Red Hat OpenShift Administration I · DO180

Chapter 3

Configuring Persistent Storage and Accessing Containers

Bind mounts · Named volumes · SELinux labels · PVs and PVCs · exec, attach, cp
CIS271RH — Mesa Community College
Attach persistent storage to containers, label it correctly for SELinux, relate it to Kubernetes storage, and access running containers to inspect and troubleshoot them.

Key Commands

  • podman volume create
  • podman run -v
  • podman exec -it
  • podman cp
  • Containers are disposable: removing one deletes its writable layer.
  • Data that must outlive a container, like a database, needs storage outside it.
  • In a cluster, that storage must also follow the application to whichever node it runs on.
# Bind mount: host path -> container path
$ podman run -d --name db -e MYSQL_ROOT_PASSWORD=redhat \
    -v /var/local/mysql-data:/var/lib/mysql:Z \
    registry.redhat.io/rhel8/mysql-80

# Named volume, created and managed by Podman
$ podman volume create mysql-vol
$ podman run -d --name db -e MYSQL_ROOT_PASSWORD=redhat \
    -v mysql-vol:/var/lib/mysql \
    registry.redhat.io/rhel8/mysql-80
  • Bind mount: you choose the host directory · Named volume: Podman manages it, by name
Tip — Named Volumes Are the Default RecommendationThey're more portable: they don't assume a particular host directory exists.
OptionEffect
:ZRelabels the host directory privately, for this one container
:zRelabels it as shared, so several containers can use it
:UChanges ownership to match the container's user
NoteNamed volumes are labeled automatically, so they don't need :Z. Bind mounts do.
Warning — Rootless OwnershipIn a rootless container, the app's user (UID 27 for MySQL) maps to a different host UID. If it can't write to a bind mount, add :U, or run podman unshare chown 27:27 DIR.
ObjectWhat It Is
PersistentVolume (PV)A piece of actual storage in the cluster
PersistentVolumeClaim (PVC)An application's request for storage
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: db-data
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi

The pod asks for "5 GiB, read-write" through the PVC; the cluster finds or provisions a matching PV. Pod definitions stay portable.

CommandWhat It Does
podman exec NAME CMDRuns one command in a running container
podman exec -it NAME /bin/bashOpens an interactive shell in it
podman attach NAMEConnects your terminal to the container's main process
podman cpCopies files between the host and a container
$ podman exec db mysql --version
$ podman cp ./schema.sql db:/tmp/schema.sql      # host -> container
$ podman cp db:/etc/my.cnf .                     # container -> host
Tip — Use exec, Not attach, for Debuggingexec starts a separate process. attach connects to the main process, so your keystrokes go to the application itself.
WarningWhile attached, Ctrl+C is sent to the application and can stop the container. Detach safely with Ctrl+P, then Ctrl+Q.
$ podman volume create app-data
$ podman run -d --name app -v app-data:/data quay.io/example/app:latest
$ podman exec -it app /bin/bash
[container]$ ls /data
[container]$ exit

Remove and recreate the app container with the same -v app-data:/data, and the data in /data is still there.

$ podman volume ls
$ podman volume inspect app-data
Common Pitfall — Forgetting :Z on a Bind MountThe app gets "Permission denied" even though file permissions look correct. SELinux is blocking it. Confirm with sudo ausearch -m avc -ts recent, then add :Z or :z.
bind mount
A direct mapping of a host directory into a container
named volume
Engine-managed storage referenced by name, not host path
:Z / :z
SELinux relabeling options for exclusive versus shared access
PersistentVolume (PV)
A cluster-level representation of actual storage in Kubernetes/OpenShift
PersistentVolumeClaim (PVC)
An application's storage request, decoupled from the underlying PV
  1. What is the key difference between a bind mount and a named volume?
  2. Why might a container fail to write to a correctly permissioned bind mount on RHEL, and how do you fix it?
  3. How do a PersistentVolume and a PersistentVolumeClaim differ in Kubernetes/OpenShift?
  4. Which command opens an interactive bash shell in a running container?
  5. Why is podman exec generally safer for debugging than podman attach?