Welcome folks. This is the august meeting of the St. Louis users group.
We have an interesting presentation tonight, our.
Distant friend from Des Moines. Andrew dinner, who is a.
Software Wong extraordinaire during the day, and.
Software fanatic doing things like this at nights.
Is going to tell us about.
Building.
Oci containers with build.
Stan, you want to.
Carry the meeting stuff for a minute, and then we'll turn it over to Andrew.
To see just some slides here. It talks about our meetings, we from 6 0 6 arrival time. We like people to test their chat.
Their microphones and sound and screen, sharing things like that.
We last meeting we had a little trouble with one of the presenters.
Hey!
Had trouble sharing his screen. So it's a good time, the 1st half hour, to test it out.
We start out at 6 30. We do introductions, announcements.
Talk about other meetings, archives, the calendar mailing list, and call for help if necessary.
And at least by 6, 45. Then we go into the presentation.
And it's up to the presenter. If he wants to have people ask, allow people to ask questions during the presentation, or to hold them till.
Till the end.
And
After that that.
His portion. Further discussion is possible on our mailing list and the.
Since the meeting is being recorded. We're gonna.
Post setup on our archives within a day or so.
James Conroy, who's here? He's our chairman, Gary. Usually here. He's not he usually acts as Mc.
Host. Lee. Lambert introduces.
Our speaker tonight.
I do some production with the slides and recording and junk like that.
And I've gotten filled here to monitor the chat room.
And
As always like to say, we need someone to help find speakers. Gary can't do it all. He tries, but.
He's only one, and as much as we'd like a cologne. It just doesn't happen.
As far as announcements, 5 days from now the 4th Tuesday is going to be the new Linux meeting.
The next meeting after that is usually on the 1st Thursday. The slack meeting.
Our next slug General meeting is on the second Wednesday of each month.
Sean,
Is develop is developing some alternate, and Linux, St. Louis web pages.
And so our website may change in the next month or so.
I'd like to call for any other people.
Have an announcement they'd like to make.
Going, once.
Going, twice.
Moving right along. Do. We have other meetings? And after we mentioned those, we're gonna then do a call for help session.
As I mentioned earlier.
This meeting is St. Louis users group 5 days from now with the new Linux Cruisers Group, and then on the 1st Thursday of the month, the slack meeting.
Our main meeting is on the second Wednesday of the month. That's the general unix Linux meetings.
The this Linux presentation meaning is, is what we commonly do here.
The new Linux meeting is for big beginner workshop. The slack meeting is a configuration workshop.
Those 2 meetings are pretty free format.
We have a.
Presentation archives only the General Meeting and this meeting recordings are archived.
Usually available next.
Day or so.
And
That link goes on. Each of the websites we, the links, are are listed.
And you can go directly to that role.
That page with the resources, presentations, archive.
We have some mailing list, or we have a calendar.
And see if I can.
Share this. I'll try.
Nope, I'm not getting there from here.
Or am I?
Give me a second, Stan. I can bring it up if you can.
Okay. If you would please.
Resources, calendar.
Anyway, our our meetings, our sponsored meetings, are represented in highlighted in red, on that calendar.
Let's see.
There you go!
Alright!
You.
Like, I said. The the red highlights show this meetings that are sponsored by us.
And everything else so.
Is either a.
In St. Louis, and face to face, or even hybrid
Meetings together.
Also, we separately list other.
Oh, open meetings that are.
Across the Internet.
This.
Such meetings as the.
Atlanta lug is on Sundays.
Things like that.
Okay.
Okay. I'd like to go back to me.
See if I can do this.
Okay, and you care to say anything else about those meetings.
Sorry. I just killed it.
That's okay. I'm gonna go back to the.
Slides, real quick.
Quick!
For a quick shot at
Wrong button or wrong button.
Wrong button. There.
We have a.
Couple of mailing lists, he announced, is very limited, usually just meeting instructions
General discussion lists.
I'll discuss opinions, questions, you know, pretty free for.
We opened everything.
We have a steering committee.
Mailing list.
Ish dan.
Yes, sir.
Richard.
Your slides are not on the screen.
Oh, they're not what happened! Oh.
It looks like your zoom.
Pages on the screen.
Good.
Were you using the right computer.
No.
If I was using the correct computer it would know what to do, and it wouldn't even bother listening to me.
Huh!
Since I'm sharing
Oh, we see your your zoom screen.
I know.
What happened?
You're sharing your Firefox, and it's open to zoom.
If you just switch that.
Yeah, I understand. I understand that it's what it's just not doing what I wanted to do.
Never does.
Yeah, and.
Computers. They do exactly what you tell them to do in the most destructive way possible.
Well, that's the problem that that is always a problem. It
Oh!
It is definitely a problem.
Course.
Like everything else. How about this one? There you go!
There you go!
Yeah, you're back.
Alright did announce this discuss list and a steering committee list. We also have a Sys Admin list, but that's for volunteers that are gonna help us do actual work.
Okay.
So if you have Syst Admin questions, you can ask them on the discuss, and more likely that's the best place to ask a general questions.
Okay.
Now.
Before we go any further we can go in a call for help.
Anybody like to talk about the problem they've had this week.
Or complain, or beg for forgiveness.
Or help.
Any problems.
Everybody just dying to get to the presentation is that it.
Okay.
So the talk we have here at this meeting are generally focused on Linux, or either personal or enterprise.
I don't have anything nice to say about the thing I've been working on. So I'm not gonna say anything.
Hopefully, they're more advanced. Important.
Profound, significant blinken lights, that kind of stuff.
Oh!
Okay. Andrew.
Do you want people to hold their questions to the end? Or what.
Feel free to heckle away as much as you'd like. I can't promise that I'll have any answers to the questions, but ask away.
I usually tend to be a fairly informal way of running things, so.
It.
Should be interesting. Let's see, I've got everything all set up here.
And if I click here you should be able to see my
Slide deck, right now.
Not yet.
Do.
Okay. Let me try again. Here.
Oh!
I need to actually say, yes, I want to share.
It makes a world of difference.
Yay!
Okay.
So you guys should be able to see the actual slide deck. Now.
We do?
Thank you.
Alright, awesome.
Hey!
So just as an introduction here, we're going to be talking about how to.
Up your container.
Containerization.
Game.
And we'll do a little bit of a dive. I see it completely trimmed off the
Part of it here. But we're having a deep dive into, build a little bit of what it is, and we believe and have a little bit of compare and contrast to.
Docker and Podman as well, and I'll.
As Gary had requested, I will make sure to define all these for those who have no idea what I'm talking about.
And that's okay, because there's a lot of.
Just random words that we throw into technology here.
So, 1st of all, an introduction.
I'm Andrew Denner. I'm somehow still the president of the Central Iowa Linux Users group. We meet at the 3rd Wednesday of every month.
And we are meeting currently in a hybrid format, hit up our website.
At cialug.org for our meeting, and the link to how to get a hold of everything and all of.
That that magic.
There, and.
We're we're your friendly neighbors to the north, if not just a little bit smaller.
So yeah, by day, I am a senior software, scientific software developer for a.
Large North American
Agricultural Company, called Corteva. It's the old pioneer.
If you've heard of it, and by night I still tinker with all things
Linux and containerization, and all of those things.
So first, st a little bit of information.
So.
We'll we'll dive into it a little bit deeper here in a minute of the difference of what is containerization.
The easiest answer, and the best way that I've found for new people to wrap their minds around it.
Just think of it as almost like a Vm.
That you're running all of your stuff contained inside of this universe in a bottle.
As I'll describe here in a few minutes. It's more complex than that. But you know what we'll get there.
And
Essentially, it cures that problem that all of us have where we say, well, it runs on my computer.
And with this, basically, you pack the the whole.
Stuff that needs to be installed around it, and even somewhat a little bit of the operating system.
And ship it all as one big unit.
And that means that you no longer have to worry about what packages do. I have installed on my machine.
Do I have.
Problem where the Dev machine has
Version 2 of.
Oh! Like.
Something like, Oh, just say that we we have an old version of.
The the compiler there, or something.
One of those big problems like that.
Because it has everything you need, all contained.
Really, the.
Containerization really has nothing new in it.
It's using things like C groups and other Linuxy things all bundled together in one nice package.
Docker. The company really was the 1st ones that brought.
The the Docker Project.
And it.
Sort of most things are kind of named after that.
But, however, in the last few years.
They like many other
Open source companies have decided to be a little more.
Stingy about freely, passing things around.
And so if you're a larger company, or you.
Stuff like that.
There are a lot more strings about running their windows version of it, and they've limited how much you can get into the docker hub to download pre-built containers.
And all sorts of stuff like that. So.
The open source community as a whole have sort of started to move away and branch out.
You've seen a growth of other things like kubernetes, which
Is out of scope for this presentation as well as people saying, You know what I really like it on my local machine. But I don't like Docker. The people.
I'm gonna fork it. I'm gonna take the the bits that I like, and I'm going to take my ball and go play somewhere else.
And that's where you see sort of the Red Hat side of things with Podman and Builder.
