pour vérifier si ce fichier est pris en compte, consultez la sortie de la commande **podman info** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman info | ||
| + | ... | ||
| + | registries: | ||
| + | search: | ||
| + | - registry.access.redhat.com | ||
| + | - registry.redhat.io | ||
| + | - docker.io | ||
| + | store: | ||
| + | configFile: / | ||
| + | containerStore: | ||
| + | number: 0 | ||
| + | paused: 0 | ||
| + | running: 0 | ||
| + | stopped: 0 | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | =====LAB #2 - Gestion des Images===== | ||
| + | |||
| + | ====2.1 - Télécharger une Image==== | ||
| + | |||
| + | Pour obtenir une image et la stocker localement, sans créer de conteneur, utilisez la commande **podman pull** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman pull registry.access.redhat.com/ | ||
| + | Trying to pull registry.access.redhat.com/ | ||
| + | Getting image source signatures | ||
| + | Checking if image destination supports signatures | ||
| + | Copying blob 8756f22094d0 done | | ||
| + | ... | ||
| + | Copying config 142e82b6e6 done | | ||
| + | Writing manifest to image destination | ||
| + | Storing signatures | ||
| + | 142e82b6e600e0a2208e32bcffab89cd6257316f93b22a1f12f172756ed7fe53 | ||
| + | </ | ||
| + | |||
| + | Pour examiner l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ su - | ||
| + | Password: | ||
| + | [root@redhat9 ~]# dnf install skopeo -y | ||
| + | ... | ||
| + | [root@redhat9 ~]# exit | ||
| + | logout | ||
| + | [trainee@redhat9 ~]$ | ||
| + | </ | ||
| + | |||
| + | Utilisez maintenant la commande **skopeo inspect** pour examiner l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ skopeo inspect docker:// | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ... | ||
| + | " | ||
| + | " | ||
| + | ... | ||
| + | " | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ], | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | Pour lister les images disponibles localement, utilisez la commande **podman images** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman images | ||
| + | REPOSITORY | ||
| + | registry.access.redhat.com/ | ||
| + | </ | ||
| - | <WRAP center round important> | + | <WRAP center round important |
| - | **Important** | + | **Important** |
| </ | </ | ||
| - | Configurez votre interface réseau #2 (eth1) | + | ====2.2 - Créer une Image à l'aide d'un Fichier Containerfile==== |
| + | |||
| + | Créez un contexte sous la forme d'un répertoire, | ||
| < | < | ||
| - | root@debian8:~# nmcli connection add con-name ip_fixe ifname eth1 type ethernet ip4 10.0.2.16/ | + | [trainee@redhat9 |
| - | Connection ' | + | |
| - | root@debian8:~# nmcli connection mod ip_fixe ipv4.dns 8.8.8.8 | + | [trainee@redhat9 |
| - | root@debian8:~# nmcli connection up ip_fixe | + | |
| - | Connection successfully activated (D-Bus active path: / | + | [trainee@redhat9 rh13409]$ vi Containerfile |
| - | root@debian8:~# nmcli c show | + | |
| - | NAME | + | [trainee@redhat9 rh13409]$ cat Containerfile |
| - | eth1 | + | FROM registry.access.redhat.com/ |
| - | eth0 | + | RUN dnf install |
| - | Ifupdown (eth0) | + | CMD ["/ |
| - | ip_fixe | + | |
| - | root@debian8: | + | |
| - | root@debian8:~# nmcli c show | + | |
| - | NAME | + | |
| - | eth0 | + | |
| - | ip_fixe | + | |
| - | Ifupdown (eth0) | + | |
| - | eth1 | + | |
| </ | </ | ||
| - | Ajoutez une autre adresse IP pour le NFS : | + | Dans le fichier **Containerfile**, |
| + | |||
| + | ^ Commande ^ Description ^ | ||
| + | | **FROM** | Définit l' | ||
| + | | **RUN** | Lance un processus dans la construction de la nouvelle image. | | ||
| + | | **CMD** | Définit la commande qui sera exécutée dans le conteneur lors de sa création à partir de la nouvelle image. | | ||
| + | |||
| + | Créez maintenant l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 rh13409]$ podman build -t python36: | ||
| + | STEP 1/3: FROM registry.access.redhat.com/ | ||
| + | Trying to pull registry.access.redhat.com/ | ||
| + | Getting image source signatures | ||
| + | Checking if image destination supports signatures | ||
| + | Copying blob 148a3ed2f70e done | | ||
| + | Copying config 4f03f39cd4 done | | ||
| + | Writing manifest to image destination | ||
| + | Storing signatures | ||
| + | STEP 2/3: RUN dnf install -y python36 | ||
| + | Updating Subscription Management repositories. | ||
| + | Unable to read consumer identity | ||
| + | subscription-manager is operating in container mode. | ||
| + | |||
| + | This system is not registered with an entitlement server. You can use subscription-manager to register. | ||
| + | |||
| + | Red Hat Enterprise Linux 8 for x86_64 - AppStre | ||
| + | Red Hat Enterprise Linux 8 for x86_64 - BaseOS | ||
| + | Red Hat Universal Base Image 8 (RPMs) - BaseOS | ||
| + | Red Hat Universal Base Image 8 (RPMs) - AppStre | ||
| + | Red Hat Universal Base Image 8 (RPMs) - CodeRea 991 kB/s | 186 kB | ||
| + | Last metadata expiration check: 0:00:01 ago on Wed Oct 30 16:31:36 2024. | ||
| + | Dependencies resolved. | ||
