Podman

What is Podman?

Originally developed by Red Hat engineers along with the open-source community, the Podman project defines Podman as "a daemonless container engine for developing, managing, and running OCI Containers on your Linux System. Containers can either be run as root or in rootless mode."

Podman is essentially a container management tool that allows users to manage containers and container images on Linux systems. Similar to Docker, Podman enables users to run, build, and manage containers, but it operates without requiring a separate daemon process, which provides a more secure and lightweight alternative. Podman utilizes the same container images and pods concept as Docker, making it easy for users familiar with Docker to transition to Podman. Additionally, Podman supports Kubernetes-style pod orchestration, making it a versatile tool for container management in various environments.


How does Podman work?

Similar to other common Container Engines (Docker, CRI-O, containerd), Podman relies on an OCI compliant Container Runtime (runc, crun, runv, etc.) to interface with the operating system and create the running containers. This makes the running containers created by Podman nearly indistinguishable from those created by any other common container engine.

Containers under the control of Podman can either be run by root or by a non-privileged user. Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library. Podman specializes in all of the commands and functions that help you to maintain and modify OCI container images, such as pulling and tagging. It allows you to create, run, and maintain those containers and container images in a production environment.

A pod is a group of containers that share the same name space, ports, and network connection. Usually, containers within one pod can communicate directly with each other. Each pod contains an infrastructure container (INFRA), whose purpose is to hold the name space. INFRA also enables Podman to add other containers to the pod. Port bindings, cgroup-parent values, and kernel name spaces are all assigned to the infrastructure container.

Each container in a pod has its own instance of a monitoring program. The monitoring program watches the container's process and if the container dies, the monitoring program saves its exit code. The program also holds open the TTY (Tele Typewriter) interface for the particular container. The monitoring program enables you to run containers in the detached mode when Podman exits, because this program continues to run and enables you to attach TTY later.


What is Podman and how does it differ from Docker? Podman vs. Docker.

Podman is a container management tool for Linux systems. It allows users to create, run, manage, and deploy containers and container images. One of the key differences between Podman and Docker is how they handle the container runtime environment. Key differences between Podman and Docker include:

  • Daemonless: Unlike Docker, Podman does not require a central daemon process (like the Docker daemon – a long-running background process) to manage containers. Each Podman command runs as a separate process, providing a more lightweight and secure container management solution.
  • Rootless Containers: Podman supports running containers as regular users without requiring root privileges. This enhances security by reducing the attack surface and potential vulnerabilities associated with running containers as the root user.
  • Kubernetes Integration: Podman is designed to be compatible with Kubernetes and supports pod-based orchestration, making it easier to work with Kubernetes environments.
  • Namespace Separation: Podman separates container namespaces per process, which can provide finer control over container processes and resources compared to Docker. See: Podman and user namespaces: A marriage made in heaven | Opensource.com.

Key similarities between Docker and Podman, include:

  • Compatibility: Podman is compatible with Docker container images and Dockerfiles, making it easy for users familiar with Docker to transition to Podman without significant changes to their workflows.
  • Networking and Storage: Podman offers flexible networking and storage options for containers, similar to Docker. It supports various networking plugins and storage backends, allowing users to tailor container environments to their specific requirements.

Overall, Podman provides an alternative container management solution that prioritizes security, compatibility, and flexibility, especially in environments where running containers without root privileges is essential.


What is Podman Desktop?

Podman Desktop is an open-source graphical tool enabling you to work with containers and Kubernetes from your local environment seamlessly.

A good overview of Podman Desktop is available on the Red Hat Developers’ Blogs from the OpenShift team, see: What is Podman Desktop? A developer's introduction | Red Hat Developer.


Can I use Podman to run Docker containers?

Yes. The open standards and OCI compliance enable users to use Podman and Docker in compatible environments. It is possible to create a container in either Podman or Docker and modify it using either technology. A quick get started guide is available on the Red Hat Developer’s Blog, see: Transitioning from Docker to Podman | Red Hat Developer.


Is Podman compatible with Kubernetes?

Yes, Podman is compatible with Kubernetes.


Can Podman be used to port containers to OpenShift?

Originating from Red Hat engineering, Podman has been designed to integrate with OpenShift and facilitate moving containers to OpenShift. Podman can be used to port containers to OpenShift. OpenShift is a Kubernetes-based container orchestration platform, and Podman is compatible with Kubernetes. Since OpenShift is Kubernetes-compatible, you can use Podman to build container images and then deploy them onto an OpenShift cluster.

You can find information on how to port containers to OpenShift using Podman in the Red Hat documentation, see: Chapter 13. Porting containers to OpenShift using Podman Red Hat Enterprise Linux 8 | Red Hat Customer Portal.


Why Monitor Podman?

The containers and the applications in the containers launched using Podman Container Engine need to be fast and robust in nature. As continuous access to the containers/applications is the key in modern IT environments, even the smallest slip in the performance of the Podman Container Engine can result in significant impacts. To ensure 24x7 availability of the Podman Container Engine and high-performance, administrators need to closely monitor the performance and status of the Podman Container Engine and its associated components, promptly detect abnormalities, and fix them before dependent services and ultimately end-users notice. eG Enterprise offers a dedicated Podman monitoring model for detecting and fixing such abnormalities at the earliest opportunity.


How can I monitor Podman? What metrics should I monitor for Podman?

eG Enterprise offers a specialized Podman monitoring model that monitors each of the key indicators of the performance of Container Engine - such as the images, pods, containers etc.- and proactively alerts administrators to potential performance bottlenecks, so that administrators can resolve the issues well before end-users complain.

Every layer in eG Enterprise Podman monitoring component is mapped to various tests, each of which report a wealth of useful information related to the Podman container. Using these metrics, administrators can find quick and accurate answers to the following performance queries:

  • Is the Podman service installed?
  • What is the current status of the Podman service?
  • What is the total count of the Podman images in the server? How many images are used to create the containers?
  • What is the disk space utilization of the images that are mapped to the containers?
  • How many containers are created from each image of the Podman Container Engine? How many containers are actually running and how well are the CPU, disk and memory resources are utilized by those containers?
  • How many containers are available in the Podman Container Engine and among them how many containers are currently running? How many containers are added recently and how many are actually removed?
  • What is the uptime of each container?
  • Is the container available over the network?
  • What is the disk space utilization of each container?
  • How well data is transmitted and received from each container?
  • What is the rate of errors that are transmitted through each container?
  • How well the memory is utilized by each container?
  • How well data is read from and written to each container?

Moreover, eG Enterprise also monitors and correlates alerts from dependencies including the Operating System, TCP, and Network Layers. You can read more about eG Enterprise support for Podman in our documentation, see: How to Monitor Podman using eG Enterprise? (eginnovations.com).