Coming in, and we'll dive into those a bit deeper here in a minute.
So again, the containerization. You remember that we're talking about encapsulating all of your code, all the stuff that goes along with it.
And everything you need is completely independent. So.
It can run in all places. You have a copy of Linux, and.
You're you're good to go.
And
So again, this is going to be diving into the.
What is different between a.
Virtual machine sort of your host OS. Is wrapping and.
A lot more of the actual.
Stuff is in this container, and is not shared.
And so this tends to be very much a lot heavier.
But it also allows you to run different systems.
So you can have a.
Host that's running windows, and you can, for whatever reason, run.
Linux, on your your.
Vm container.
And.
The 2 don't mix.
It's a slightly more secure for the fact that you're not sharing your kernel.
So in the the docker and oci world, which will define that here in a minute.
You have a shared host kernel.
And so, if I want to run a different kernel than my host has.
I'm out of luck. I.
Really don't have any choice. What I have is what I have.
But for the most part really, that.
Hurt. I haven't been hindered by that really often.
And at that point, you know, you just have to make some upgrades and.
Or upgrade your host, and things are okay. But.
As you can see, there's a lot less shared.
Which means it's a lot more nimble.
And you can go ahead and cram a lot more containers onto the the host.
Then what you can with a Vm.
Hopefully. All of that is making sense.
But, as you can see, Linux, it really Docker, and the whole containerization world is using.
A bunch of stuff that already existed.
Like a.
Namespaces, C groups.
Networking.
All of those sort of things. It's just they they did a lot better job of packaging it than some of the earlier projects that that started down this path.
Like C root, and other things like that.
Stan, I saw you looked like you had a question, and or Lee.
I always have questions that doesn't necessarily make any sense. But.
Heck!
Okay.
Oh, they they were! Does it make any difference? And I see in your in the.
Representation on the right? Does it kvm, or.
Are.
Virtual box or something else is that make any major difference.
Are, we are, we.
I mean, it makes a world of difference in performance, because I mean, if you're using like open box or something like that.
Just in general it's a lot.
It's running in more of a user space area. Kvm, or.
V. Spear, or any of those sort of things. All are.
Perfectly fine.
The the idea still holds.
Okay, I I see there's a lot of moving parts here and and.
Are, are you gonna be focusing on? I haven't quite a simulated.
What all is interplay here.
Are we focused on the.
The description on model or on the right? Or is it just kinda both.
We're going to be on the model on the left here.
This is just helping to explain the difference between, because, most fairly novice people think of
The the containerization and docker, and all of those things as well. It's just like a Vm.
And I was trying to show that.
No, it hasn't. It uses a lot more of the underlying infrastructure. So it's not quite a Vm.
Okay.
But it still helps to think of it in those sort of terms.
Oh, that explanation helps quite a bit under understanding.
What you're presenting here.
Yep. And really this is just supposed to be sort of the the brief overview before we dive into the deep part here.
Did catch up anyone who wasn't familiar with these sort of things.
And and honestly, my focus sometimes drifts.
Yeah, okay.
That's perfectly okay. I I'm the same way. And I'm trying to present this. So I I get it.
Okay.
Yeah.
Lee did.
And Andrew. What? Back up one sec. What one other comment.
One of the folks that made a comment earlier.
And I'm trying to translate it into something that makes sense to to everybody.
One of the one of the issues or not issues, but one of the facets of a standard container.
Is that it has to be written to the Apis, provided by the host or by the Linux namespaces, or.
Whatever operating environment is running in.
So the question was.
How are the containers different? We know. If you run them on a Linux machine, they have to be built.
For the Apis available on those hosts.
But what about things like Kubernetes are.
Other cloud tools, and and I think.
That's where Oci comes in. But.
I wanted to make sure that
You had that in the back of your mind, Andrew, when you get to those parts of the presentation.
Yep. So basically, to roughly answer that question here quickly, and we can dive into it deeper.
The easiest way to think of. Whenever you hear people talk about Oci.
Their docker containers just.
Everyone's mad at Docker.
So they they've sort of walked away from using the name docker, since so many other things use it.
Even though you still can write docker files.
And do that sort of stuff.
The Oci is the open container initiative.
And
It basically is the standard that all of.
Kubernetes. Basically anything that's using the run C world, which we'll dive into here in another chart here in about 2 slides.
But.
Anybody who's using that sort of paradigm.
It's basically oci.
Is the group that's the open source big tent that everyone's.
Sharing and collaborating in.
Yeah. And those are all.
Linux, right.
So.
Linux Base.
You. There is actually Docker.
That you can run in windows.
If you're using the Linux containers inside of that you can. They've enabled it so that you can develop mostly for like developers and stuff like that.
Like.
If your corporate machine has windows on it. But really under the hood, what's happening is.
There is a virtual machine.
That is running Linux and the the docker in windows is connected up to that, and it.
Sending the commands through. And actually, most of the stuff you'll do is running.
Linux.
There are windows, containers as well, but and those have to be running on.
Windows, machines.
The whole idea, though, is no matter where you're running.
Your containers all use the host, kernel.
So the the core ring, 0 operating system.
Stuff.
Is shared across all your containers.
Which.
Is? Where.
You get a lot of agility there, but also.
Yeah.
If that host kernel gets compromised because there was a vulnerability in it.
Well.
Now all of your containers lost.
Their their isolation essentially, and they have the keys to the kingdom.
And.
In in windows. It's using the the equivalency of the.
Windows. Kernel.
If you're using
A windows container hopefully, that makes sense.
Yeah, I think so. And to answer the question that was that was raised earlier.
Most.
A normal containers. You're running on a on a windows machine.
Are actually Linux running on whistle right?
Yes, running on Whistle or the the older versions of Docker. They they were. They actually spun up a hypervisor which is actually.
Just a hyper container running a a virtual machine.
With a lot of Microsoft special sauce sprinkled over the top of it. So you don't notice.
Cool.
Alright. Thank you, sir.
Okay? So again, why do we want to do this?
It's portable. It's scalable.
It's fault tolerant in the the fact that like, say, for example, if you're using some of the bigger technologies like Kubernetes.
You can have multiple copies of it. If you burn it down and completely crash it.
But whatever you you kill it, it follows the cattle. Not's idea.
Where.
I I get really kind of upset if I lose a cow for my herd.
But really it's not my pet dog.
Where I'm gonna get really tore up and really upset if Fido ends up.
Dying.
And where also is it useful?
It's really useful if you have on-prem processes and you want to move them to the cloud.
Basically, it really helps in forklift.
Shifting the the whole thing.
It's used very heavily in micro services where a lot of these websites you'll see where.
If you go to Amazon.
That deals of the day is one service that the website's loading before it shows it to you.
The videos are a whole and other service, the logins and other service, and each group of developers are working on just their one little tiny corner of the world.
It's really useful in that as well as portability, like, I said, solves the.
Well, it runs on my computer.
It won't run on yours.
Well, it doesn't matter, because it essentially is just running inside of a bottle.
And here's where we're going to talk into a little bit of those other technology stacks.
So, Docker, we've already sort of.
Talked about the the docker company sort of was the the 1st ones that got everything.
If you're running in the Linux world, it is still a community edition and is free.
It's only if you try to use docker desktop.
Where they they.
Start charging you a lot of money.
Now, of course it's great. If you throw money back at open source projects. So.
You should, but.
Shouldn't have to, or 2 different answers.
So.
A lot of different things, said, you know, this is a really great idea. So Kubernetes, the Run Sea world.
All of those sort of things.
Kate.
So? Is everybody mad at Docker.
So the the irritation with Docker is over the years they've started nickel and diming.
Before you said everybody was mad at Docker. Why is everybody mad at.
They? They, like all things, started out first, st where everything was free. You could buy support.
Sort of follow the the world, the the example that.
A lot of open source. Projects have gone with.
However, they also need to pay their bills.
And they so.
They they started, saying, Well, if your company's above size, X.
Now you have to pay per seat to run docker, desktop.
They started, really clamping down on polls per hour. You can use in.
Pulling down pre-built images and stuff like that from their pre-built docker hub.
And just sort of have generally started slowly inching that line.
Closer and closer to the making it painful enough that you want to buy.
The their service.
So that you don't have to.
Deal with the the workarounds anymore.
Are you?
And so.
If that makes sense.
Are you going to cover dust.
So.
Alright, yeah, that makes sense for you to cover desktop. Or is that just a.
Do docker desktop is basically the windows instance of docker.
So if you want to run docker on your windows 11.
Corporate machine that corporate gives you.
And you want to do your development so you can deploy it in the cloud, and all that stuff.
That.
That sort of.
Whole bundle package that makes everything play nice in windows.
Is docker, desktop.
Or on your macintosh, or stuff like that.
And so that that particular tool is the one knob that they started cranking down. Where? Hey? You're you're a corporate developer.
You need windows.
Docker. So.
And your company makes more than X number of dollars.
You're you're now going to have to pay like $15 per seat or so. What? Whatever amount it is at the moment.