| + | ============================================================================================================== | ||
| + | | ||
| + | ============================================================================================================== | ||
| + | Installing: | ||
| + | | ||
| + | Installing dependencies: | ||
| + | | ||
| + | | ||
| + | | ||
| + | Enabling module streams: | ||
| + | | ||
| + | |||
| + | Transaction Summary | ||
| + | ============================================================================================================== | ||
| + | Install | ||
| + | |||
| + | Total download size: 1.8 M | ||
| + | Installed size: 7.1 M | ||
| + | Downloading Packages: | ||
| + | (1/4): python36-3.6.8-39.module+el8.10.0+20784+ 137 kB/s | 20 kB | ||
| + | (2/4): python3-setuptools-39.2.0-8.el8_10.noarc 2.9 MB/s | 163 kB | ||
| + | (3/4): platform-python-pip-9.0.3-24.el8.noarch. 7.2 MB/s | 1.6 MB | ||
| + | (4/4): python3-pip-9.0.3-24.el8.noarch.rpm | ||
| + | -------------------------------------------------------------------------------- | ||
| + | Total 7.8 MB/s | 1.8 MB | ||
| + | Running transaction check | ||
| + | Transaction check succeeded. | ||
| + | Running transaction test | ||
| + | Transaction test succeeded. | ||
| + | Running transaction | ||
| + | Preparing | ||
| + | Installing | ||
| + | Installing | ||
| + | Installing | ||
| + | Installing | ||
| + | Running scriptlet: python36-3.6.8-39.module+el8.10.0+20784+edafcd43.x86 | ||
| + | Verifying | ||
| + | Verifying | ||
| + | Verifying | ||
| + | Verifying | ||
| + | Installed products updated. | ||
| + | |||
| + | Installed: | ||
| + | platform-python-pip-9.0.3-24.el8.noarch | ||
| + | python3-pip-9.0.3-24.el8.noarch | ||
| + | python3-setuptools-39.2.0-8.el8_10.noarch | ||
| + | python36-3.6.8-39.module+el8.10.0+20784+edafcd43.x86_64 | ||
| + | |||
| + | Complete! | ||
| + | --> ffbfe7e2c52a | ||
| + | STEP 3/3: CMD ["/ | ||
| + | COMMIT python36: | ||
| + | --> aeb6174afefe | ||
| + | Successfully tagged localhost/ | ||
| + | aeb6174afefe34e16037a22efe8d6b9de6f7542dd15e24f33335fd5ba4689dd7 | ||
| + | </ | ||
| < | < | ||
| - | root@debian8:~# nmcli connection mod ip_fixe +ipv4.addresses 192.168.1.2/24 | + | [trainee@redhat9 rh13409]$ podman images |
| + | REPOSITORY | ||
| + | localhost/ | ||
| + | registry.access.redhat.com/ | ||
| + | registry.access.redhat.com/ | ||
| </ | </ | ||
| - | Continuez maintenant | + | En consultant l' |
| < | < | ||
| - | root@debian8:~# systemctl enable nfs-kernel-server | + | [trainee@redhat9 |
| - | Synchronizing state for nfs-kernel-server.service with sysvinit using update-rc.d... | + | ... |
| - | Executing | + | " |
| - | Executing /usr/sbin/update-rc.d nfs-kernel-server enable | + | "/bin/bash", |
| + | "-c", | ||
| + | "sleep infinity" | ||
| + | ], | ||
| + | ... | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | ... | ||
| </ | </ | ||
| - | La mise en place d' | + | =====LAB #3 - Gestion des Conteneurs===== |
| + | |||
| + | Un conteneur peut être dans un de cinq états : | ||
| + | |||
| + | ^ Etat ^ Description ^ | ||
| + | | **Created** | Un conteneur qui est créé mais qui n'est pas démarré. | | ||
| + | | **Running** | Un conteneur qui fonctionne avec ses processus. | | ||
| + | | **Stopped** | Un conteneur dont les processus sont arrêtés. | | ||
| + | | **Paused** | Un conteneur dont les processus sont en pause. Non pris en charge pour les conteneurs Rootless. | | ||
| + | | **Deleted** | Un conteneur dont les processus sont dans un état mort. | | ||
| + | |||
| + | ====3.1 - Création | ||
| + | |||
| + | Créez un conteneur dénommé | ||
| < | < | ||
| - | root@debian8: | + | [trainee@redhat9 |
| - | root@debian8: | + | f42e19a0627eb457570ca3626c8bb1fff77963542b7dc59ae5d07e86bf1a3fca |
| - | root@debian8:~# exportfs | + | |
| - | / | + | |
| </ | </ | ||
| - | Afin de mettre | + | Pour visualiser la liste des conteneurs |
| < | < | ||
| - | root@debian8:~# vi /etc/exports | + | [trainee@redhat9 ~]$ podman ps |
| - | root@debian8:~# cat /etc/exports | + | CONTAINER ID IMAGE |
| - | # /etc/exports: the access control list for filesystems which may be exported | + | </ |
| - | # to NFS clients. | + | |
| - | # | + | Pour consulter la liste de tous les conteneurs, ajoutez l' |
| - | # Example for NFSv2 and NFSv3: | + | |
| - | # /srv/homes | + | < |
| - | # | + | [trainee@redhat9 |
| - | # Example for NFSv4: | + | CONTAINER ID IMAGE |
| - | # /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check) | + | f42e19a0627e |
| - | # /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check) | + | </ |
| - | # | + | |
| - | /home/trainee 192.168.1.1 | + | ====3.2 - Démarrage d'un Conteneur==== |
| - | /tmp *(fsid=0) | + | |
| + | Pour démarrer un conteneur déjà créé, utilisez la commande **podman start** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman start python36 | ||
| + | python36 | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman ps | ||
| + | CONTAINER ID IMAGE | ||
| + | f42e19a0627e | ||
| + | </ | ||
| + | |||
| + | Pour démarrer un conteneur à partir d'une image distante, il convient d' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 | ||
