Red Hat OpenShift Administration I · DO180

Chapter 5

Custom Container Images

Design principles · Base images · Containerfile instructions · podman build · Build cache
CIS271RH — Mesa Community College
Design and build custom container images with a Containerfile, choosing a suitable base image, ordering instructions for the build cache, and running as a non-root user.

Key Commands and Instructions

  • podman build
  • FROM
  • RUN
  • COPY
  • USER
  • CMD / ENTRYPOINT
  • A custom image layers your application code and configuration on top of a base image.
  • Building it from a file makes it repeatable: anyone can rebuild the same image.
  • The same image then runs unchanged in development, test, and production.
  • Small: only what the application needs
  • Single-purpose: one main process per container
  • No extra packages, no baked-in secrets
  • Configured at run time, through environment variables or mounted files
Base ImageUse It When
ubi8/ubi-minimal / ubi9/ubi-minimalYou want a small base with microdnf
ubi9/ubiYou need full dnf and common tools
Language images, such as ubi9/python-311The runtime your app needs is known
InstructionPurpose
FROMSets the base image
RUNRuns a command at build time, committing the result as a layer
COPY / ADDCopies files from the build context into the image
ENVSets an environment variable for build and run time
EXPOSEDocuments the port(s) the app listens on
USERSets the user the process runs as
CMDThe default command at start; can be overridden
ENTRYPOINTA fixed executable; CMD supplies its default arguments
ENTRYPOINT ["ping"]
CMD ["-c", "3", "localhost"]
$ podman run myping                   # runs: ping -c 3 localhost
$ podman run myping -c 1 example.com  # runs: ping -c 1 example.com

Arguments after the image name replace CMD, but the ENTRYPOINT stays. With only CMD, they replace the whole command.

# Containerfile
FROM registry.access.redhat.com/ubi8/ubi-minimal
RUN microdnf install -y httpd && microdnf clean all && \
    sed -i 's/^Listen 80$/Listen 8080/' /etc/httpd/conf/httpd.conf && \
    chgrp -R 0 /var/log/httpd /run/httpd && \
    chmod -R g=u /var/log/httpd /run/httpd
COPY ./site/ /var/www/html/
EXPOSE 8080
USER 1001
CMD ["httpd", "-D", "FOREGROUND"]
Note — Why the Extra Lineshttpd listens on port 80 by default, which a non-root user can't bind, and it must write its logs and PID file. The sed, chgrp, and chmod steps fix both.
$ podman build -t quay.io/myorg/mysite:1.0 .
$ podman run -d --name mysite -p 8080:8080 quay.io/myorg/mysite:1.0
  • -t names and tags the image.
  • The final . is the build context: the directory whose files COPY can use.
Tip — Containerfile == DockerfileSame syntax. Podman reads a file named either Containerfile or Dockerfile.

Podman reuses a cached layer until an instruction, or a file it copies, changes. Every layer after that is rebuilt.

# Slow: any code change re-runs the package install
COPY ./site/ /var/www/html/
RUN microdnf install -y httpd

# Fast: packages are cached; only the COPY layer rebuilds
RUN microdnf install -y httpd
COPY ./site/ /var/www/html/
Tip — Order for Cache EfficiencyPut steps from least likely to change to most likely to change.
Common Pitfall — Running as Root by DefaultWithout a USER instruction, the container runs as root. Set a non-root USER unless root is truly needed.
Note — OpenShift Expects ThisOpenShift runs containers as an arbitrary non-root UID in group 0. Making files group-owned by 0 and group-writable, as above, lets the image run there unchanged.
Containerfile
A file of build instructions; Podman's name for a Dockerfile
base image
The starting image a custom image is built FROM
build context
The local files available to COPY/ADD during a build
CMD vs. ENTRYPOINT
CMD gives overridable default arguments; ENTRYPOINT is the fixed command
build cache
Reuse of unchanged layers to speed up later builds
  1. What is the difference between CMD and ENTRYPOINT?
  2. Why should OS package installation usually come before copying application code?
  3. What security practice applies to the USER instruction, and why?
  4. What is the build context, and what command supplies it?
  5. Name two properties of a well-designed container image besides being small.