So that that sort of whole things left somewhat of a bad taste in people's mouths.
And is why I mean it's somewhat a little glib saying that everyone's mad at them. But.
It did sort of touch off this whole.
Well, fine! I'm going to go do it my my own way.
As well as like Red hat, decided. Hey?
We we want to be more.
Have more control over how things are built and how things are deployed.
And we think we can do a better job. So we're going to build our own.
Thing which is the the pod man.
Sort of space.
Kubernetes basically think of you have a whole bunch of computers all running.
A docker like thing.
And you want to deploy your application into that cluster.
Multiple copies, you can be flexible.
All those sort of things.
And that's a whole and other talk diving into the complexities of Kubernetes.
But basically, it's you want to run a whole bunch of you. You want to run stuff on.
A whole bunch of different computers, and you don't really care which one it's running on.
Because
You. You're running a whole cluster.
If that makes sense.
Sure.
Okay, so.
To help drive that home a little bit. Here.
You've got this image registry that we're we were talking about. Docker. The company is the one that runs.
Most of them or mo most of it.
However, with the fact that they've been clamping down.
Yes, that that was an AI generated.
Image, and it did have some interesting hallucinations.
I.
Those feet are rather terrifying.
If you also notice, it's the truex.
Which I think it was trying to go, for Tux is the name on the side of it, so.
Yeah.
It's amazing what you can get when you ask Copilot to generate some images for you.
But
Diving back here into the the image registry. Basically, that's.
There's a bunch of different images out there that like, say, umbuntu, or centos, or
Take your pick of Linux distribution as well as a bunch of different projects. So like, say, I want to run.
A web server.
I can go out and download the Apache pack container already.
That's been generated out there, so I don't have to worry about building it.
Someone else who's a lot smarter than me has gone out and done it for me.
And, like I was saying, Docker was the the primary folks who were running that sort of.
Thing for the better of the whole community. But.
Unfortunately, bandwidth and disk costs money.
So there have been a few different places that have forked out and sort of.
Either mirror it or.
Have their own set of images.
Amazon Ecr is one of them. They have a lot of public images that you can just download for free.
Way is another one that is basically red hats.
Slash Ibm's, and you pay the money for it, etc.
But the the whole idea is that in the docker.
This Dr. Damon runs as route.
And that that, of course, brings about a whole nother set of heartburn.
Because you have to be in that Docker group.
All commands are basically running inside of the docker Damon, which is running as route.
So if there's a bug or a flaw in there.
And you can pop.
The docker, Damon, you now have keys to the kingdom.
But basically one of the things that was nice enough to do. They? They broke out this sort of runtime.
Into container d, and run c.
And that's a container. Damon.
Which?
A lot of things, and it obviously they they forked into open, sourced a bunch of that stuff and then run C is sort of the
Containerization running thing that interfaces and connects directly to the kernel and the containers and all that stuff.
And it's what.
Kubernetes uses. It's what Podman uses. It's what everyone basically uses.
And that's part of that open container initiatives.
Shared sort of good for for the good of all stuff that they they host.
It's sort of like.
If you've heard of.
Oh, like Apache. And those guys, they, it's basically running in that same big tent sort of world that Apache does.
So there is an alternative. And they later on did come up where you can run, rootless Docker, where you still have a Damon running. But it's now running as your individual user.
And it's a lot more secure. But.
That's not the way most of the world runs. Docker.
So over on the other side.
You have Podman.
Which is.
Completely docker, compatible.
Or at least should be.
There's always edges and dragon. There's always dragons at the edges, and.
You'll probably run into something that that will go wrong.
At some point. If you try hard enough.
But then you have the builder.
Project which is for building those container images which is most of what we're going to be diving into tonight.
And then this run C. Notice how there's no Damon, you're not necessarily running as root.
Although you can run it as route just as well as anything.
Else like that.
Yes,
To to Sean's Point.
Podman.
You are traveling the path less traveled, and there are Gremlins.
But.
Yeah, plus, it's red hat sort of blessed. So of course, there's going to be Gremlins with it.
But yeah. So anyway, though, like most of the examples that I'm going to run tonight.
I'll be running his route because I did something before the meeting here, and totally hosed my.
User account and can't actually run Podman right now with it.
And build a? So yeah.
Did something wrong. I didn't sacrifice nearly enough blood to the demo gods.
So yeah, it's been fun.
But yeah. So anyway, though, we'll build your containers.
It's.
You can run docker.
The the docker files and build them, and podemen actually wholesaleed.
Well.
Borrowed its open source. The bits of build. That do that. So you can build containers inside, Podman as well.
Just not nearly as advanced or doing the shell based stuff that will be showing off here.
Hopefully that makes sense.
So like, I said with Podmin. It's by default.
You can run pseudo stuff.
There's no Damon.
And it's truly free in the fact that no one's charging you money or.
Anything like that should be. But of course.
First.st
Yeah in day, but you can do all sorts of really cool stuff. The system d to schedule your containers to run.
With System D kicking them off and run them as services, so that if they die they can be rebooted. All that sort of stuff.
They also have a lot of compatibility with Kubernetes.
If you're developing kubernetes, you, you can basically use.
The cube control commands locally and.
It will run and generate.
Gamble and understand all those things as well.
But again, as Sean pointed out, there are some greens with this.
Pseudo is.
So grant to clarify. Here. Are you talking about Docker or Podman?
Odd man.
So in pod, man.
Were the 1st bullet on your list.
Yep, so so podman, basically.
You do not need to run sudo if you're running as the user.
And what that will look like is inside of the container.
It will look like it's user route. If you're running as route.
But any of the files that you have mounted into it, or anything like that.
You don't have any more permissions than.
The the actual user account that is running Podman.
So like, say, if I decided to mount into the the container.
It doesn't matter. I can't go to the
The Etsy folder and start editing stuff, where with Docker.
If I'm allowed to mount.
And I'm running is that Damon.
I can mount files that I don't have access to as my individual user.
But because it's root that's doing it.
It has all the keys to the kingdom.
So it can do whatever it wants.
With that file that you mounted into the the container.
Hopefully that makes sense.
Yeah.
It sounds like it's using user namespaces.
Exactly the the and it's using the the sub user. Id sort of stuff.
Which is one of the hiccups that you will run into, depending on.
What
How your user accounts are created on the like corporate level.
If they're they don't have your individual machine with the.
Sub user ids.
Available. You're gonna have trouble.
But since this is a local laptop, and I have full control over it, everything's fine.
So we can go ahead and dive into.
I see the the one slide showing that.
There. There was another slide showing that basically sort of the one universe.
And the the podman builder is the other universe, and that's run by essentially our good friends at Red Hat.
But here we can go ahead and dive into some Demos. Here, I'll just go ahead and flip over to my Demo machine.
And
Okay, use my built-in display.
And here we should be able to see some stuff. And like I said, I'm going to have to flip over.
Let me make this text just a little bit bigger, so that those in the back can see.
And basically with.
We can see.
Into.
Demo.
And here we are.
With a Hello world.
And let's just look at some stuff here. Basically, this is just a your standard.
Rust project that we're going to build some.
Executable of.
And.
Run it in side of a container. So let's go ahead and look at the docker. File.
And basically.
This is a slightly more advanced version of it.
Because, as you can see, I'm I've got 2 containers running here.
The 1st one is basically building. It's a rust.
Bullseye. So it's a Debian based container.
And.
We copy the the files in the current working directory, which we just saw into App.
Change directories into the the app, and then just run cargo, build, and turn it into an executable.
And then from there we build.
Ubuntu, or we use the the ubuntu container just because I like inbound.
And we copy the Hello world, executable.
From the rust container.
Into route there, basically, and then.
Default. Yeah.
Execution is just running.
So if we want to take a look at what is the source code.
Just to prove that there's.
Nothing going on.
It is literally just the hello world.
Example.
And if I could type.
And I jumped one too far.
CD.
Demo.
Let's just go.
So that things will play nice here.
Since I broke everything normally you would not have to do this.
If you hadn't nerved your partition and.
Yeah, given it taken away permission or something like that. So now, as you can see, we are running this route.
So in theory, if you do get out of it, you do have all of the problems that come with running as route.
But let's just go ahead and do.
Add.
Man.
So you could totally just substitute in Docker here, and it would run just as fine.
Thank you.
Assuming you had Docker installed on your your machine.
And yes, I I can't type and talk at the same time. Apparently.
And so that should look like any other thing that you've ever seen with.
The built.
And, as you can see, we don't have it local downloaded, which.
Is odd, because I know I did have that downloaded earlier today, but apparently either they released a new version of it.
Or something.
So we'll have to just.
Did you have it downloaded for user? And now it, you're pulling it down as root.
That very well could be.
But here, as you can see, it downloads.
And now we're going to build.
And it built. It didn't take long at all, and now we have it running. So then you can do
Podman.
Run.
Just like you would a docker container, and we name.
Hit test.
And as you can see, it says, Hello, world.
So!
To answer Sam's question. I'm assuming that you had this installed already. Just be for ease of use.