| + | 85e26c02bfad3b47270b785b74ce225799dea5aff16ebf4f002a51688da2b3a7 | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman ps | ||
| + | CONTAINER ID IMAGE | ||
| + | f42e19a0627e | ||
| + | 85e26c02bfad | ||
| + | </ | ||
| + | |||
| + | ====3.3 - Exécution d'une Commande dans un Conteneur==== | ||
| + | |||
| + | Pour exécuter une commande à l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman exec python38 ps -ax | ||
| + | PID TTY STAT TIME COMMAND | ||
| + | 1 ? Ss 0:00 / | ||
| + | 2 ? R 0:00 ps -ax | ||
| + | </ | ||
| + | |||
| + | Il est aussi possible d' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman exec python38 sh -c 'ps -ax > / | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman exec python38 | ||
| + | PID TTY STAT TIME COMMAND | ||
| + | 1 ? Ss | ||
| + | 3 ? S 0:00 sh -c ps -ax > / | ||
| + | 4 ? R 0:00 ps -ax | ||
| + | </ | ||
| + | |||
| + | Créez maintenant le fichier **/ | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ echo "echo 'hello world'" | ||
| + | |||
| + | [trainee@redhat9 ~]$ stat / | ||
| + | File: / | ||
| + | Size: 19 Blocks: 8 IO Block: 4096 | ||
| + | Device: fd00h/ | ||
| + | Access: | ||
| + | Context: unconfined_u: | ||
| + | Access: 2024-10-31 09:49:46.727000000 +0100 | ||
| + | Modify: 2024-10-31 09: | ||
| + | Change: 2024-10-31 09: | ||
| + | Birth: 2024-10-31 09: | ||
| + | |||
| + | Bien évidement ce fichier n' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman exec python38 stat /tmp/hello.sh | ||
| + | stat: cannot statx '/ | ||
| + | </ | ||
| + | |||
| + | Copiez donc le fichier dans le conteneur et regardez ses caractéristiques : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman cp / | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman exec python38 stat / | ||
| + | File: / | ||
| + | Size: 19 Blocks: 8 IO Block: 4096 | ||
| + | Device: 40h/64d Inode: 115769725 | ||
| + | Access: | ||
| + | Access: 2024-10-31 08: | ||
| + | Modify: 2024-10-31 08: | ||
| + | Change: 2024-10-31 08: | ||
| + | | ||
| + | </ | ||
| + | |||
| + | Exécutez le script dans le conteneur avec le shell **bash** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman exec python38 bash / | ||
| + | hello world | ||
| + | </ | ||
| + | |||
| + | ====3.4 - Suppression des Images et des Conteneurs==== | ||
| + | |||
| + | En essayant de supprimer l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman rmi registry.access.redhat.com/ | ||
| + | Error: image used by 85e26c02bfad3b47270b785b74ce225799dea5aff16ebf4f002a51688da2b3a7: | ||
| + | </ | ||
| + | |||
| + | Arrêtez donc le conteneur **python38** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman stop python38 | ||
| + | WARN[0010] StopSignal SIGTERM failed to stop container python38 in 10 seconds, resorting to SIGKILL | ||
| + | python38 | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE | ||
| + | f42e19a0627e | ||
| + | 85e26c02bfad | ||
| + | </ | ||
| + | |||
| + | Supprimez le conteneur **python38** avec la commande **podman rm** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman rm python38 | ||
| + | python38 | ||
| + | </ | ||
| + | |||
| + | Il est maintenant possible de supprimer l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman rmi registry.access.redhat.com/ | ||
| + | Untagged: registry.access.redhat.com/ | ||
| + | Deleted: 142e82b6e600e0a2208e32bcffab89cd6257316f93b22a1f12f172756ed7fe53 | ||
| + | </ | ||
| + | |||
| + | Créez un conteneur **db01** à partir de l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d registry.redhat.io/ | ||
| + | Trying to pull registry.redhat.io/ | ||
| + | Getting image source signatures | ||
| + | Checking if image destination supports signatures | ||
| + | Copying blob 0258a9a5cd06 done | | ||
| + | Copying blob 148a3ed2f70e skipped: already exists | ||
| + | Copying blob 4de1bba6ee61 done | | ||
| + | Copying config b0e9bcdcc3 done | | ||
| + | Writing manifest to image destination | ||
| + | Storing signatures | ||
| + | aea7c40abc0570fb616be14de5642683be5ebbadc95359f4b2d3ec32f1b12ddd | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | f42e19a0627e | ||
| + | aea7c40abc05 | ||
| + | </ | ||
| + | |||
| + | Examinez l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ skopeo inspect docker:// | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | ... | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ... | ||
| + | } | ||
| + | </code> | ||
| + | |||
| + | Vous noterez que pour lancer un conteneur, il faut spécifier les variables d' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d -e MYSQL_USER=user -e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db -p 3306:3306 rhel8/mariadb-105 | ||
| + | afc0cc8427677eed8cf17ef1ee9669b937ca25ccd322c066ee9c46e070baf3d3 | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | f42e19a0627e | ||
| + | aea7c40abc05 | ||
| + | afc0cc842767 | ||
| + | </ | ||
| + | |||
| + | Notez que le conteneur crée avec les variables d' | ||
| + | |||
