Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:redhat:rh134:l108 [2024/10/30 16:55] – admin | elearning:workbooks:redhat:rh134:l108 [2024/11/22 08:50] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 14: | Ligne 14: | ||
| * Historique | * Historique | ||
| * Conteneurs vs Machines Virtuelles | * Conteneurs vs Machines Virtuelles | ||
| + | * Machines Virtuelles | ||
| + | * Conteneurs | ||
| * Conteneurs Rootless et Rootful | * Conteneurs Rootless et Rootful | ||
| * Architecture à base de Conteneurs | * Architecture à base de Conteneurs | ||
| Ligne 19: | Ligne 21: | ||
| * Images et Registres des Conteneurs | * Images et Registres des Conteneurs | ||
| * Podman | * Podman | ||
| + | * Présentation | ||
| * La Commande Podman | * La Commande Podman | ||
| * LAB #1 - Configuration des Registres | * LAB #1 - Configuration des Registres | ||
| + | * LAB #2 - Gestion des Images | ||
| + | * 2.1 - Télécharger une Image | ||
| + | * 2.2 - Créer une Image à l'aide d'un Fichier Containerfile | ||
| + | * LAB #3 - Gestion des Conteneurs | ||
| + | * 3.1 - Création d'un Conteneur | ||
| + | * 3.2 - Démarrage d'un Conteneur | ||
| + | * 3.3 - Exécution d'une Commande dans un Conteneur | ||
| + | * 3.4 - Suppression des Images et des Conteneurs | ||
| + | * LAB #4 - Gestion du Stockage et du Réseau | ||
| + | * 4.1 - Gestion du Stockage Persistant | ||
| + | * 4.2 - Gestion du Réseau | ||
| + | * LAB #5 - Gestion des Conteneurs en tant que Services Système | ||
| + | * 5.1 - Création du Gestionnaire de Conteneurs | ||
| + | * 5.2 - Création d'un Conteneur de Serveur Web | ||
| Ligne 58: | Ligne 75: | ||
| Graphiquement, | Graphiquement, | ||
| - | |||
| - | ===Machines Virtuelles=== | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ===Conteneurs=== | ||
| - | |||
| - | {{ : | ||
| ====Conteneurs Rootless et Rootful==== | ====Conteneurs Rootless et Rootful==== | ||
| Ligne 92: | Ligne 101: | ||
| <WRAP center round important 60%> | <WRAP center round important 60%> | ||
| - | **Important** : L' | + | **Important** : L' |
| </ | </ | ||
| Ligne 101: | Ligne 110: | ||
| Les images des conteneurs sont construites conformément à des spécifications, | Les images des conteneurs sont construites conformément à des spécifications, | ||
| - | Un registre de conteneurs est un référentiel permettant de stocker et de récupérer des images de conteneurs. Un développeur pousse ou télécharge des images de conteneurs dans un registre de conteneurs. Ensuite le dévellopeur | + | Un registre de conteneurs est un référentiel permettant de stocker et de récupérer des images de conteneurs. Un développeur pousse ou télécharge des images de conteneurs dans un registre de conteneurs. Ensuite le développeur |
| Il est possible d' | Il est possible d' | ||
| Ligne 110: | Ligne 119: | ||
| * **registry.connect.redhat.com** pour les conteneurs basés sur des produits tiers. | * **registry.connect.redhat.com** pour les conteneurs basés sur des produits tiers. | ||
| - | Le **[[https:// | + | Le **[[https:// |
| ====Podman==== | ====Podman==== | ||
| Ligne 230: | Ligne 239: | ||
| short-name-mode = " | short-name-mode = " | ||
| </ | </ | ||
| + | |||
| + | Commencez par vous connecter au registre **registry.access.redhat.com** : | ||
| < | < | ||
| [trainee@redhat9 ~]$ podman login registry.access.redhat.com | [trainee@redhat9 ~]$ podman login registry.access.redhat.com | ||
| - | Username: | + | Username: |
| - | Password: | + | Password: |
| Login Succeeded! | Login Succeeded! | ||
| </ | </ | ||
| + | |||
| + | Pour vérifier si vous êtes connecté au registre **registry.access.redhat.com**, | ||
| < | < | ||
| [trainee@redhat9 ~]$ podman login registry.access.redhat.com --get-login | [trainee@redhat9 ~]$ podman login registry.access.redhat.com --get-login | ||
| - | hvn@ittraining.team | + | < |
| </ | </ | ||
| + | |||
| + | Notez que vous devez vous connecter à chaque registre séparément : | ||
| < | < | ||
| [trainee@redhat9 ~]$ podman login registry.redhat.io --get-login | [trainee@redhat9 ~]$ podman login registry.redhat.io --get-login | ||
| Error: not logged into registry.redhat.io | Error: not logged into registry.redhat.io | ||
| - | </ | ||
| - | < | ||
| [trainee@redhat9 ~]$ podman login registry.redhat.io | [trainee@redhat9 ~]$ podman login registry.redhat.io | ||
| - | Username: | + | Username: |
| - | Password: | + | Password: |
| Login Succeeded! | Login Succeeded! | ||
