Objective: Describe how software containers work, how container architecture fits together on a Linux host, and how Kubernetes and Red Hat OpenShift orchestrate containers at scale.
Overview
Containers package an application with everything it needs to run — libraries, binaries, and configuration — into a single, portable unit that runs consistently across laptops, test systems, and production clusters. Kubernetes and Red Hat OpenShift build on top of a container runtime to manage large numbers of containers across many hosts automatically.
Key Concepts
What a container is
A container is an isolated Linux process (or group of processes) with its own filesystem, network namespace, and resource limits, built from a read-only image. Unlike a virtual machine, a container shares the host kernel, which is why containers start in milliseconds and use far less overhead than a full VM.
The Linux primitives underneath
Container isolation is implemented with kernel features rather than a hypervisor: namespaces (PID, network, mount, UTS, IPC, user) isolate what a process can see, and control groups (cgroups) limit and account for how much CPU, memory, and I/O a process can use. SELinux adds mandatory access control on top, and container engines add per-container SELinux labeling by default.
Container architecture: image, container, registry
An image is a read-only template built in layers. A container is a running (or stopped) instance of an image with a thin writable layer on top. A registry stores and distributes images so they can be pulled onto any host that needs to run them.
| Term | Analogy |
|---|---|
| Image | A class definition, or a program on disk |
| Container | An instance of the class, or a running process |
| Registry | A package repository the image is downloaded from |
Podman vs. Docker
This course uses Podman as the container engine. Podman is daemonless (no background root process) and rootless-capable (containers can run without root privileges), while remaining command-line compatible with Docker for the commands covered in this course.
Kubernetes and OpenShift
Kubernetes is the open-source orchestration engine that schedules containers onto a cluster of hosts (nodes), keeps the desired number of instances running, and provides service discovery and load balancing. Red Hat OpenShift Container Platform is an enterprise Kubernetes distribution that adds a web console, integrated container registry, developer-focused build tooling (source-to-image), and stronger default security policies.
Working with It
Because Podman has no long-running daemon, each podman command runs as its own process — there's nothing to restart if the tool misbehaves.
Prefer running containers rootless where possible; it limits the blast radius if a container is compromised, since the container process has only the privileges of the unprivileged user that started it.
A container shares the host kernel. A kernel-level exploit or an outdated kernel affects every container on that host — container isolation is not equivalent to hypervisor-level isolation.
Checking the container engine
# Confirm Podman is installed and check basic info
$ podman --version
$ podman info --format "{{.Host.Arch}}: {{.Host.Kernel}}"Watch Out For
A container shares the host kernel. A kernel-level exploit or an outdated kernel affects every container on that host — container isolation is not equivalent to hypervisor-level isolation.
Key Terms
- Image
- A read-only, layered template used to create containers.
- Container
- A running instance of an image with an ephemeral writable layer.
- Registry
- A service that stores and distributes container images.
- Namespace (kernel)
- A Linux kernel feature that isolates what a process can see (PIDs, network, mounts, etc.).
- cgroups
- Linux control groups; limit and account for a process's CPU, memory, and I/O usage.
Review Questions
- What is the fundamental difference between how a container achieves isolation and how a virtual machine achieves isolation?
- Name the two Linux kernel features primarily responsible for container isolation and resource limiting.
- What is the relationship between an image and a container?
- List two practical differences between Podman and a traditional Docker daemon-based setup.
- In one or two sentences, describe what Kubernetes adds on top of a container runtime, and what OpenShift adds on top of Kubernetes.