| + | Supprimez maintenant le conteneur **db01**. Notez que vous que l'on peut référencer le conteneur par une partie de son **CONTAINER ID**, à condition que cette partie soit unique : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman rm aea | ||
| + | aea | ||
| + | </code> | ||
| + | |||
| + | Supprimez le deuxième conteneur en stipulant son nom : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman rm boring_ganguly | ||
| + | Error: cannot remove container afc0cc8427677eed8cf17ef1ee9669b937ca25ccd322c066ee9c46e070baf3d3 as it is running - running or paused containers cannot be removed without force: container state improper | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman rm -f boring_ganguly | ||
| + | boring_ganguly | ||
| + | </code> | ||
| + | |||
| + | Re-créez un conteneur MariaDB ayant le nom **db1** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --name db1 -e MYSQL_USER=user -e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db -p 3306:3306 rhel8/ | ||
| + | 90c582b10512c3049ded2937d72c6c4ccfe98a6e40311f44000a7c0425aa219e | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | f42e19a0627e | ||
| + | 90c582b10512 | ||
| + | </ | ||
| + | |||
| + | =====LAB #4 - Gestion du Stockage et du Réseau===== | ||
| + | |||
| + | ====4.1 - Gestion du Stockage Persistant==== | ||
| + | |||
| + | Consultez les deux fichiers **/proc/ | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman unshare cat / | ||
| + | 0 1000 1 | ||
| + | | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman unshare cat / | ||
| + | | ||
| + | | ||
| </ | </ | ||
| - | <WRAP center round important> | + | <WRAP center round important |
| - | **Important** | + | **Important** |
| </ | </ | ||
| - | Démarrez maintenant | + | Obtenez l'UID et le GID de l' |
| < | < | ||
| - | root@debian8:~# systemctl reload nfs-kernel-server | + | [trainee@redhat9 |
| - | root@debian8:~# systemctl start nfs-kernel-server | + | mysql:x:27:27:MySQL Server:/var/lib/mysql:/sbin/nologin |
| - | root@debian8:~# systemctl status nfs-kernel-server | + | </code> |
| - | ● nfs-kernel-server.service - LSB: Kernel NFS server support | + | |
| - | | + | |
| - | | + | |
| - | Process: 10475 ExecReload=/etc/init.d/nfs-kernel-server reload (code=exited, status=0/ | + | |
| - | Mar 22 10:04:01 debian8 nfs-kernel-server[506]: | + | Il convient maintenant de monter le répertoire **/ |
| - | Mar 22 10:25:59 debian8 nfs-kernel-server[10475]: Re-exporting directories for NFS kernel daemon...exportfs: | + | |
| - | Mar 22 10:25:59 debian8 nfs-kernel-server[10475]: exportfs: | + | Créez donc le répertoire **/ |
| - | Mar 22 10:25:59 debian8 nfs-kernel-server[10475]: | + | |
| - | Mar 22 10:25:59 debian8 nfs-kernel-server[10475]: | + | < |
| - | Mar 22 10:25:59 debian8 nfs-kernel-server[10475]: | + | [trainee@redhat9 ~]$ mkdir /home/trainee/ |
| - | Mar 22 10:25:59 debian8 nfs-kernel-server[10475]: | + | |
| - | Mar 22 10:25:59 debian8 nfs-kernel-server[10475]: NOTE: this default has changed since nfs-utils version 1.0.x | + | [trainee@redhat9 ~]$ podman unshare chown 27:27 /home/trainee/ |
| - | Mar 22 10:25:59 debian8 nfs-kernel-server[10475]: | + | |
| - | Hint: Some lines were ellipsized, use -l to show in full. | + | [trainee@redhat9 ~]$ ls -l / |
| + | total 8 | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 100026 | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| </ | </ | ||
| - | Puisque aucune option ne soit spécifiée pour les montages, ceux-ci ont été exportés avec des option par défaut. En utilisant | + | Vérifiez que l'état de SELinux est **enforcing** dans la machine hôte **redhat9** : |
| < | < | ||
| - | root@debian8:~# exportfs -v | + | [trainee@redhat9 ~]$ su - |
| - | / | + | Password: fenestros |
| - | /tmp < | + | |
| + | [root@redhat9 | ||
| + | Permissive | ||
| + | |||
| + | [root@redhat9 ~]# setenforce enforcing | ||
| + | |||
| + | [root@redhat9 ~]# exit | ||
| + | logout | ||
| </ | </ | ||
| - | ====Configuration | + | Arrêtez le conteneur **bd1** : |
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman stop db1 | ||
| + | db1 | ||
| + | </ | ||
| + | |||
| + | Créez un conteneur dénommé **bd01** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --name db01 -e MYSQL_USER=user -e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db -p 3306:3306 -v / | ||
| + | 959e8039ba2bc11a30bbe0ffb9185c4779aa6c8865a9288767675c5163e119bd | ||
| + | </ | ||
| + | |||
| + | Consultez l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | f42e19a0627e | ||
| + | 90c582b10512 | ||
| + | 959e8039ba2b | ||
| + | </ | ||
| + | |||
| + | Afin de comprendre la nature du problème, consultez les journaux du conteneur avec la commande **podman container logs** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman container logs db01 | ||
| + | ... | ||
| + | 2024-10-31 | ||
| + | 2024-10-31 | ||
| + | 2024-10-31 | ||
| + | 2024-10-31 | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | En notant l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ su - | ||
| + | Password: fenestros | ||
| + | </ | ||
| + | |||
| + | Générez un fichier d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# sealert -a / | ||
