linuxexpert-practice-labs/labs/linux-plus/2-6-2-running-containers/README.md

Linux+ 2.6.2: Running containers

Running a rootless web server container, looking inside it, and seeing how rootless containers map users to the host.

Before you start

The VM needs internet access to pull images. The lab installs Podman and creates user alice (password Lab-Pass-1), with lingering turned on so her user services run. Do every task as alice: log in as her, or use sudo -iu alice and then export XDG_RUNTIME_DIR=/run/user/$(id -u). Write answers to files in alice's ~/answers/ directory (make it first). Docker Hub limits anonymous pulls; if you hit the limit, mirror.gcr.io/library/nginx:1.30 is the same image.

Tasks

1. Run nginx:1.30 in the background as a container named web, with host port 8080 forwarded to its port 80 and the variable TZ set to UTC. Check it with podman ps, curl and its logs. Leave it running.
2. Get a shell inside web and look around (id, /etc/os-release, $TZ), and look at it with podman top and podman inspect. Write the NAME from the container's /etc/os-release to ~/answers/2.
3. Find the nginx main process on the host side and see which user it runs as, then look at the user namespace's UID map and /etc/subuid. Write the host UID that UID 1 inside alice's containers maps to (the start of her subordinate range) to ~/answers/3.

Hints

• podman run -d --name -p 8080:80 -e TZ=UTC docker.io/library/nginx:1.30, curl -sI http://127.0.0.1:8080, podman logs.
• podman exec -it web sh, podman top web, podman inspect web --format '{{.State.Status}} {{.State.Pid}} {{json .Config.Env}}'.
• ps -o user,pid,cmd -p PID, podman unshare cat /proc/self/uid_map, grep alice /etc/subuid.
• The chapter's step 4 (stop, start, remove) isn't graded: try it when you're done.