| [trainee@redhat9 ~]$ podman login registry.redhat.io --get-login | [trainee@redhat9 ~]$ podman login registry.redhat.io --get-login | ||
| - | hvn@ittraining.team | + | < |
| </ | </ | ||
| + | |||
| + | Les directives dans le fichier **/ | ||
| < | < | ||
| Ligne 271: | Ligne 286: | ||
| blocked = false | blocked = false | ||
| </ | </ | ||
| + | |||
| + | Pour vérifier si ce fichier est pris en compte, consultez la sortie de la commande **podman info** : | ||
| < | < | ||
| Ligne 290: | Ligne 307: | ||
| </ | </ | ||
| - | =====LAB #2 - Travailler avec des Images===== | + | =====LAB #2 - Gestion |
| + | |||
| + | ====2.1 - Télécharger une Image==== | ||
| + | |||
| + | Pour obtenir une image et la stocker localement, sans créer de conteneur, utilisez la commande **podman pull** : | ||
| < | < | ||
| Ligne 304: | Ligne 325: | ||
| 142e82b6e600e0a2208e32bcffab89cd6257316f93b22a1f12f172756ed7fe53 | 142e82b6e600e0a2208e32bcffab89cd6257316f93b22a1f12f172756ed7fe53 | ||
| </ | </ | ||
| + | |||
| + | Pour examiner l' | ||
| < | < | ||
| Ligne 314: | Ligne 337: | ||
| [trainee@redhat9 ~]$ | [trainee@redhat9 ~]$ | ||
| </ | </ | ||
| + | |||
| + | Utilisez maintenant la commande **skopeo inspect** pour examiner l' | ||
| < | < | ||
| - | [trainee@redhat9 ~]$ skopeo inspect docker:// | + | [trainee@redhat9 ~]$ skopeo inspect docker:// |
| + | { | ||
| " | " | ||
| " | " | ||
| Ligne 417: | Ligne 443: | ||
| } | } | ||
| </ | </ | ||
| + | |||
| + | Pour lister les images disponibles localement, utilisez la commande **podman images** : | ||
| < | < | ||
| Ligne 427: | Ligne 455: | ||
| **Important** - Notez que l' | **Important** - Notez que l' | ||
| </ | </ | ||
| + | |||
| + | ====2.2 - Créer une Image à l'aide d'un Fichier Containerfile==== | ||
| + | |||
| + | Créez un contexte sous la forme d'un répertoire, | ||
| < | < | ||
| Ligne 440: | Ligne 472: | ||
| CMD ["/ | CMD ["/ | ||
| </ | </ | ||
| + | |||
| + | Dans le fichier **Containerfile**, | ||
| + | |||
| + | ^ Commande ^ Description ^ | ||
| + | | **FROM** | Définit l' | ||
| + | | **RUN** | Lance un processus dans la construction de la nouvelle image. | | ||
| + | | **CMD** | Définit la commande qui sera exécutée dans le conteneur lors de sa création à partir de la nouvelle image. | | ||
| + | |||
| + | Créez maintenant l' | ||
| < | < | ||
| Ligne 529: | Ligne 570: | ||
| registry.access.redhat.com/ | registry.access.redhat.com/ | ||
| </ | </ | ||
| + | |||
| + | En consultant l' | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman inspect localhost/ | ||
| + | ... | ||
| + | " | ||
| + | "/ | ||
| + | " | ||
| + | "sleep infinity" | ||
| + | ], | ||
| + | ... | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | ... | ||
| + | </ | ||
| + | =====LAB #3 - Gestion des Conteneurs===== | ||
| + | |||
| + | Un conteneur peut être dans un de cinq états : | ||
| + | |||
| + | ^ Etat ^ Description ^ | ||
| + | | **Created** | Un conteneur qui est créé mais qui n'est pas démarré. | | ||
| + | | **Running** | Un conteneur qui fonctionne avec ses processus. | | ||
| + | | **Stopped** | Un conteneur dont les processus sont arrêtés. | | ||
| + | | **Paused** | Un conteneur dont les processus sont en pause. Non pris en charge pour les conteneurs Rootless. | | ||
| + | | **Deleted** | Un conteneur dont les processus sont dans un état mort. | | ||
| + | |||
| + | ====3.1 - Création d'un Conteneur==== | ||
| + | |||
| + | Créez un conteneur dénommé **python36** à partir de la nouvelle image. Notez que l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman create --name python36 aeb6174afefe | ||
| + | f42e19a0627eb457570ca3626c8bb1fff77963542b7dc59ae5d07e86bf1a3fca | ||
| </ | </ | ||
| + | |||
| + | Pour visualiser la liste des conteneurs en cours d' | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman ps | ||
| + | CONTAINER ID IMAGE | ||
| + | </ | ||
| + | Pour consulter la liste de tous les conteneurs, ajoutez l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE | ||
| + | f42e19a0627e | ||
| </ | </ | ||
| + | |||
| + | ====3.2 - Démarrage d'un Conteneur==== | ||
| + | |||
| + | Pour démarrer un conteneur déjà créé, utilisez la commande **podman start** : | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman start python36 | ||
| + | python36 | ||
| + | [trainee@redhat9 ~]$ podman ps | ||
| + | CONTAINER ID IMAGE | ||
| + | f42e19a0627e | ||
| </ | </ | ||
| + | |||