| + | |||
| + | [root@redhat9 ~]# cat / | ||
| + | ... | ||
| + | -------------------------------------------------------------------------------- | ||
| + | |||
| + | SELinux is preventing / | ||
| + | |||
| + | ***** Plugin catchall (100. confidence) suggests | ||
| + | |||
| + | If you believe that mariadbd should be allowed read write access on the aria_log_control file by default. | ||
| + | Then you should report this as a bug. | ||
| + | You can generate a local policy module to allow this access. | ||
| + | Do | ||
| + | allow this access for now by executing: | ||
| + | # ausearch -c ' | ||
| + | # semodule -X 300 -i my-mysqld.pp | ||
| + | |||
| + | |||
| + | Additional Information: | ||
| + | Source Context | ||
| + | Target Context | ||
| + | Target Objects | ||
| + | Source | ||
| + | Source Path / | ||
| + | Port < | ||
| + | Host < | ||
| + | Source RPM Packages | ||
| + | Target RPM Packages | ||
| + | SELinux Policy RPM selinux-policy-targeted-38.1.35-2.el9_4.2.noarch | ||
| + | Local Policy RPM selinux-policy-targeted-38.1.35-2.el9_4.2.noarch | ||
| + | Selinux Enabled | ||
| + | Policy Type | ||
| + | Enforcing Mode Enforcing | ||
| + | Host Name | ||
| + | Platform | ||
| + | 5.14.0-427.37.1.el9_4.x86_64 #1 SMP | ||
| + | PREEMPT_DYNAMIC Fri Sep 13 12:41:50 EDT 2024 | ||
| + | x86_64 x86_64 | ||
| + | Alert Count 1 | ||
| + | First Seen 2024-10-31 10:53:10 CET | ||
| + | Last Seen | ||
| + | Local ID c9066e3a-05ae-464e-bbd4-fd94585c6b64 | ||
| + | |||
| + | Raw Audit Messages | ||
| + | type=AVC msg=audit(1730368390.63: | ||
| + | tem_u: | ||
| + | |||
| + | |||
| + | type=SYSCALL msg=audit(1730368390.63: | ||
| + | 6 suid=100026 fsuid=100026 egid=100026 sgid=100026 fsgid=100026 tty=(none) ses=6974 comm=mysqld exe=/ | ||
| + | D=trainee UID=unknown(100026) GID=unknown(100026) EUID=unknown(100026) SUID=unknown(100026) FSUID=unknown(100026) EGID=unknown(100026) SGID=unknown(100026) FSGID=unknown(100026) | ||
| + | |||
| + | Hash: mysqld, | ||
| + | |||
| + | [root@redhat9 ~]# exit | ||
| + | logout | ||
| + | </ | ||
| + | |||
| + | En consultant l' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# ls -lZ / | ||
| + | drwxr-xr-x. 3 100026 | ||
| + | </ | ||
| + | |||
| + | Pour forcer l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --replace --name db01 -e MYSQL_USER=user -e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db -p 3306:3306 -v / | ||
| + | 47a5626d51dd02a8a7c769bfd37c4ba763320f731a2ccc71797567817205a20b | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | f42e19a0627e | ||
| + | 90c582b10512 | ||
| + | 47a5626d51dd | ||
| + | </ | ||
| + | |||
| + | Finalement vérifiez le SC du répertoire **/ | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ ls -lZ / | ||
| + | drwxr-xr-x. 3 100026 | ||
| + | </ | ||
| + | |||
| + | ====4.2 - Gestion du Réseau==== | ||
| + | |||
| + | Pour fournir un accès réseau aux conteneurs, les clients doivent se connecter aux ports de l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --replace --name db01 -e MYSQL_USER=user -e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db -p 3306:3306 -v / | ||
| + | 97f190a660ceba8f62b688781a5df1daef06e3ded241d799b15a8df744049116 | ||
| + | </ | ||
| + | |||
| + | Notez ensuite la prise en charge de cette commande : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman ps -a | grep db01 | ||
| + | 97f190a660ce | ||
| + | </ | ||
| + | |||
| + | Pour voir le mappage des ports, utilisez la commande **podman port -a** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman port -a | ||
| + | 97f190a660ce | ||
| + | 97f190a660ce | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman port db01 | ||
| + | 3306/tcp -> 0.0.0.0: | ||
| + | 3306/tcp -> 0.0.0.0: | ||
| + | </ | ||
| + | |||
| + | Depuis la version 4.0, Podman supporte deux réseaux pour les conteneurs, **Netavark** et **CNI**. À partir de RHEL 9, les systèmes utilisent **Netavark** par défaut. Pour vérifier quel backend réseau est utilisé, exécutez la commande podman info suivante : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman --version | ||
| + | podman version 4.9.4-rhel | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman info --format {{.Host.NetworkBackend}} | ||
| + | netavark | ||
| + | </ | ||
| + | |||
| + | Pour modifier le backend utilisé, il convient de modifier la directive **network_backend** dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ cat / | ||
| + | # | ||
| + | </ | ||
| + | |||
| + | Lors de l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman network ls | ||
| + | NETWORK ID NAME DRIVER | ||
| + | 2f259bab93aa | ||
| + | </ | ||
| - | <WRAP center round important> | + | <WRAP center round important |
| - | **Important** | + | **Important** |
| </ | </ | ||
| - | Re-configurez ensuite l' | + | Regardez les caractéristiques |
| < | < | ||
| - | root@debian8:~# nmcli connection del ip_fixe | + | [trainee@redhat9 |
| - | root@debian8:~# nmcli connection show ip_fixe | + | [ |
| - | Error: ip_fixe | + | { |
