Red Hat OpenShift Administration I · DO180

Chapter 4

Container Images

Image names · Registries · Authentication · Local images · Layers · Tags and digests
CIS271RH — Mesa Community College
Find, retrieve, inspect, tag, publish, and clean up container images, and understand how registries, layers, tags, and digests work.

Key Commands

  • podman login
  • podman search
  • podman pull
  • podman tag
  • podman push
  • podman rmi
  • Every container starts from an image, so you need to:
  • find the right image, and retrieve it from a registry
  • inspect what it contains
  • tag and publish your own copies
  • clean up images you no longer need
registry.redhat.io/rhel8/httpd-24:latest
PartExampleMeaning
Registryregistry.redhat.ioThe server that stores the image
Namespacerhel8An organization or project within the registry
Repositoryhttpd-24The image's name
TaglatestWhich version; defaults to latest if omitted
Note — Short NamesLeave off the registry, and RHEL checks /etc/containers/registries.conf: it uses a configured alias, or prompts you to choose a registry. Fully qualified names avoid surprises.
RegistryWhat It Offers
registry.redhat.ioRed Hat certified images; login required
registry.access.redhat.comSome Red Hat images, including UBI; no login required
quay.ioA general-purpose registry for public and private images
OpenShift internal registryImages built and stored inside the cluster
# Log in once; credentials are saved for later pulls and pushes
$ podman login registry.redhat.io
$ podman login quay.io

# Check who you're logged in as, then log out
$ podman login --get-login registry.redhat.io
$ podman logout quay.io
NoteCredentials are saved in ${XDG_RUNTIME_DIR}/containers/auth.json, which is cleared at logout or reboot.
CommandPurpose
podman search TERMSearches registries for matching images
podman pull IMAGEDownloads an image to local storage
podman imagesLists local images
podman tag IMAGE NEWNAMEAdds another name to a local image
podman push IMAGEUploads an image to a registry
podman rmi IMAGERemoves a local image
podman inspect IMAGEShows an image's metadata as JSON
Tip — Search Before You Guesspodman search httpd is faster than guessing an image's exact name.
$ podman login registry.redhat.io
$ podman pull registry.redhat.io/rhel8/httpd-24
$ podman images
$ podman tag registry.redhat.io/rhel8/httpd-24 quay.io/myorg/httpd-24:v1
$ podman login quay.io
$ podman push quay.io/myorg/httpd-24:v1

podman tag doesn't copy anything: both names point at the same image and layers. Pushing to quay.io needs its own login.

  • Each build step adds an immutable layer: a set of file-system changes.
  • Layers are identified by their content, so images that share a base share layers.
  • A pull downloads only the layers you don't already have.
# Show the layers an image was built from
$ podman history registry.redhat.io/rhel8/httpd-24
# A tag can be moved to a different image at any time
$ podman pull quay.io/myorg/httpd-24:v1

# A digest identifies one exact image, forever
$ podman pull quay.io/myorg/httpd-24@sha256:4f1e...c9a2

# Find an image's digest
$ podman inspect quay.io/myorg/httpd-24:v1 --format '{{.Digest}}'
Warning — Tags Are Just Pointers:latest today may be a different image tomorrow. Pin production deployments to a digest.
Common Pitfall — rmi Fails on In-Use Imagespodman rmi refuses to remove an image that any container references, even a stopped one. Remove that container first, or use podman rmi -f deliberately: it removes the containers too.
$ podman ps -a --filter ancestor=quay.io/myorg/httpd-24:v1
registry
A networked service that stores and serves container images
tag
A mutable, human-readable label pointing at a specific image
digest
An immutable, content-based identifier for one exact image (sha256:...)
layer
An immutable, content-addressed file-system diff that forms part of an image
podman pull / push
Download an image from, or upload one to, a registry
podman tag
Adds another name to a local image without duplicating its layers
  1. Write out the four parts of a fully qualified image name and give an example.
  2. What is the practical difference between registry.redhat.io and registry.access.redhat.com?
  3. Why can pulling a new image sometimes be much faster than its total size would suggest?
  4. Why is pinning a production deployment to an image digest safer than pinning to a tag like :latest?
  5. What would you need to do before podman rmi would succeed on an image still referenced by a stopped container?