| + | Pour démarrer un conteneur à partir d'une image distante, il convient d' | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --name python38 registry.access.redhat.com/ | ||
| + | 85e26c02bfad3b47270b785b74ce225799dea5aff16ebf4f002a51688da2b3a7 | ||
| + | [trainee@redhat9 ~]$ podman ps | ||
| + | CONTAINER ID IMAGE | ||
| + | f42e19a0627e | ||
| + | 85e26c02bfad | ||
| </ | </ | ||
| + | |||
| + | ====3.3 - Exécution d'une Commande dans un Conteneur==== | ||
| + | |||
| + | Pour exécuter une commande à l' | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman exec python38 ps -ax | ||
| + | PID TTY STAT TIME COMMAND | ||
| + | 1 ? Ss 0:00 / | ||
| + | 2 ? R 0:00 ps -ax | ||
| + | </ | ||
| + | Il est aussi possible d' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman exec python38 sh -c 'ps -ax > / | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman exec python38 cat / | ||
| + | PID TTY STAT TIME COMMAND | ||
| + | 1 ? Ss 0:00 / | ||
| + | 3 ? S 0:00 sh -c ps -ax > / | ||
| + | 4 ? R 0:00 ps -ax | ||
| </ | </ | ||
| + | |||
| + | Créez maintenant le fichier **/ | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ echo "echo 'hello world'" | ||
| + | [trainee@redhat9 ~]$ stat / | ||
| + | File: / | ||
| + | Size: 19 Blocks: 8 IO Block: 4096 | ||
| + | Device: fd00h/ | ||
| + | Access: (0644/ | ||
| + | Context: unconfined_u: | ||
| + | Access: 2024-10-31 09: | ||
| + | Modify: 2024-10-31 09: | ||
| + | Change: 2024-10-31 09: | ||
| + | | ||
| + | |||
| + | Bien évidement ce fichier n' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman exec python38 stat / | ||
| + | stat: cannot statx '/ | ||
| </ | </ | ||
| + | |||
| + | Copiez donc le fichier dans le conteneur et regardez ses caractéristiques : | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman cp / | ||
| + | [trainee@redhat9 ~]$ podman exec python38 stat / | ||
| + | File: / | ||
| + | Size: 19 Blocks: 8 IO Block: 4096 | ||
| + | Device: 40h/64d Inode: 115769725 | ||
| + | Access: (0644/ | ||
| + | Access: 2024-10-31 08: | ||
| + | Modify: 2024-10-31 08: | ||
| + | Change: 2024-10-31 08: | ||
| + | | ||
| </ | </ | ||
| + | |||
| + | Exécutez le script dans le conteneur avec le shell **bash** : | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman exec python38 bash / | ||
| + | hello world | ||
| + | </ | ||
| + | ====3.4 - Suppression des Images et des Conteneurs==== | ||
| + | |||
| + | En essayant de supprimer l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman rmi registry.access.redhat.com/ | ||
| + | Error: image used by 85e26c02bfad3b47270b785b74ce225799dea5aff16ebf4f002a51688da2b3a7: | ||
| </ | </ | ||
| + | |||
| + | Arrêtez donc le conteneur **python38** : | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman stop python38 | ||
| + | WARN[0010] StopSignal SIGTERM failed to stop container python38 in 10 seconds, resorting to SIGKILL | ||
| + | python38 | ||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE | ||
| + | f42e19a0627e | ||
| + | 85e26c02bfad | ||
| </ | </ | ||
| + | |||
| + | Supprimez le conteneur **python38** avec la commande **podman rm** : | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman rm python38 | ||
| + | python38 | ||
| + | </ | ||
| + | Il est maintenant possible de supprimer l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman rmi registry.access.redhat.com/ | ||
| + | Untagged: registry.access.redhat.com/ | ||
| + | Deleted: 142e82b6e600e0a2208e32bcffab89cd6257316f93b22a1f12f172756ed7fe53 | ||
| </ | </ | ||
| + | |||
| + | Créez un conteneur **db01** à partir de l' | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman run -d registry.redhat.io/ | ||
| + | Trying to pull registry.redhat.io/ | ||
| + | Getting image source signatures | ||
| + | Checking if image destination supports signatures | ||
| + | Copying blob 0258a9a5cd06 done | ||
| + | Copying blob 148a3ed2f70e skipped: already exists | ||
| + | Copying blob 4de1bba6ee61 done | ||
| + | Copying config b0e9bcdcc3 done | ||
| + | Writing manifest to image destination | ||
| + | Storing signatures | ||
| + | aea7c40abc0570fb616be14de5642683be5ebbadc95359f4b2d3ec32f1b12ddd | ||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | f42e19a0627e | ||
| + | aea7c40abc05 | ||
| </ | </ | ||
| + | |||