| - | root@debian8:~# nmcli connection add con-name ip_fixe ifname eth1 type ethernet ip4 10.0.2.17/24 gw4 10.0.2.2 | + | " |
| - | Connection ' | + | " |
| - | root@debian8:~# nmcli connection mod ip_fixe ipv4.dns 8.8.8.8 | + | " |
| - | root@debian8:~# nmcli connection mod ip_fixe +ipv4.addresses 192.168.1.1/ | + | " |
| - | root@debian8:~# nmcli connection up ip_fixe | + | " |
| - | Connection successfully activated (D-Bus active path: / | + | " |
| - | root@debian8:~# systemctl restart NetworkManager.service | + | { |
| + | " | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| </ | </ | ||
| - | <WRAP center round important > | + | Créez maintenant un deuxième réseau appelé **db_net** : |
| - | **Important** | + | |
| + | < | ||
| + | [trainee@redhat9 ~]$ podman network create --gateway 10.87.0.1 --subnet 10.87.0.0/ | ||
| + | db_net | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman network ls | ||
| + | NETWORK ID NAME DRIVER | ||
| + | 556c9797ea6d | ||
| + | 2f259bab93aa | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman network inspect db_net | ||
| + | [ | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | Placez le conteneur **db01** dans le réseau **db_net** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --replace --name db01 -e MYSQL_USER=user -e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db -p 3306:3306 -v / | ||
| + | 36c9f95ae52f76f96c45bb7fd6600cb014adc751059a531bb7bf38f927a11541 | ||
| + | </ | ||
| + | |||
| + | Créez maintenant le conteneur **client** en le plaçant dans le réseau **db_net** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --name client --network db_net registry.access.redhat.com/ | ||
| + | 00b2b82c2adf022badf91f88a9a7f59e71cac705bf4885fa08553681ad1f594c | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | f42e19a0627e | ||
| + | 90c582b10512 | ||
| + | 36c9f95ae52f | ||
| + | 00b2b82c2adf | ||
| + | </ | ||
| + | |||
| + | Installez dans le conteneur **client**, les paquets **iputils** et **iproute** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman exec -it client dnf install -y iputils iproute | ||
| + | </ | ||
| + | |||
| + | Testez la connectivité du réseau **db_net** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman exec -it client ip a | grep 10.8 | ||
| + | inet 10.87.0.3/ | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman exec -it client ping -c3 db01 | ||
| + | PING db01.dns.podman (10.87.0.2) 56(84) bytes of data. | ||
| + | 64 bytes from 10.87.0.2 (10.87.0.2): | ||
| + | 64 bytes from 10.87.0.2 (10.87.0.2): | ||
| + | 64 bytes from 10.87.0.2 (10.87.0.2): | ||
| + | |||
| + | --- db01.dns.podman ping statistics --- | ||
| + | 3 packets transmitted, | ||
| + | rtt min/ | ||
| + | </ | ||
| + | |||
| + | Testez la résolution des noms **db_net** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman exec -it client ping -c3 www.free.fr | ||
| + | PING www.free.fr (212.27.48.10) 56(84) bytes of data. | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | |||
| + | --- www.free.fr ping statistics --- | ||
| + | 3 packets transmitted, | ||
| + | rtt min/ | ||
| + | </ | ||
| + | |||
| + | Créez le troisième réseau **backend** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman network create backend | ||
| + | backend | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman network ls | ||
| + | NETWORK ID NAME DRIVER | ||
| + | 9c7fcc7b2b5d | ||
| + | 556c9797ea6d | ||
| + | 2f259bab93aa | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman network inspect backend | ||
| + | [ | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | Placez les deux conteneurs existants dans ce nouveau réseau : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman network connect backend db01 | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman network connect backend client | ||
| + | </ | ||
| + | |||
| + | Constatez que les deux conteneurs se trouvent dans les deux réseaux, **backend** et **db_net** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman inspect db01 | ||
| + | [ | ||
| + | ... | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | } | ||
| + | } | ||
| + | }, | ||
| + | ... | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman inspect client | ||
| + | [ | ||
| + | ... | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | } | ||
| + | } | ||
| + | }, | ||
| + | ... | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | =====LAB #5 - Gestion des Conteneurs en tant que Services Système===== | ||
| + | |||
| + | Sans faire appel à un Orchestrateur de Conteneurs tel Kubernetes, il est possible de gérer des petites infrastructures en utilisant simplement **-systemd**. | ||
| + | |||
| + | ====5.1 - Création du Gestionnaire de Conteneurs==== | ||
| + | |||
| + | Commencez par créer un compte qui sera utilisé pour gérer les conteneurs : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ su - | ||
| + | Password: fenestros | ||
| + | |||
| + | [root@redhat9 ~]# groupadd fenestros && useradd fenestros -c FenestrOs -d / | ||
| + | |||
| + | [root@redhat9 ~]# passwd fenestros | ||
| + | Changing password for user fenestros. | ||