If you're running it on Ubuntu or Wslbu.
The the easiest way to install Pod.
Would be here if we just go out to and do a Google search for Podman.
There are.
We just land on the the website here.
And if we go to their get started, Page.
BA, basically, they'll
Walk you through.
How, how to download and install everything.
But.
Depending on all the different versions. But, as you can see here, all you have to do is just install it.
The latest version is in all of the Repos. That matter.
So just to prove there's nothing. Fancy going on here.
Well.
Paste.
And, as you can see, I already have it installer.
Hopefully. That answers your question.
Builder will works very much the same way.
When we get to it to install that.
If we do a search for builda.
They actually have.
Of course, the the most terrifying.
Thing.
You know they had here. Oh, and it's on the install page.
Because you should always trust everything here.
As you can see, it does have this option.
But there is actually, I believe, a shell script as well.
I'm not seeing it. I I know this.
This morning I landed on a page that basically you can.
Download! Install script from.
Their website, type it into Sh and.
It just will magically install it, no matter what OS you're using.
Of course, with that comes normal warning of Do not.
Randomly install stuff from the Internet, unless you trust the Internet and.
I think we've all seen enough that you shouldn't trust the Internet.
So yeah, anyway, though.
But I mean, if you can't trust your package maintainers.
Well.
We're.
We're probably in a lot bigger problem.
But.
Hopefully that makes sense. Sam.
But for for the most part.
The demonstration of Bilda was just show that it exists, and that
You can do the Bill building of containers and do all of that stuff.
Sort of in the interest of time here since.
We, we have more examples, and probably more heckling, that.
I I hope we'll be coming at some point here. I can switch back over to.
Our presentation, to talk a little more about.
And.
Yes, let's stop.
Share screen, one.
Okay, and everyone should be able to see the slide deck again.
Okay, seeing Stan nodding, we'll just dive boldly forward here.
And so build a. It actually came before Podman.
And the whole idea is that you can create.
So!
To answer Sam's question. That dockers on your windows machine, but not on Wsl.
If you have Docker installed and you're running docker desktop. It should be bundled along.
Honestly.
Unless you really want to jump ship, I'd recommend.
Not trying to mix the 2, because I I have had some bad experiences.
With that.
But if you have a Vm. Sitting around Sam, that would be a great spot to try this.
Or like. For example, I.
Some of the machines at work I work on are red hat machine. So it just made sense to get used to using
Todd man.
But
Yeah, the the issue Sam, with that is that.
Docker desktop!
At least the modern version of it does use Wsl. Under the hood.
And so it makes that connection and runs.
So that that's why I.
It can be an issue you can actually possibly spin up a different Wsl container.
Because you you can have multiple installs of Wsl.
Stuff. We we can walk through that here at the end of the the night.
During the questions here.
Yeah.
Oh, well, it might not be installed there. We we can totally work through how to do that. Then.
But.
Yeah. So anyway, we'll we'll dive into and troubleshoot that that here.
But so.
Build a.
Basically, the the idea is that it came before.
And
The the idea is that you can use it to build a working.
Basically using an image from a start as a start point, or from just the base
Nothing, for example, that example of using rust.
You can statically compile rust so that.
It will have everything you need, including the muscle c
A.
Core libraries. So that basically, instead of having any operating system at all running there, basically, you're just running as process 0, you're executable.
And we'll talk about. Why would you want to do that? And all of.
Those sort of things as well.
In a bit.
But we'll we'll get into that like, I said, and.
God.
Your images either can be built using. There was a original version of docker format that was a bit older and slightly different, or the newer modern version that most things are now compatible with.
You can build it either way.
For the most part we're just gonna go ahead with the the default.
Because that that works almost everywhere.
And if it doesn't look up the documentation cause it.
It's a little bit.
Interesting. You can also mount a working container's root file system and make modifications in it.
Just on the command line.
You can then unmount it as well, of course, because mounting it without being able to unmount. It is just crazy talk.
And you can also.
Use all of these changes to make a new image.
Delete the old images. So you you can do all of the crud sort of stuff that you'd expect.
What about?
So you said, you can mount the root file system. What about bind mounts? Can you mount.
The bind mounts from one hand to another.
I.
Yes, so well.
Bind mounts
What what I've done with it, because you're you're, of course, using this while you're building stuff.
You. You can do that multi-stage build sort of idea where you've built an executable in one container.
You, you can essentially copy it.
Copy the files from that other container into the new container.
And you can also.
Have multiple containers running basically mounted at the same time and move stuff just with copy commands.
If that makes sense.
Because it just ends up being a happy little folder on your disk system.
Hopefully that makes sense.
But again, basically, we've talked a little bit about the purpose.
And remember that it's using all of the stuff that Docker and others have come before it.
That got all contributed up to the opener initiative. Specifications.
And it makes sure the big benefit of that is, it means that.
All of the other container tools.
Like Docker and Kubernetes, and build or and Podman.
Can use the containers that it generates.
One of the big benefits is that your builder does not require a Damon to run.
Unlike Docker. So it's a lot more lightweight and flexible.
It also means that you can spin it up on your Cicd machine as you're doing like software development. So.
Continuous integration, continuous Development.
It can build your container. You can script everything out.
And.
It just will work.
And that that's why it it makes life a little bit easier. You don't have to worry about. Okay is
Docker installed on the the build machine. All of those sort of things.
But so anyway, though.
Sort of the the next step here will dive into the the roots and.
Nuts and bolts of everything.
So let's go ahead and flip back over to.
Our wonderful Linux machine.
And here we are.
We? We have really nothing happening here. I'm just going to flip.
Through, my.
Notes here, just because.
They're out of order. Okay? So
Let's go back to our Hello. World example.
And the the 1st thing that we totally can do is.
Just run a few
Commands just to make sure that Bill is up and running.
And so we can do things like.
Build a version.
As you can see, it's running and.
It.
Is built off of that dirty stuff called go.
But whatever you you don't ever have to interact with the code, and that somewhat just.
Snide remarks that sarcastically.
Dive.
Go is I hate as a language.
And yes, I do see that they they totally didn't have their clock set right when they built this.
Because it totally was built at a really weird time.
Which would be one second before the the epoch. So.
Yeah, not sure what's going on there.
But yeah, so that that's.
How you can tell what's around and working there.
The.
Thank you for the heckling. James.
So build a a.
And so.
What our other.
Sorry it's info.
And, as you can see, it likes to chuck.
A whole bunch of.
Json.
But, as you can see, some of the underlying stuff, I'm running to 24.
See, groups are version, 2.
I have a little bit of memory, not insane amounts.
It's running that that C run.
Runtime.
And it's an Amd. 64 CPU.
I only have 4 cpus, because this is just a really cheap mystery. Meat
Chinese Laptop.
It's Tigger is the hostname. Why, I don't know. It was a good name at the time, and we're running in Linux, and currently we're running as route.
I've been up for about an hour now.
Which he, I rebooted it before I started this, so that hopefully, we won't have as many problems.
I've got a couple images in the container already.
And yeah.
Fairly easy. Nothing overly crazy here.
So let's just go ahead and build our container like we did in.
Podman, just to prove that we still can. So
Build, a.
Build.
P.
And, as you can see, since I'd already built it, and it was downloaded.
It really just did all of the same things over again.
And one thing to call out here is that.
This is still building, just like Docker, where you have.
Multiple stages. Each command in your docker file is a different layer. We're going to show how you can jump around in that and.
Collapse everything into one layer. It.
Which has some pros and cons. We'll talk about that in a minute, though.
But, as you can see, it's just your your bog standard
Sort of thing.
If we want to look at our.
File and see what happened there. We can do.
Inspect.
And we called it.
Test.
Latest.
And as you can see, it dumps a whole bunch of.
Json to the screen again.
But it will tell you everything about the this container.
And, as you can see, there's a lot there.
But the the big things to remember here is, let's see here.
Where you can see what C group namespaces, options using.
It's not mounting anything. It's not using the network.
I.
It's using a user space and etc.
So nothing crazy here you can see all of the commands that we're running.
Which, again, it's. This is some of the stuff that was originally.
Done by the Mbu container.
And see, it's downloaded.
All of that, and runs all of those sort of things.
And as we get down to where it's doing it, we copied in the
The file. Hello! World!
And then.
Alright!
The 1st thing it does is actually runs. It.
As you can see, it's all in Json, so it's a little bit messy, but.
It basically tells you everything that happened here.
So
One of the things that we we can do is.
Let's say that we have a
Sorry here, flipping to.
Through my notes. Here.
And there is the the note that I wanted.
Apologies. That's what happens when you go through this practice ahead of time.
So!
1 1 of the ideas is that you can.
Use
The sort of base.
Sorry here.
Flipping through to the right spot.
And that didn't. My.
So yeah. Great.
Anyway, though.
One of the things you can do rather than using the the test or your your base image.
Image you can.
Let let me just do one quick search here, because I'm drawing a blank on the name of it.
And it is.
Sorry here, pulling a yet.
But let me quick pull up the the name of it here, because.
Apologies here.