| + | Examinez l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ skopeo inspect docker:// | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | ... | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ... | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | Vous noterez que pour lancer un conteneur, il faut spécifier les variables d' | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman run -d -e MYSQL_USER=user -e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db -p 3306:3306 rhel8/ | ||
| + | afc0cc8427677eed8cf17ef1ee9669b937ca25ccd322c066ee9c46e070baf3d3 | ||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | f42e19a0627e | ||
| + | aea7c40abc05 | ||
| + | afc0cc842767 | ||
| </ | </ | ||
| + | |||
| + | Notez que le conteneur crée avec les variables d' | ||
| + | |||
| + | Supprimez maintenant le conteneur **db01**. Notez que vous que l'on peut référencer le conteneur par une partie de son **CONTAINER ID**, à condition que cette partie soit unique : | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman rm aea | ||
| + | aea | ||
| + | </ | ||
| + | Supprimez le deuxième conteneur en stipulant son nom : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman rm boring_ganguly | ||
| + | Error: cannot remove container afc0cc8427677eed8cf17ef1ee9669b937ca25ccd322c066ee9c46e070baf3d3 as it is running - running or paused containers cannot be removed without force: container state improper | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman rm -f boring_ganguly | ||
| + | boring_ganguly | ||
| </ | </ | ||
| + | |||
| + | Re-créez un conteneur MariaDB ayant le nom **db1** : | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --name db1 -e MYSQL_USER=user -e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db -p 3306:3306 rhel8/ | ||
| + | 90c582b10512c3049ded2937d72c6c4ccfe98a6e40311f44000a7c0425aa219e | ||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | f42e19a0627e | ||
| + | 90c582b10512 | ||
| </ | </ | ||
| + | |||
| + | =====LAB #4 - Gestion du Stockage et du Réseau===== | ||
| + | |||
| + | ====4.1 - Gestion du Stockage Persistant==== | ||
| + | |||
| + | Consultez les deux fichiers **/ | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman unshare cat / | ||
| + | | ||
| + | | ||
| + | [trainee@redhat9 ~]$ podman unshare cat / | ||
| + | | ||
| + | | ||
| </ | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** - La sortie précédente montre que dans le conteneur, l' | ||
| + | </ | ||
| + | |||
| + | Obtenez l'UID et le GID de l' | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ podman exec -it db1 grep mysql /etc/passwd | ||
| + | mysql: | ||
| + | </ | ||
| + | |||
| + | Il convient maintenant de monter le répertoire **/ | ||
| + | |||
| + | Créez donc le répertoire **/ | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ mkdir / | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman unshare chown 27:27 / | ||
| + | [trainee@redhat9 ~]$ ls -l / | ||
| + | total 8 | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 100026 | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| + | drwxr-xr-x. 2 trainee trainee | ||
| </ | </ | ||
| + | |||
| + | Vérifiez que l' | ||
| < | < | ||
| + | [trainee@redhat9 ~]$ su - | ||
| + | Password: fenestros | ||
| + | [root@redhat9 ~]# getenforce | ||
| + | Permissive | ||
| + | |||
| + | [root@redhat9 ~]# setenforce enforcing | ||
| + | |||
| + | [root@redhat9 ~]# exit | ||
| + | logout | ||
| </ | </ | ||
| + | Arrêtez le conteneur **bd1** : | ||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman stop db1 | ||
| + | db1 | ||
| + | </ | ||
| + | Créez un conteneur dénommé **bd01** : | ||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --name db01 -e MYSQL_USER=user -e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db -p 3306:3306 -v / | ||
| + | 959e8039ba2bc11a30bbe0ffb9185c4779aa6c8865a9288767675c5163e119bd | ||
| + | </ | ||
| + | Consultez l' | ||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | f42e19a0627e | ||
| + | 90c582b10512 | ||
| + | 959e8039ba2b | ||
| + | </ | ||
| + | Afin de comprendre la nature du problème, consultez les journaux du conteneur avec la commande **podman container logs** : | ||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman container logs db01 | ||
| + | ... | ||
| + | 2024-10-31 | ||
| + | 2024-10-31 | ||
| + | 2024-10-31 | ||
| + | 2024-10-31 | ||
| + | ... | ||
| + | </ | ||
| + | En notant l' | ||
| + | < | ||
| + | [trainee@redhat9 ~]$ su - | ||
| + | Password: fenestros | ||
| + | </ | ||
| + | Générez un fichier d' | ||
| + | < | ||
| + | [root@redhat9 ~]# sealert -a / | ||