| + | New password: fenestros | ||
| + | BAD PASSWORD: The password contains the user name in some form | ||
| + | Retype new password: fenestros | ||
| + | passwd: all authentication tokens updated successfully. | ||
| + | </ | ||
| + | |||
| + | Devenez l' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# su - fenestros | ||
| + | |||
| + | [fenestros@redhat9 ~]$ podman info | ||
| + | WARN[0000] The cgroupv2 manager is set to systemd but there is no systemd user session available | ||
| + | WARN[0000] For using systemd, you may need to log in using a user session | ||
| + | WARN[0000] Alternatively, | ||
| + | WARN[0000] Falling back to --cgroup-manager=cgroupfs | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Podman est un utilitaire sans état et nécessite une session de connexion complète. Podman doit être utilisé dans une session SSH et ne peut pas être utilisé dans un shell sudo ou su : | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ exit | ||
| + | logout | ||
| + | |||
| + | [root@redhat9 ~]# ssh fenestros@localhost | ||
| + | The authenticity of host ' | ||
| + | ED25519 key fingerprint is SHA256: | ||
| + | This key is not known by any other names | ||
| + | Are you sure you want to continue connecting (yes/ | ||
| + | Warning: Permanently added ' | ||
| + | fenestros@localhost' | ||
| + | Register this system with Red Hat Insights: insights-client --register | ||
| + | Create an account or view all your systems at https:// | ||
| + | Last login: Thu Oct 31 13:04:30 2024 | ||
| + | |||
| + | [fenestros@redhat9 ~]$ podman info | ||
| + | host: | ||
| + | arch: amd64 | ||
| + | buildahVersion: | ||
| + | cgroupControllers: | ||
| + | - memory | ||
| + | - pids | ||
| + | cgroupManager: | ||
| + | cgroupVersion: | ||
| + | conmon: | ||
| + | package: conmon-2.1.10-1.el9.x86_64 | ||
| + | path: / | ||
| + | version: ' | ||
| + | cpuUtilization: | ||
| + | idlePercent: | ||
| + | systemPercent: | ||
| + | userPercent: | ||
| + | cpus: 4 | ||
| + | databaseBackend: | ||
| + | distribution: | ||
| + | distribution: | ||
| + | version: " | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | ====5.2 - Création d'un Conteneur de Serveur Web==== | ||
| + | |||
| + | Commencez par créer un répertoire dans l' | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ mkdir www | ||
| + | </ | ||
| + | |||
| + | Créez ensuite un conteneur, appelé **webserver** avec un mappage de ports, à partir de l' | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ podman run -d --name webserver -p 8080:8080 -v ~/ | ||
| + | Trying to pull registry.access.redhat.com/ | ||
| + | Getting image source signatures | ||
| + | Checking if image destination supports signatures | ||
| + | Copying blob c302a7fbb8d5 done | | ||
| + | Copying blob 148a3ed2f70e done | | ||
| + | Copying blob 4de1bba6ee61 done | | ||
| + | Copying config e11bc11181 done | | ||
| + | Writing manifest to image destination | ||
| + | Storing signatures | ||
| + | e8afda5806a98f378865230e6d5c900c85afc0ea152609602a65d05c60cd68dc | ||
| + | </ | ||
| + | |||
| + | Utilisez la commande **podman generate systemd** pour créer un fichier d' | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ podman generate systemd --name webserver --new --files | ||
| + | |||
| + | DEPRECATED command: | ||
| + | It is recommended to use Quadlets for running containers and pods under systemd. | ||
| + | |||
| + | Please refer to podman-systemd.unit(5) for details. | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important | ||
| + | **Important** | ||
| </ | </ | ||
| - | A partir de votre client, consultez les répertoire | + | |
| + | Le fichier est créé dans le répertoire | ||
| < | < | ||
| - | root@debian8:~# showmount | + | [fenestros@redhat9 |
| - | Export list for 192.168.1.2: | + | # container-webserver.service |
| - | /tmp * | + | # autogenerated by Podman 4.9.4-rhel |
| - | /home/trainee 192.168.1.1 | + | # Thu Oct 31 13:42:12 CET 2024 |
| + | |||
| + | [Unit] | ||
| + | Description=Podman container-webserver.service | ||
| + | Documentation=man: | ||
| + | Wants=network-online.target | ||
| + | After=network-online.target | ||
| + | RequiresMountsFor=%t/containers | ||
| + | |||
| + | [Service] | ||
| + | Environment=PODMAN_SYSTEMD_UNIT=%n | ||
| + | Restart=on-failure | ||
| + | TimeoutStopSec=70 | ||
| + | ExecStart=/ | ||
| + | --cidfile=%t/ | ||
| + | --cgroups=no-conmon \ | ||
| + | --rm \ | ||
| + | --sdnotify=conmon \ | ||
| + | --replace \ | ||
| + | -d \ | ||
| + | --name webserver \ | ||
| + | -p 8080:8080 \ | ||
| + | -v /home/fenestros/ | ||
| + | ExecStop=/ | ||
| + | --ignore -t 10 \ | ||
| + | --cidfile=%t/ | ||
| + | ExecStopPost=/ | ||
| + | -f \ | ||
| + | --ignore -t 10 \ | ||
| + | --cidfile=%t/ | ||
| + | Type=notify | ||
| + | NotifyAccess=all | ||
| + | |||
| + | [Install] | ||
| + | WantedBy=default.target | ||
| </ | </ | ||
| - | Créez maintenant | + | Pour que systemd puisse prendre en charge le service, le fichier d' |
| < | < | ||
| - | root@debian8:~# mkdir /nfs | + | [fenestros@redhat9 |