As as charity.
Yeah.
It's.
Okay, so let's quick dive in here
Aye.
Scratch.
That was the name I, because I always think of base, not scratch. But anyway, though here, as you can see, they they dive into
And, if you remember, go packages, everything, including the kitchen sink.
You. You can get away with it without even doing anything.
So we're looking for.
So if we wanted to.
Change, a.
Umbuntu latest to
The one other thing that we need to do here before we do anything else here, while I'm still remembering.
Is as we.
Build it.
Cargo doesn't actually, or rust doesn't actually.
All of the C. And C. Libraries that it links to.
So we need to add a.
So we need to basically include the.
Either the can you see libraries or muscle.
Which is a lot lighter version of it.
We can do. X.
86.
Underscore 64.
Dash.
I know one.
Linux.
Muscle.
And.
Should work.
On the head that should have worked.
Want scratch, not base.
Yeah. Scratch.
Apologies. There.
And that works so much better.
So now, if we wanted to run.
And it should have.
But anyway, though.
The the point is that you need to package. Oh.
I know the problem.
The the issue is that instead of copying it from target, we need to copy it from a different location.
Because it changes where it's located.
Just based off of the fact that it's.
Very nice, and moves all of your different stuff into different locations.
So if you look at target here.
You can see that we have this.
86, 64, Linux, Mus.
And that's where it actually is being built.
And so if we just go ahead and.
Copy that.
And I am failing it.
Clicking.
And so then we go ahead and change where it's being copied instead of debug.
We want to.
And we didn't want to copy all of that.
Because that won't be where it's actually at.
So we want.
Target on.
And I believe it ends up putting it in debug in there. Yes.
Okay.
So we want target.
As you can see here.
And, as you can see, it just ran and built.
And then let's just go ahead and.
Rather than test, and as you can see, it's running.
And if we take a look at.
Actually inspecting the the image.
Image, and its.
Test.
Now, if we're looking here, you can see that.
Basically, all we're doing is copying that file in.
And it runs there. There is nothing else there. And why would we want to do this?
It greatly reduces the lesser or the the vulnerability.
Because if you're packaging a full OS and you have.
Everything but the kitchen.
And you don't actually need stuff like Cp.
Your your area of stuff that can go wrong is greatly increased.
Also. Another thing is that.
This is as small of a container as you can possibly get away with.
No no bigger than the executable itself, with everything bundled in with it that it needs for
The muskie sort of stuff.
And.
The the nice thing there is that you don't have to worry about any vulnerabilities and anything else.
And even if they do pop it open, are able to somehow.
Get a hold of stuff inside that container while you're still within your container, and the only thing there is.
See the executable itself, so.
What are they gonna do with it?
Basically, you see, the whole idea is lightweight, smaller. It's single purpose.
And it just sort of makes life easier.
But let's say you already have this being built as an executable on your Cicd process.
And you distribute it around, and you don't want to have to rebuild it, just to build a docker container or.
Anything like that.
We can totally move into, the the more.
Nuts and bolts of builder. Here.
And I am.
Going to go ahead and.
Let's just go ahead.
With this, and go.
Build.
And we'll pull the container we want to play with. Let's go ahead and use the Alpine
Container, just because it's a nice one to play with.
It's small. It's easy.
And it's lightweight.
So.
Go ahead, and we've already pulled it down.
We can look and see what we've already, what we have in our repository, as well.
And, as you can see, I've pulled down rusty Alpine.
I've got a container called Lug.
And that a bunch of stuff that I've created, that.
Don't have names to them.
That just haven't been cleaned up yet.
And then as well, the test image that we were talking about before.
So let's go ahead and mount Alpine.
One of the ways we can do this is.
Let's just name our variable.
Containers, Ctr.
And we go container equals.
Dover.
So we're executing this. The output of that goes into that container variable.
And what we can do is if we look at it.
It's Alpine working container. One is what it magically gets named.
Whatever. We just let it handle that.
And that's a lot to type. So I like Ctr a lot better.
So.
We want to mount that. Now let's go ahead and.
Build, a.
Mount.
And since this is bash, everything that we're doing here can.
Put into a shell script.
But basically, all we're doing is saying, Hey, go ahead and mount this. So it's just a folder.
And, as you can see, it got mounted into this big, long path that is on the overlay.
And it's there. And we can start doing things.
So now we want to just copy.
That
Executable. That is the Hello world, executable.
And we're just gonna copy it directly in there, so we can do.
Build.
And.
Happy from, let's see, would be.
Source.
Okay, let's build it first, st just to make sure it's there.
Aye.
Cargo.
Build.
Back up my notes. Here.
So build double, dash.
Equals X.
Since this is running muscle.
X 80.
6.
Underscore 64.
Dash.
A known.
Dash.
Linux.
Dash.
MUS.
L.
Parko might not be on roots path. Maybe it's on your users path.
That could be.
Let's just go ahead and solve that problem.
Okay. So then we want to run the same command over again.
Because.
Reasons.
And apparently.
Is, the.
Target x 86 64.
Linux, unknown Linux, muscle.
Just a text string? Or does it actually.
Means something like, is it just convention or.
Actual.
So it means something to cargo.
Because let's just go ahead and misspell it here.
It will tell you that it doesn't have that target.
So if we do.
There you can see all of the different things that you can build it as.
And.
Okay.
A lot of those.
Probably means something to somebody. But yeah,
But you can do cross-compiling with windows.
Depending on. If you want to use the new libraries, or the Microsoft version, or etc.
Or even you can compile it, for osx.
I will!
Apple.
I only compile the Ohs! Sorry about that.
Yeah, there, there's some interesting ones there. But.
MUS.
Just another demonstration. There need the sl. But I realize you were just testing us.
There we go!
Okay, so it built it.
Just to prove it's here.
Let's go back to to
Root.
Typing is hard.
Especially when people are watching.
Okay, so.
Here we are in. Hello! World.
We're going to.
Mount, that.
And then.
We're going to mount Container.
There we go!
And now we want to copy the files from Builda into or from this Hello world.
Into our container. So.
Copy.
And a lot of these commands are fairly similar to what you'd use in docker files.
So here we go into target.
And x 86.
Debug.
Hello, world, and want to put it in.
The world.
And we want copy.
Which, if I'd read my notes, it would have.
And we need to have.
Sorry here. Where do.
Yes.
So the the format is copy.
And then our.
Do, do.
Ctr. Is the name of it. So dollar sign.
There we go!
So it's been copied into there and mounted, and everything is fine.
And I believe we can even do stuff like
Ls lists. The containers, anyway.
So now that we've copied those files into there.
The next thing we want to do is actually build our
Image and store it.
So what you'll want to do is.
You'll death.
Commit.
Yeah. So when you copied that in there, you got that hash back.
And so is that, like the hash of a layer that was just created when we did that.
Yes.
Wow!
Yep. So that that is the hash of a layer that gets created.
So it's basically a programmatic bash way of interacting with the same exact thing you do inside of.
A bat inside of a docker image.
Or docker, file.
So what we can then do is, Docker commit container.
And let's call it.
Test because we're just using that same container name all over again.
We hit, control, or enter here.
And as you can see it
Created up the the image, signatures.
And if you look back here.
So.
The end. 11.
Yeah. I'm not sure how that E, 9 F.
Yeah, I'm.
Not not sure exactly which blob and how the the magic gets made here, but, as you can see, it ends up getting.
Copied and moved in there so.
If we went ahead and looked at.
Our test, latest, again.
You can see that.
We've copied in the the file.
Just as we'd expect.
Yep, there's the the add.
And so.
If we wanted to go ahead and run it.
And we just scroll back up to our pod.
And we wanted to run.
Because we didn't include that command is, we did previously.
So as you can see.
Hello world works, just as we'd expect it to.
So one of the things that I really like for the is that.
If you have a.
Let's go ahead and add in that.
Command here!
So we can say.
Build, a.
Config.
Double dash. Cmd.
And that is going to be our.
Slash!
Hello! World. Again. Here.
And we want to go ahead and add.
In quotes, otherwise it will not like it.
Is that an L or a pipe.
These are 2 l's here. That's a closed bracket.
Oh!
And these are slashes.
Oh, okay.
So it's run from.
Execute, Hello, world.
And we need to.
Tell it which container we want to put this in so.
Ctr.
I couldn't see that was a bracket, because I had the the text.
Bubbles overlaying the.
Top of it.
Yep. Sorry there.
Andrew. If you hit the little minimize bar.
On the.
View. Up here. Yeah.
There we go. Sorry about that.
There you go!
Let's see here, I'll get the.
Text version.
And this is a very picky command here, like you must put it in just the right.
There we go!
Takes at last. That's 1 of the minor annoyances that I found with this is consistency is not one of its better things.
But so okay, we just added the command.
Let's go ahead and add in
An environmental variable, because so those are always nice to add to.
And let's just say.
Oo.
And.
Bar, so that that inside the container now there'll be a environment variable.
Foo that is equal to bar.
And you can do other things like, set the working directory. All those add your username or add set what username it is.