| + | [root@redhat9 ~]# cat / | ||
| + | ... | ||
| + | -------------------------------------------------------------------------------- | ||
| + | SELinux is preventing / | ||
| + | ***** Plugin catchall (100. confidence) suggests | ||
| + | If you believe that mariadbd should be allowed read write access on the aria_log_control file by default. | ||
| + | Then you should report this as a bug. | ||
| + | You can generate a local policy module to allow this access. | ||
| + | Do | ||
| + | allow this access for now by executing: | ||
| + | # ausearch -c ' | ||
| + | # semodule -X 300 -i my-mysqld.pp | ||
| + | Additional Information: | ||
| + | Source Context | ||
| + | Target Context | ||
| + | Target Objects | ||
| + | Source | ||
| + | Source Path / | ||
| + | Port < | ||
| + | Host < | ||
| + | Source RPM Packages | ||
| + | Target RPM Packages | ||
| + | SELinux Policy RPM selinux-policy-targeted-38.1.35-2.el9_4.2.noarch | ||
| + | Local Policy RPM selinux-policy-targeted-38.1.35-2.el9_4.2.noarch | ||
| + | Selinux Enabled | ||
| + | Policy Type | ||
| + | Enforcing Mode Enforcing | ||
| + | Host Name | ||
| + | Platform | ||
| + | 5.14.0-427.37.1.el9_4.x86_64 #1 SMP | ||
| + | PREEMPT_DYNAMIC Fri Sep 13 12:41:50 EDT 2024 | ||
| + | x86_64 x86_64 | ||
| + | Alert Count 1 | ||
| + | First Seen 2024-10-31 10:53:10 CET | ||
| + | Last Seen | ||
| + | Local ID c9066e3a-05ae-464e-bbd4-fd94585c6b64 | ||
| + | Raw Audit Messages | ||
| + | type=AVC msg=audit(1730368390.63: | ||
| + | tem_u: | ||
| + | type=SYSCALL msg=audit(1730368390.63: | ||
| + | 6 suid=100026 fsuid=100026 egid=100026 sgid=100026 fsgid=100026 tty=(none) ses=6974 comm=mysqld exe=/ | ||
| + | D=trainee UID=unknown(100026) GID=unknown(100026) EUID=unknown(100026) SUID=unknown(100026) FSUID=unknown(100026) EGID=unknown(100026) SGID=unknown(100026) FSGID=unknown(100026) | ||
| + | Hash: mysqld, | ||
| + | |||
| + | [root@redhat9 ~]# exit | ||
| + | logout | ||
| + | </ | ||
| + | |||
| + | En consultant l' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# ls -lZ / | ||
| + | drwxr-xr-x. 3 100026 | ||
| + | </ | ||
| + | |||
| + | Pour forcer l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --replace --name db01 -e MYSQL_USER=user -e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db -p 3306:3306 -v / | ||
| + | 47a5626d51dd02a8a7c769bfd37c4ba763320f731a2ccc71797567817205a20b | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | f42e19a0627e | ||
| + | 90c582b10512 | ||
| + | 47a5626d51dd | ||
| + | </ | ||
| + | |||
| + | Finalement vérifiez le SC du répertoire **/ | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ ls -lZ / | ||
| + | drwxr-xr-x. 3 100026 | ||
| + | </ | ||
| + | |||
| + | ====4.2 - Gestion du Réseau==== | ||
| + | |||
| + | Pour fournir un accès réseau aux conteneurs, les clients doivent se connecter aux ports de l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --replace --name db01 -e MYSQL_USER=user -e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db -p 3306:3306 -v / | ||
| + | 97f190a660ceba8f62b688781a5df1daef06e3ded241d799b15a8df744049116 | ||
| + | </ | ||
| + | |||
| + | Notez ensuite la prise en charge de cette commande : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman ps -a | grep db01 | ||
| + | 97f190a660ce | ||
| + | </ | ||
| + | |||
| + | Pour voir le mappage des ports, utilisez la commande **podman port -a** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman port -a | ||
| + | 97f190a660ce | ||
| + | 97f190a660ce | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman port db01 | ||
| + | 3306/tcp -> 0.0.0.0: | ||
| + | 3306/tcp -> 0.0.0.0: | ||
| + | </ | ||
| + | |||
| + | Depuis la version 4.0, Podman supporte deux réseaux pour les conteneurs, **Netavark** et **CNI**. À partir de RHEL 9, les systèmes utilisent **Netavark** par défaut. Pour vérifier quel backend réseau est utilisé, exécutez la commande podman info suivante : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman --version | ||
| + | podman version 4.9.4-rhel | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman info --format {{.Host.NetworkBackend}} | ||
| + | netavark | ||
| + | </ | ||
| + | |||
| + | Pour modifier le backend utilisé, il convient de modifier la directive **network_backend** dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ cat / | ||
| + | # | ||
| + | </ | ||
| + | |||
| + | Lors de l' | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman network ls | ||