| - | root@debian8:~# mount -t nfs 192.168.1.2:/home/trainee | + | |
| + | [fenestros@redhat9 | ||
| </ | </ | ||
| - | =====Surveillance du Serveur===== | + | Pour créer le service, utilisez la commande **systemctl --user daemon-reload**. Notez que l' |
| - | ====La Commande rpcinfo==== | + | < |
| + | [fenestros@redhat9 ~]$ systemctl --user daemon-reload | ||
| + | </ | ||
| - | La commande **rpcinfo** permet de faire une requête RPC sur le serveur et de voir les démons gérés | + | Vérifiez |
| < | < | ||
| - | root@debian8:/# rpcinfo | + | [fenestros@redhat9 ~]$ systemctl |
| - | | + | ○ container-webserver.service |
| - | 100000 | + | Loaded: loaded (/ |
| - | 100000 | + | Active: inactive (dead) |
| - | 100000 | + | Docs: man:podman-generate-systemd(1) |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100024 | + | |
| - | 100024 | + | |
| - | 100024 | + | |
| - | 100024 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100227 | + | |
| - | 100227 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100227 | + | |
| - | 100227 | + | |
| - | | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100227 | + | |
| - | 100227 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100227 | + | |
| - | 100227 | + | |
| - | | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| </ | </ | ||
| - | ====La Commande nfsstat==== | + | Dans l' |
| - | La Commande | + | < |
| + | [fenestros@redhat9 ~]$ loginctl show-user fenestros | ||
| + | UID=1001 | ||
| + | GID=1001 | ||
| + | Name=fenestros | ||
| + | Timestamp=Thu 2024-10-31 13:09:25 CET | ||
| + | TimestampMonotonic=240322297212 | ||
| + | RuntimePath=/ | ||
| + | Service=user@1001.service | ||
| + | Slice=user-1001.slice | ||
| + | Display=7200 | ||
| + | State=active | ||
| + | Sessions=7200 | ||
| + | IdleHint=no | ||
| + | IdleSinceHint=1730379006672000 | ||
| + | IdleSinceHintMonotonic=242763627399 | ||
| + | Linger=no | ||
| + | </ | ||
| + | |||
| + | Afin que le service reste démarré après la fermeture de la session et qu'il réagisse comme un service de système, il faut modifier la valeur de Linger à **yes** : | ||
| < | < | ||
| - | root@debian8:/# nfsstat | + | [fenestros@redhat9 ~]$ loginctl enable-linger |
| - | Server rpc stats: | + | |
| - | calls badcalls | + | |
| - | 0 0 0 0 0 | + | |
| - | Client rpc stats: | + | [fenestros@redhat9 ~]$ loginctl show-user fenestros |
| - | calls retrans | + | UID=1001 |
| - | 77 | + | GID=1001 |
| + | Name=fenestros | ||
| + | Timestamp=Thu 2024-10-31 13:09:25 CET | ||
| + | TimestampMonotonic=240322297212 | ||
| + | RuntimePath=/ | ||
| + | Service=user@1001.service | ||
| + | Slice=user-1001.slice | ||
| + | Display=7200 | ||
| + | State=active | ||
| + | Sessions=7200 | ||
| + | IdleHint=no | ||
| + | IdleSinceHint=1730379080672000 | ||
| + | IdleSinceHintMonotonic=242837627399 | ||
| + | Linger=yes | ||
| + | </ | ||
| - | Client nfs v3: | + | Créez un fichier **index.html** dans le répertoire **$HOME/ |
| - | null | + | |
| - | 0 | + | < |
| - | read | + | [fenestros@redhat9 ~]$ echo "Hello World" > ~/ |
| - | 0 0% 0 | + | </ |
| - | remove | + | |
| - | 0 | + | Supprimez le conteneur actuel **webserver** en utilisant l' |
| - | fsstat | + | |
| - | 0 0% 6 16% 3 8% 0 | + | < |
| + | [fenestros@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | e8afda5806a9 | ||
| + | |||
| + | [fenestros@redhat9 ~]$ podman rm -f webserver | ||
| + | webserver | ||
| + | </ | ||
| + | |||
| + | Activez et démarrez le service utilisateur **container-webserver** : | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ systemctl --user enable --now container-webserver | ||
| + | Created | ||
| + | |||
| + | [fenestros@redhat9 ~]$ systemctl --user status | ||
| + | ● container-webserver.service - Podman container-webserver.service | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Main PID: 235072 (conmon) | ||
| + | Tasks: 16 (limit: 48799) | ||
| + | | ||
| + | CPU: 132ms | ||
| + | CGroup: / | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | [fenestros@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | ed306cecef9e | ||
| + | </ | ||
| + | |||
| + | Déconnectez-vous du compte fenestros et vérifiez que le serveur Web fonctionne : | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ exit | ||
| + | logout | ||
| + | Connection to localhost closed. | ||
| - | Client nfs v4: | + | [root@redhat9 ~]# curl http:// |
| - | null | + | Hello World |
| - | 0 0% 0 0% 0 0% 0 0% 0 0% 0 0% | + | |
| - | open_noat | + | |
| - | 0 0% 0 0% 0 0% 0 0% 6 16% 0 0% | + | |
| - | setclntid | + | |
| - | 3 8% 3 8% 0 0% 0 0% 0 0% 3 8% | + | |
| - | getattr | + | |
| - | 3 8% 3 8% 3 8% 0 0% 0 0% 0 0% | + | |
| - | symlink | + | |
| - | 0 0% 0 0% 3 8% 0 0% 0 0% 0 0% | + | |
| - | server_caps | + | |
| - | 9 25% 0 0% 0 0% 0 0% 0 0% 0 0% | + | |
| - | secinfo | + | |
| - | 0 0% 0 0% 0 0% 0 0% 0 0% 0 0% | + | |
| - | reclaim_comp layoutget | + | |
| - | 0 0% 0 0% 0 0% 0 0% 0 0% 0 0% | + | |
| - | (null) | + | |
| - | 0 | + | |
| </ | </ | ||
| ----- | ----- | ||
| - | Copyright © 2020 Hugh Norris | + | Copyright © 2024 Hugh Norris |