All the things that you can do in a docker file.
You can still do here.
So let's just go ahead and rebuild it.
And one of the other things we can do here. And this is what I really like about is.
As you can see, we have multiple layers. And one of the big issues that you'll always see is.
Some dumb user slash developer will go ahead and copy in way too much. Too many files.
Ian is one of the layers.
And then we'll right away. Go ahead and delete stuff out of it that he doesn't need.
In the next layer. Well, you're now carrying that boat anchor around of all those big files, or maybe even like.
Usernames and passwords, and all sorts of really bad stuff that you shouldn't have in a container that you can see with that inspect command.
What we want to do is one of the things you can do is actually take all these layers and just.
Collapse them down into one.
Layer.
And the.
That's beneficial in the fact that you can make for smaller containers.
But also, if you like, say like, use the the ubuntu base container for all of your work.
Now, instead of one copy of Umbuntu.
Layers.
You now have one copy for each of your containers, with everything in it, including the ubuntu container. So it's hit or miss whether or not. It's a good idea.
But
It's nice for the fact that it does simplify things, and it.
Does sort of cure that problem of.
People doing bad things and having a million line set of transactions.
Where each layer does have a weight and a complexity added to it. If that makes sense.
But what you can do here is.
The command, Squash!
And we want to take it.
You're oop.
And, as you can see now.
If we inspect it.
You only have the the one container.
And so if we go ahead and.
Run it here!
There, there, you can see. And so.
Hopefully that makes sense.
See! How are we doing.
And those you're not making the Hello world executable.
Do you have any idea how that's happening?
So the the Hello world! Executable.
I already had built it on the the host machine.
As
With basically the idea that I built it during my Cic process as a previous step.
And that executable is going to be distributed out to multiple sources and locations.
But we can totally still go ahead with that idea of.
I want to build it in a separate container and copy it across. That's.
Actually a great segue, because that's what I'm going to be showing next.
Actually, I meant, like the permission to execute that file. Usually, when you copy something you have to make it executable before you can run it.
But it seems like you don't have to do that here.
So the one way that I'm getting around that is the fact that.
I'm putting that.
Slash dot there.
Because that's basically saying, Hey, this is an executable. You can run it. But let's just go ahead and take a look at.
That file just to see what it looks like, just to make sure that we're.
Looking right.
Oh, maybe because you're using build a copy instead of the Cp command. I'm used to the Cp. Command, which will not.
If I'm remembering right. Cp. Does not copy.
Permissions like executable, like the execute bit.
But maybe build a copy does maintain the execute bit being set.
And maybe that's why.
Bet that might be.
Cp. Doesn't pop in by default, but you can make it do it.
Yeah.
But, as you can see, it is an executable already.
Any other questions. Long as we're sort of at a.
Pause, point here.
Wait!
Okay, hearing none. Let's go ahead and go with that idea of can I do? A multiple.
Can I ask one more? So on your last podman run, you put the hello world at the end right. But since we set.
That command. You shouldn't have to do that right.
Correct.
I don't. Actually, I don't know if we committed after setting the command. That's what I was.
That's partially what I was wondering.
Yeah, so we.
Oh, you're right. Yeah, we committed right there. But after we squash, I wonder if we.
I don't know.
Yeah, I'm not sure quite what's happening here.
Run.
Well, can't you mount the.
Squash container.
At.
And take a look in it.
And see if Hello! World is in the route thereof.
Yeah, we we can. We can also just.
The Hello world, is there.
So is there.
But the command is not set. It seems like the command to run. That doesn't seem to be.
Yeah.
It does look like.
Okay. So we did run, command.
Wonder? Is it because we have our.
Let's way my notes have it as.
Okay.
Yep.
So you did a commit. You also need to build.
Oh no!
So if you don't need a bill.
So what what I did basically.
So so to go through what I just ran.
So I did. The config command.
And change the the quotes around, because apparently.
It's expecting them to be quotes versus single quotes.
And that that was the big issue.
I also, added Colon, latest, because just on the off chance that it wasn't getting done.
What wasn't copying it correctly.
So that that's there. Now.
And as we run it there you can see. Hello! World is being properly.
Installed.
Hopefully.
And so if I'm if I'm a person who thinks that.
Then if I
If I'm a person that thinks, Oh, well, I'm just gonna look at the docker file that created this container.
And as long as it looks good, then this container must be somewhat safe.
You're, you know, you're pretty much proving that's not true to squash thing right? Because if you push this up to Docker hub right now.
It would have a bunch of stuff that you've done, not being shown in the docker file, that it shows.
Up on Docker I/O. Is that right?
Yeah, essentially, it will show it, as it's just one big tarball of Gui. Goodness.
Okay, so any basically, any container.
On Docker hub, or any container registry could have a ton of malicious stuff.
And they just.
Squash that layer, so you don't know about it, but it could have a ton of malicious stuff in there, and looking at the docker file.
Doesn't really help you under like, know that or not right.
Yeah, yeah. So we're we're used.
Sort of as an example here.
If you look at.
The the build-to-inspect of Alpine.
So as you can see, basically.
Alpine's history. Here the the docker file that went into creating it.
Essentially they, they copy in a.
The the entire file system into slash.
And all of Alpine is right there. Everything you need.
And then they set.
The the command to run as that you want shell. There.
So, looking at the docker file.
You can see that they've already squashed it into just one container.
And you'll see that that happens an awful lot.
If we look at Umbuntu and see what they did.
I feel like there's a flag on the play there.
Analogous to.
I don't see anything that would be qualified as like cryptographic verification.
So my concern would be. I could create.
A malicious image.
That.
Ends up with a.
I presume that's a hash name.
Collision.
And looks like Alpine or Ubuntu, or whatever.
But it is really my own custom, bespoke image.
Masquerading as something that you might.
Trust.
Yeah, so that that layer, that that is one of the concerns.
And as far as well, it's a single versus. There's multiple.
I could repeat that process with the multiple layers.
And even if they're the successive layers are basically no Ops.
And but I'm.
Synthetically making history or inspect show things like you might think a legitimate would have with multiple layers and build and.
Avoiding the squash.
Yeah. So my understanding of how the container layers work, they.
You. You do end up with this file. Hash.
Which is a cryptographically secure hash.
I forget just exactly which. Ver what hashing it's using.
And that that layer that hash is basically used and can be shared across multiple images.
So if you did have a collision, malicious or not.
It would cause issues.
Is the file. I understand that the file name.
Is originally generated.
By taking a hash.
However.
Is there any reason I can't create an image.
With whatever hash it has.
Rename that image.
To another.
String of bytes that looks like a different hash.
And then subsequently included.
And it looks like.
I'm pulling in a different file.
I believe that both the the Container Repository itself.
As well as it's running hashes on things as they come down to validate, that it was actually pulled properly.
As you're building it. Yes, but I'm talking about. If I'm building a.
An image.
From a malicious docker file on my system.
And once I have created my malicious image, and I've uploaded.
And it is a fat image that contains everything.
And hasn't been squashed.
You inspect it, and see.
Values like, you've highlighted there thinking, okay, yeah, those all match. That's.
Good.
But it's bogus data.
Much like I can create.
Tls certificates where.
Damn near everything matches what somebody else uses.
But it is a malicious.
Cert.
If you want to get very, very dark and deep in the weeds.
Yes. So if I'm understanding right, there's.
A couple of things that will go on there one
That that's assuming that you have access and privileges to be able to upload and clobber.
My!
Basically my, my som here. Essentially, that is the.
List of all the layers that are there.
And.
Clapper with to replace out yours.
And also that assuming that.
The the Container Repository that you're uploading stuff to is going to let you.
Load that in and doesn't double. Check your work.
Which I.
I'm pretty sure they they do actually check to make sure that the.
The hashes, match.
And if you did cook the books and upload and say, Hey, this is half, 1, 2, 3, and it wasn't.
The moment you download it.
On the the victim's computer.
It will say, Hey.
The the hash that I downloaded, the one that.
I asked you to send me, so it.
It will throw it out and say it's bad.
Is my understanding of it.
But of course, with all things security, there'd be dragons.
Right, and I'm not so much thinking I'm trying to replace yours. It's more the.
Trojanized freeware of. Hey! I have this great new game that seems really like Candyland.
Because.
It's a copy of Candyland that I've downloaded, and I've put.
A wrapper around, or something.
Yep.
And I upload.
My full image, not the docker file, and I, my understanding, which may be wrong, is the docker file is more like a recipe that you can create.
Things, yourself.
Whereas I can upload a full image.
That you could download and run.
Without.
Building yourself.
Yes.
So that's what I'm saying is, I could cook the books in the image I create.
Upload the image.
With malicious things in it.
Pretending to be.
Legitimate.
Somebody downs ago pay a new free version of Candyland. Yes, please.
And it's really a Trojanized version.
Yep. So that is one of the concerns about grabbing just random.
Images that aren't part of the the official images that that are like, verified and validated, and all that stuff.
Like, for example, the the Apache image. Here.
I'm trusting that Vietnam.