| + | NETWORK ID NAME DRIVER | ||
| + | 2f259bab93aa | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** - Le DRIVER **bridge** est limité aux conteneurs d'un hôte unique exécutant podman. Les conteneurs ne peuvent communiquer qu' | ||
| + | </ | ||
| + | |||
| + | Regardez les caractéristiques de ce réseau : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman network inspect podman | ||
| + | [ | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | Créez maintenant un deuxième réseau appelé **db_net** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman network create --gateway 10.87.0.1 --subnet 10.87.0.0/ | ||
| + | db_net | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman network ls | ||
| + | NETWORK ID NAME DRIVER | ||
| + | 556c9797ea6d | ||
| + | 2f259bab93aa | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman network inspect db_net | ||
| + | [ | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | Placez le conteneur **db01** dans le réseau **db_net** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --replace --name db01 -e MYSQL_USER=user -e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db -p 3306:3306 -v / | ||
| + | 36c9f95ae52f76f96c45bb7fd6600cb014adc751059a531bb7bf38f927a11541 | ||
| + | </ | ||
| + | |||
| + | Créez maintenant le conteneur **client** en le plaçant dans le réseau **db_net** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman run -d --name client --network db_net registry.access.redhat.com/ | ||
| + | 00b2b82c2adf022badf91f88a9a7f59e71cac705bf4885fa08553681ad1f594c | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | f42e19a0627e | ||
| + | 90c582b10512 | ||
| + | 36c9f95ae52f | ||
| + | 00b2b82c2adf | ||
| + | </ | ||
| + | |||
| + | Installez dans le conteneur **client**, les paquets **iputils** et **iproute** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman exec -it client dnf install -y iputils iproute | ||
| + | </ | ||
| + | |||
| + | Testez la connectivité du réseau **db_net** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman exec -it client ip a | grep 10.8 | ||
| + | inet 10.87.0.3/ | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman exec -it client ping -c3 db01 | ||
| + | PING db01.dns.podman (10.87.0.2) 56(84) bytes of data. | ||
| + | 64 bytes from 10.87.0.2 (10.87.0.2): | ||
| + | 64 bytes from 10.87.0.2 (10.87.0.2): | ||
| + | 64 bytes from 10.87.0.2 (10.87.0.2): | ||
| + | |||
| + | --- db01.dns.podman ping statistics --- | ||
| + | 3 packets transmitted, | ||
| + | rtt min/ | ||
| + | </ | ||
| + | |||
| + | Testez la résolution des noms **db_net** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman exec -it client ping -c3 www.free.fr | ||
| + | PING www.free.fr (212.27.48.10) 56(84) bytes of data. | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | |||
| + | --- www.free.fr ping statistics --- | ||
| + | 3 packets transmitted, | ||
| + | rtt min/ | ||
| + | </ | ||
| + | |||
| + | Créez le troisième réseau **backend** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman network create backend | ||
| + | backend | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman network ls | ||
| + | NETWORK ID NAME DRIVER | ||
| + | 9c7fcc7b2b5d | ||
| + | 556c9797ea6d | ||
| + | 2f259bab93aa | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman network inspect backend | ||
| + | [ | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | Placez les deux conteneurs existants dans ce nouveau réseau : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman network connect backend db01 | ||
| + | |||
| + | [trainee@redhat9 ~]$ podman network connect backend client | ||
| + | </ | ||
| + | |||
| + | Constatez que les deux conteneurs se trouvent dans les deux réseaux, **backend** et **db_net** : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman inspect db01 | ||
| + | [ | ||
| + | ... | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | } | ||
| + | } | ||
| + | }, | ||
| + | ... | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ podman inspect client | ||
| + | [ | ||
| + | ... | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | } | ||
| + | } | ||
| + | }, | ||
| + | ... | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | =====LAB #5 - Gestion des Conteneurs en tant que Services Système===== | ||
| + | |||
| + | Sans faire appel à un Orchestrateur de Conteneurs tel Kubernetes, il est possible de gérer des petites infrastructures en utilisant simplement **-systemd**. | ||