Which was the user that uploaded this, that vmware.
Isn't including any.
Special things there that.
I wouldn't want them to in their container.
So where a lot of that comes into play here, if we grab one of these really low down.
So.
Okay. Apache was a horrible example, because they apparently have been rather prolific. But
Let's go. Engine X.
I can't type to save my life.
But like say so, enginex here.
If
A bunch of these are trusted.
But say, like this, glue Federation engine X.
I'm very much trusting that their.
Not up to any bad stuff.
Or like even this, a big call out, Here is.
The last time this image with Enginex was updated was 2 years ago.
Well, there's been a lot of vulnerabilities, and a lot of bad things have happened.
In 2 years that have been patched.
You don't want to be using this container.
And that gets it.
And, as you can see, only.
4 or 40 people have actually pulled.
That container in the.
I think.
What?
Oh, that's a per day so, or a.
Per range sort of thing. There's been 10 K people. But yeah, so anyway, though.
That that's 1 of those things where no your containers and know what you're building off of.
If you're using like the the base images like Umbu's latest or.
A up to date version of Umbu.
Or Santos, or Debian, or one of those as what you're building off of.
Great if you're using one of those actual.
Projects that are being maintained. So like enginex, if you're actually using.
The the official build of enginex. As you can see, they updated it last.
7 days ago.
Those are the containers you want to be using.
Not not necessarily Bob's best.
Version of Candyland.
Right.
But I would assume that if you downloaded Bob's best candyland.
And you didn't inspect.
As long as it wasn't squashed, and even if it had.
Malicious.
Copycat ids.
That you would actually be able to use that as a recipe.
And have it pull down the real things.
And rebuild it.
Yes.
With.
Non Malicious Copies.
Yes, see you, you should be okay with that.
With a bunch of hand waving that. Yeah, you should never trust anyone. A 100%.
What can I say? I'm paranoid.
Show me a gray beard that isn't.
Yeah, exactly. But yeah, like, here, you can pop into there. Debian Mainlinex.
And you can see how they go about installing it.
Which they're
Putting a bunch of Ampersands here. Basically, they're doing a whole bunch of stuff in one command.
Which means that.
All of that falls into one layer.
Which is nice.
I wonder why us.
So what we did in a recent docker file was, we actually created a script, and we copied the script in.
And.
Ran it, and it still seemed, even though that script had a ton of commands inside. I think it was still one layer.
Yes.
And it's nice, because then you don't have to do all and nonsense with all this, like you just write a regular bash script, you know.
Yep.
So I wonder why they don't. I wonder why that's not more popular? I guess it's just another file to log around, I guess.
Hill.
September.
Yeah. So that's the reason is that your script that is building stuff.
Actually ends up being logged around.
And the the nicety here is that.
You could
Execute that script.
And then remove it as the last step.
And that that would get rid of your your script.
Essentially would be.
Audibility, and.
Visibility into what is purportedly done.
Yeah.
Going out of your way to make.
Your image appear to be more trustworthy.
But I, too, will admit some of my stuff that isn't for public consumption.
Internal use. Sort of stuff that.
Yeah, I've totally done that where I just.
Lobby. I.
Do sh script in and.
Executed.
You know the best. The best is in a gitlab config files. I don't know if you mess with Gitlab at all, but.
I've seen so many get lab cil files where people are putting.
Bash for loops inside of the ammo, and it's just the worst.
I'm like, please just make a make a separate file, and then just call that one. Please.
Yeah.
Let's see other. Yeah. Are there other questions or things that you want to see the other? The last one that I I haven't shown off yet.
Is the how to do sort of that multi-stage build.
To do where you build your your Hello world.
And then you copy it across from one container to another.
But if you can squash, there's no really, there's no reason to do that unless you want a different base. I guess I guess, having a different base would be the reason to do that. One.
Well, I don't see.
One base to build and one base to.
If you have.
What he, his demo, being built is relatively simple.
But think about something much larger, like open Ssl or open Ssh. That has.
A full test suite and a whole bunch of stuff, and you end up with just.
Us.
Much smaller distribution.
Directory, so you could have all that Cruft.
In a build container.
And then copy just the pieces you want.
Into, your.
Shipping container.
The other benefit is that your shipping container.
Doesn't need to have.
Any of the build tools.
So to be able to build your your rust container, or to be all of the stuff included. If you're building a cert thing.
You don't need to install all that stuff into the shipping container.
You, you install it into the build container.
If that makes sense.
Yeah. And I guess what that just it's almost like a dev container at that point, right? So just basically keeps you from having to have that stuff installed on your local machine, your workstation.
Correct.
So.
Like, say, for example, if I was building this on a ephemeral build server.
And wanted to.
May make sure that all the tooling was installed, that that would be one way that you could sort of get around that.
So as an example. Here, let's CD, our way back out a little bit.
So let's go ahead and.
As we scroll up just a little bit.
Let's go ahead and mount.
Let's call it Blde.
And this could be rust. Latest.
And go go fast, Internet.
And I totally should have done this while.
We were waiting. Sorry about that.
Chalk it up to the demo. Gods.
Oh, I know why, because before I was using bullseye.
Slim instead of latest.
So it's a different container.
Okay. So now it's doing those image source checking. And there we go.
And so then.
Let's go ahead and mount.
Act, so.
Then our copy command.
Back, up.
Nothing, and.
Let's just go ahead and copy everything.
To.
In.
Okay. So we went ahead and copied it in.
And then let's run the command.
Run.
Want to set
Config.
Enter, and it be.
App.
Here we go, and then we'll do.
Run. Rum is later, after I get off the call. Here.
And let's do.
Build.
And there you can see it got copied, and then.
Let's go ahead and.
There we go!
And now we do a.
Copy.
Tools.
Build.
It will be.
App.
What is it?
Sorry here. App.
Target.
And then.
Debug.
And.
And I'll get this right at some point before the end of the night.
The build container.
To, our.
Working Container.
And we're copying this file and copying it to Hello, world.
And then from there we'll be able to do the.
Build, a.
Mitt.
Container.
And.
Let's call it.
Test.
Latest.
And there, you can see we've already. We committed it.
And then we just go ahead and do a podman run of test.
And of course we didn't make it executable. So.
Here we are. We just landed in the Root Directory.
And, as you can see, it worked.
Do a long listing, please.
So it is executable.
Yep.
And Dot Slash is really about pathing, not.
Executing things that are not executable.
Yeah, just prove that.
Minus x.
Yep, you are correct.
I stand corrected and.
Yeah.
For giggles try dot space.
Hello, world.
Okay.
The one thing we can look at here is.
Guess it's not in this.
We can do.
Just to show you what's happening here.
And.
As you can see with the the file that's describing what.
What's going on here.
And
The the big call out here is that it's dynamically linked.
And it's using the Ldl. Linker.
That's in lip. 64.
And if we look at.
I would be very curious.
If he went back into the container.
I was reading an article the other day that indicated you might be able to.
Put the path to.
Lib. 64 lds.
The interpreter, space.
The executable.
And run it.
That way.
Okay. So yeah, we'll we'll try that here in one second. But the thing to call out here is the the fact that.
The the muscle.
Target that we built. If you look at the output.
You can see that it was statically linked.
And.
That way. You don't need to have all that other stuff.
Bundled along. But let's just go ahead and give it a try. Long as we're trying to break things.
I am all for breaking things.
So you were talking at.
All the opportunity.
Yeah, I.
I mean, worst case, there's nothing really critical on this machine.
The 64 lds.
Okay.
And it was the context I read that in was dynamically linked. And that's a static binary. So.
So that that particular one that I copied across is a dynamically linked.
Okay.
File.
So let's just go ahead and.
Make it back X again and try that again. Just see what happens.
Yeah, and.
And that is one thing that I.
Have.
One of my biggest problems with containers.
Is the environments I've been in most of them where containers are used.
They are.
Either built or downloaded. Once.
And used for years at a time.
And.
And never in them is updated. They're never replaced.
So they are a snapshot in time.
While the host that they run on is constantly updated, and then people are flabbergasted. Well, how did I have a 4 year old vulnerability.
What's that in container.
Created, downloaded more than 4 years ago.
That's how.
And a lot of places have rules that if your container hasn't been built in so many days, they either.
Auto trigger to rebuild it.
And have. You must restart your containers.
Every so many days, or whatever.
And that that's the one way around it is that.
Your containers and your services shouldn't be running for years at a time.
Without restarting and updating.
But of course that's 1 of those. I say, not as I do sort of things.
I know, I I.
Just as guilty of some of my own pets that.
Shouldn't be pets.
Well, Podman actually has some built in stuff to do.
To. Well, I haven't used it myself, but.
I've read about Podman having some built in stuff where, if you're running your podman containers, the system do services.
It can automatically update them on some kind of schedule which is pretty cool.
Yep, and with that, and that, that's a whole nother talk, which is a very cool talk. But.
Is probably out of scope for tonight. I'm willing to imagine. I'm willing to bet that people at some point want to go to bed here.
But
That.
The using podman and System D to run stuff as services on your machine.