| + | |||
| + | ====5.1 - Création du Gestionnaire de Conteneurs==== | ||
| + | |||
| + | Commencez par créer un compte qui sera utilisé pour gérer les conteneurs : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ su - | ||
| + | Password: fenestros | ||
| + | |||
| + | [root@redhat9 ~]# groupadd fenestros && useradd fenestros -c FenestrOs -d / | ||
| + | |||
| + | [root@redhat9 ~]# passwd fenestros | ||
| + | Changing password for user fenestros. | ||
| + | New password: fenestros | ||
| + | BAD PASSWORD: The password contains the user name in some form | ||
| + | Retype new password: fenestros | ||
| + | passwd: all authentication tokens updated successfully. | ||
| + | </ | ||
| + | |||
| + | Devenez l' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# su - fenestros | ||
| + | |||
| + | [fenestros@redhat9 ~]$ podman info | ||
| + | WARN[0000] The cgroupv2 manager is set to systemd but there is no systemd user session available | ||
| + | WARN[0000] For using systemd, you may need to log in using a user session | ||
| + | WARN[0000] Alternatively, | ||
| + | WARN[0000] Falling back to --cgroup-manager=cgroupfs | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Podman est un utilitaire sans état et nécessite une session de connexion complète. Podman doit être utilisé dans une session SSH et ne peut pas être utilisé dans un shell sudo ou su : | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ exit | ||
| + | logout | ||
| + | |||
| + | [root@redhat9 ~]# ssh fenestros@localhost | ||
| + | The authenticity of host ' | ||
| + | ED25519 key fingerprint is SHA256: | ||
| + | This key is not known by any other names | ||
| + | Are you sure you want to continue connecting (yes/ | ||
| + | Warning: Permanently added ' | ||
| + | fenestros@localhost' | ||
| + | Register this system with Red Hat Insights: insights-client --register | ||
| + | Create an account or view all your systems at https:// | ||
| + | Last login: Thu Oct 31 13:04:30 2024 | ||
| + | |||
| + | [fenestros@redhat9 ~]$ podman info | ||
| + | host: | ||
| + | arch: amd64 | ||
| + | buildahVersion: | ||
| + | cgroupControllers: | ||
| + | - memory | ||
| + | - pids | ||
| + | cgroupManager: | ||
| + | cgroupVersion: | ||
| + | conmon: | ||
| + | package: conmon-2.1.10-1.el9.x86_64 | ||
| + | path: / | ||
| + | version: ' | ||
| + | cpuUtilization: | ||
| + | idlePercent: | ||
| + | systemPercent: | ||
| + | userPercent: | ||
| + | cpus: 4 | ||
| + | databaseBackend: | ||
| + | distribution: | ||
| + | distribution: | ||
| + | version: " | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | ====5.2 - Création d'un Conteneur de Serveur Web==== | ||
| + | |||
| + | Commencez par créer un répertoire dans l' | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ mkdir www | ||
| + | </ | ||
| + | |||
| + | Créez ensuite un conteneur, appelé **webserver** avec un mappage de ports, à partir de l' | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ podman run -d --name webserver -p 8080:8080 -v ~/ | ||
| + | Trying to pull registry.access.redhat.com/ | ||
| + | Getting image source signatures | ||
| + | Checking if image destination supports signatures | ||
| + | Copying blob c302a7fbb8d5 done | ||
| + | Copying blob 148a3ed2f70e done | ||
| + | Copying blob 4de1bba6ee61 done | ||
| + | Copying config e11bc11181 done | ||
| + | Writing manifest to image destination | ||
| + | Storing signatures | ||
| + | e8afda5806a98f378865230e6d5c900c85afc0ea152609602a65d05c60cd68dc | ||
| + | </ | ||
| + | |||
| + | Utilisez la commande **podman generate systemd** pour créer un fichier d' | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ podman generate systemd --name webserver --new --files | ||
| + | |||
| + | DEPRECATED command: | ||
| + | It is recommended to use Quadlets for running containers and pods under systemd. | ||
| + | |||
| + | Please refer to podman-systemd.unit(5) for details. | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | |||
| + | Le fichier est créé dans le répertoire courant : | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ cat container-webserver.service | ||
| + | # container-webserver.service | ||
| + | # autogenerated by Podman 4.9.4-rhel | ||
| + | # Thu Oct 31 13:42:12 CET 2024 | ||
| + | |||
| + | [Unit] | ||
| + | Description=Podman container-webserver.service | ||
| + | Documentation=man: | ||