It's really cool. And I'm really excited by it. I I need to actually use it more than I actually do, just because.
You might as well use System D, even though.
It touches off somewhat of a holy war. If you say that you like it.
Speaking of holy war, you know you're talking about going to bed, but nobody can sleep until you and James have it out about rest versus go.
I wanna hear it.
I don't understand Async rust. So that's what I've got. It's a failing on my part.
That's completely a fair thing.
Async. Anything is really one of those paradigm shifts that.
It's hard to wrap your mind around until it.
Isn't.
It's the same thing as like.
Model view controller, programming.
It messed with me for quite a long while, till it didn't.
But to to wrap up here with the rest of my my slide deck.
Just to hammer home the.
If.
I can get back to it.
Okay, here we go hitting share.
And okay, here we are back to.
This slide deck.
Basically just hammering home that.
Billed as single purpose. It does one thing, it does it well, it doesn't do all of the other stuff, and it's compatible, and it's great.
Big issues and concerns just sort of like how they, how.
I believe.
Oh!
Somebody had commented about how they they find edges in Podm.
There are definitely edge cases.
And.
Then also the command line syntax. As you can see, it is a little bit schizophrenic.
And it really, definitely is the road less traveled. So there's less
Really cool stuff there.
But it does help that. You can definitely
Scriptify everything rather than having one magic file.
And yeah, I think we've already beat the the dead horse here with where we've been. I think things will only continue to improve
And having a little bit of diversity in the space, so that no one company owns everything.
Is always a great thing.
And then, of course, see the standard default.
Looking at the.
Comments here just seeing
Yeah, of.
Heckling on.
Yep, go and.
Yeah. Arch vendor. OS.
And then library
And then, of course, Rusty, you can fight a bit.
Whatever. I don't pretend to actually be a very good rust programmer. I I still am.
Firm lover of, and C. Sharp.
Now that that's an open source thing.
But that that again touched off a whole nother war.
Every time I look at C. Sharp they have a new way to create objects, and I just get confused. I just.
Yeah.
Hey? Isn't there a way with? Is it built? Or a pod man where you can like literally executor, make a change, and then like commit that change is that. Do you know about that?
Yes, that that is a builder, that you can go ahead and do that.
And basically you'd.
You can do it either with that run command that I was doing, or I believe it's just exc.
But we can totally quick. Jump back over there and.
Go ahead and try that, because.
I mean. I'll try anything once.
Let's go ahead and jump in. There.
I'll share.
Help if I click right.
Okay, here we are. So let's go ahead and exit.
And let's try.
XCC container.
See what happens. Here.
Okay. So, looking here, there should be some sort of command here. Configuration from.
Images, inspect login log out.
That would be how you can. You log on to your container registry.
If you have a username to push stuff.
Manifest, you can actually edit the manifest itself.
Was it run?
Or.
So run will run the command inside of the container. I mean, that's very similar to how Docker runs.
Yeah. Didn't you run and give it? SH.
You know. And listen. Let's try it.
And.
Search here, history.
So I'm looking so it looks like there's a pod man that takes a dash, dash, change.
And the dash, dash, change takes either command.
Entry point E, and v, etc. So.
Yeah.
That might be so. It might be an argument on the commit.
Okay. So if we do that, let's.
Go and do.
Commit
And we were doing.
Sign.
Cpr. And.
Okay? And then let's just run it.
And there you can see that Foo and Bar were there. So yeah.
Go ahead and do the run and run space. Sh! Because we don't have bash in this container.
And yeah, works just fine.
Because if we echo.
Her cat.
There you can see the stuff that I added.
Wow! That's pretty cool.
Yeah, I didn't even realize you could do that. That's.
Kind of cool.
And after you exit the container like you'd run another command.
Curious, of something.
Yeah. So after I exited the container here.
The other command that I ran was, Build a commit.
Container, so I was committing the changes to.
Right.
This test image.
Right now, I'm saying after year I believe you're in the container.
That you just.
Yes.
After you exit this, when I have a command for you.
Type, mount.
Please.
Okay, so yeah.
There's a whole bunch of what I think are ugly.
Right now.
Yep, and part of that is, I did not stuff. So if you do,
It just cleaned up the the build mound at least.
Alright, and your container, Ctr. Is still mounted. Correct.
Correct. Yeah.
Because we were doing other shenanigans with it, and I didn't wanna have to remount it.
Well, I do have to say, Thank you, though, guys, because
Like like all good presentations.
The presenter has learned a few things, too, while we were
Playing with this, together.
Darn it, we haven't heckled you properly. Then.
But that that's okay. Like most lugs, it's a pretty friendly room, really.
Or a set of rooms.
So that that was the big stuff that I had to show any other questions or thoughts.
We can go back to.
Oh! What was the was it.
Grant that was having issues or.
Damn!
Know somebody else talking about installing.
I believe it was Sam talking about knocker on windows.
Yes, I I'm seeing that here Sam, if you're still around
He's still on.
Yeah, he should. He's still there.
Well. His clients still signed in.
Okay, hearing nothing and seeing no comments from him, I'm assuming he's.
Stepped away from the computer.
Very.
However, if he wants to. Oh.
Okay.
But yeah, if he wants to reach out to me
I I am on both social medias. On Twitter is a dinner.
Or if you want to reach me via email, it's.
Just a dinner at Gmail.
The Lee's question, what happens with the docs?
Project on Podman and builder.
Docker compose is actually just a set of scripts that sort of wrap around some nice to halves inside of docker.
You can get away with. Yes, I I understand the the response of cussing.
At least when I looked at the packages on the Debian based world.
There is a compatibility and.
Actually, with most things there, there is a.
Hotman compatibility layer that basically.
Essentially just aliases Podman.
To the command, Docker.
So whenever you hear and see people.
Yeah.
Okay, that's a good point, James. It's been a while since I've looked at it. I stand corrected.
Dick.
But.
And they did that specifically. So that pod man people I like I'm not. You can't convince me. I think they did that. Just so Podman couldn't use it, because.
For the longest time when Doctor composed was a separate command.
If you have Podmain, they would mock.
Somewhat just work, you know. It wasn't perfect. Obviously.
But now that it's built into the actual docker command, if you don't have Docker installed, you can't run it. And so I.
I think they did that specifically on purpose.
Try to make more. People have Docker installed as opposed to.
Podman, or any alternatives.
There is still a docker dash, compose, command out there that you can run, and for now it's still like works a little bit, but it's, you know. I think it's only a matter of time.
Yeah, I'm sure they're going to break it as well.
But I do know there's a package that you can install in.
Ubuntu and Debian that installs that docker dash, compose.
Script.
And then with the docker compatibility layer, it still does work, I imagine. What's going to end up happening is that Podman's going to build it in.
To to keep their compativeness.
But.
Speaking of reasons why people are angry at Docker. It's stuff like that.
But, Lee, I do feel you're pained.
One solution is to just say, fine. I'm not going to use Docker. Compose at all.
And move to something like kubernetes instead.
Where you can.
Leverage. Similar sort of ideas.
In namespaces and service stuff like that.
Yeah. And that's how I feel about all to be honest for stuff that I'm building like I am creating the container. That's great, like, it works fine.
But as soon as I wanna if I come across something on Github and I just wanna try it out, it's gonna be built using docker. It's gonna have Docker compose to like, spin it up and try it out. And then they're not gonna have built it with Pod man in mind, they're never gonna have tested it with Pod man. And so it's like, you know, 50 50 at that point, whether it's gonna work or not, you know. And it's just.
I am one of those people who's angry at Docker, but I'm also still using Docker because.
I've had so many issues so many times with Podman.
I understand completely and at work on my daily driver. I must confess I do have Docker installed instead of Podvan.
But that's mostly just.
Partially due to inertia.
Because it was already installed before all the shenanigans happened. And I'm lazy.
But I I do have several machines here locally in my house that I do personal stuff on that.
Is, I've totally drank from the the Podman Kool aid and run stuff there just because.
I like to keep my feet in both worlds.
Yeah. And the system d integration is so cool, right? And then, if you go like a step further, like this, quadlets.
Thing where basically you can run.
The podman containers the system to units just by dropping like a quad file in your home directory, or something like that.
And that just seems pretty cool, too, just like a real super, easy way to just run stuff.
But.
So yeah, it's something I wanna look into more. And I really, you know, I just hope the.
Compatibility. Story keeps improving, you know.
And it has improved so much from where it once was.
But.
It still has miles to go.
I also like the the fact that it has compatibility with
Kubernetes, as well.
And so you can run your yaml files, at least in theory, and it will do pods.
Inside of it.
Versus running the the full weight of Kubernetes.
Although I do have a K. 3 s. Instance, which is a whole other talk again.
Alright! Anybody else.
But a bow on it.
Yes.
I suggest bookend Lee, if you would then shut her down.
With recording.
Alright folks. This has been the St. Louis users group meeting on August 24.
For Andrew. Dinner has regaled us for 2 h, and something with all things. Podman Docker, wise and related topics.
And if I can find a button.