| + | Wants=network-online.target | ||
| + | After=network-online.target | ||
| + | RequiresMountsFor=%t/ | ||
| + | |||
| + | [Service] | ||
| + | Environment=PODMAN_SYSTEMD_UNIT=%n | ||
| + | Restart=on-failure | ||
| + | TimeoutStopSec=70 | ||
| + | ExecStart=/ | ||
| + | --cidfile=%t/ | ||
| + | --cgroups=no-conmon \ | ||
| + | --rm \ | ||
| + | --sdnotify=conmon \ | ||
| + | --replace \ | ||
| + | -d \ | ||
| + | --name webserver \ | ||
| + | -p 8080:8080 \ | ||
| + | -v / | ||
| + | ExecStop=/ | ||
| + | --ignore -t 10 \ | ||
| + | --cidfile=%t/ | ||
| + | ExecStopPost=/ | ||
| + | -f \ | ||
| + | --ignore -t 10 \ | ||
| + | --cidfile=%t/ | ||
| + | Type=notify | ||
| + | NotifyAccess=all | ||
| + | |||
| + | [Install] | ||
| + | WantedBy=default.target | ||
| + | </ | ||
| + | |||
| + | Pour que systemd puisse prendre en charge le service, le fichier d' | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ mkdir -p ~/ | ||
| + | |||
| + | [fenestros@redhat9 ~]$ mv container-webserver.service ~/ | ||
| + | </ | ||
| + | |||
| + | Pour créer le service, utilisez la commande **systemctl --user daemon-reload**. Notez que l' | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ systemctl --user daemon-reload | ||
| + | </ | ||
| + | |||
| + | Vérifiez le statut du service : | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ systemctl --user status container-webserver.service | ||
| + | ○ container-webserver.service - Podman container-webserver.service | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | </ | ||
| + | |||
| + | Dans l' | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ loginctl show-user fenestros | ||
| + | UID=1001 | ||
| + | GID=1001 | ||
| + | Name=fenestros | ||
| + | Timestamp=Thu 2024-10-31 13:09:25 CET | ||
| + | TimestampMonotonic=240322297212 | ||
| + | RuntimePath=/ | ||
| + | Service=user@1001.service | ||
| + | Slice=user-1001.slice | ||
| + | Display=7200 | ||
| + | State=active | ||
| + | Sessions=7200 | ||
| + | IdleHint=no | ||
| + | IdleSinceHint=1730379006672000 | ||
| + | IdleSinceHintMonotonic=242763627399 | ||
| + | Linger=no | ||
| + | </ | ||
| + | |||
| + | Afin que le service reste démarré après la fermeture de la session et qu'il réagisse comme un service de système, il faut modifier la valeur de Linger à **yes** : | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ loginctl enable-linger | ||
| + | |||
| + | [fenestros@redhat9 ~]$ loginctl show-user fenestros | ||
| + | UID=1001 | ||
| + | GID=1001 | ||
| + | Name=fenestros | ||
| + | Timestamp=Thu 2024-10-31 13:09:25 CET | ||
| + | TimestampMonotonic=240322297212 | ||
| + | RuntimePath=/ | ||
| + | Service=user@1001.service | ||
| + | Slice=user-1001.slice | ||
| + | Display=7200 | ||
| + | State=active | ||
| + | Sessions=7200 | ||
| + | IdleHint=no | ||
| + | IdleSinceHint=1730379080672000 | ||
| + | IdleSinceHintMonotonic=242837627399 | ||
| + | Linger=yes | ||
| + | </ | ||
| + | |||
| + | Créez un fichier **index.html** dans le répertoire **$HOME/ | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ echo "Hello World" > ~/ | ||
| + | </ | ||
| + | |||
| + | Supprimez le conteneur actuel **webserver** en utilisant l' | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | e8afda5806a9 | ||
| + | |||
| + | [fenestros@redhat9 ~]$ podman rm -f webserver | ||
| + | webserver | ||
| + | </ | ||
| + | |||
| + | Activez et démarrez le service utilisateur **container-webserver** : | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ systemctl --user enable --now container-webserver | ||
| + | Created symlink / | ||
| + | |||
| + | [fenestros@redhat9 ~]$ systemctl --user status | ||
| + | ● container-webserver.service - Podman container-webserver.service | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Main PID: 235072 (conmon) | ||
| + | Tasks: 16 (limit: 48799) | ||
| + | | ||
| + | CPU: 132ms | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | [fenestros@redhat9 ~]$ podman ps -a | ||
| + | CONTAINER ID IMAGE COMMAND | ||
| + | ed306cecef9e | ||
| + | </ | ||
| + | |||
| + | Déconnectez-vous du compte fenestros et vérifiez que le serveur Web fonctionne : | ||
| + | |||
| + | < | ||
| + | [fenestros@redhat9 ~]$ exit | ||
| + | logout | ||
| + | Connection to localhost closed. | ||
| + | |||
| + | [root@redhat9 ~]# curl http:// | ||
| + | Hello World | ||
| + | </ | ||
| ----- | ----- | ||
| Copyright © 2024 Hugh Norris | Copyright © 2024 Hugh Norris | ||
