{"id":38785,"date":"2019-10-31T22:25:55","date_gmt":"2019-10-31T19:25:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera\/"},"modified":"2019-10-31T22:25:55","modified_gmt":"2019-10-31T19:25:55","slug":"rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","title":{"rendered":"Soovitused Buildah'i k\u00e4ivitamiseks konteineris","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mis on konteinerite t\u00e4itmisruumi jagamise ilu eraldi t\u00f6\u00f6riistade komponentideks? Eelk\u00f5ige see, et neid t\u00f6\u00f6riistu saab hakata kombineerima, et nad \u00fcksteist kaitseksid.<\/p>\n

\"Soovitused
\n
\nPaljusid k\u00f6idab idee koguda konteinerite OCI-pilte raames Kubernetes<\/a><\/noindex> v\u00f5i sarnast s\u00fcsteemi. Oletame, et meil on pidev CI\/CD, mis kogub pidevalt pilte, siis midagi sellist nagu Red Hat OpenShift<\/a><\/noindex>\/Kubernetes \u0431\u044b\u043b\u043e \u0431\u044b \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435. \u0414\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u043f\u043e\u0440 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043b\u044e\u0434\u0435\u0439 \u043f\u0440\u043e\u0441\u0442\u043e \u0434\u0430\u0432\u0430\u043b\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a Docker-\u0441\u043e\u043a\u0435\u0442\u0443 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 docker build. Me oleme juba mitu aastat tagasi n\u00e4idanud<\/a><\/noindex>, et see on v\u00e4ga ebaturvaline, tegelikult on see isegi hullem kui anda paroolita root v\u00f5i sudo \u00f5igused.
\n<\/a><\/noindex>
\nSeet\u00f5ttu p\u00fc\u00fcavad inimesed pidevalt k\u00e4ivitada Buildah'i konteineris. L\u00fchidalt, me l\u00f5ime n\u00e4ide<\/a><\/noindex> kuidas, meie arvates, parim viis on k\u00e4ivitada Buildah konteineris, ja laadisime vastavad pildid \u00fcles quay.io\/buildah<\/a><\/noindex>. Alustame\u2026<\/p>\n

Seadistamine<\/h3>\n

\nNeed pildid on kogutud Dockerfile'idest, mida saab leida Buildah'i hoidlast kaustast buildahimage<\/a><\/noindex>.
\nSiin k\u00e4sitleme stabiilset versiooni Dockerfile'ist<\/a><\/noindex>.<\/p>\n

# stable\/Dockerfile\n#\n# Build a Buildah container image from the latest\n# stable version of Buildah on the Fedoras Updates System.\n# https:\/\/bodhi.fedoraproject.org\/updates\/?search=buildah\n# This image can be used to create a secured container\n# that runs safely with privileges within the container.\n#\nFROM fedora:latest\n\n# Don't include container-selinux and remove\n# directories used by dnf that are just taking\n# up space.\nRUN yum -y install buildah fuse-overlayfs --exclude container-selinux; rm -rf \/var\/cache \/var\/log\/dnf* \/var\/log\/yum.*\n\n# Adjust storage.conf to enable Fuse storage.\nRUN sed -i -e 's|^#mount_program|mount_program|g' -e '\/additionalimage.*\/a \"\/var\/lib\/shared\",' \/etc\/containers\/storage.conf\n<\/code><\/pre>\n
\nKuna we ei kasuta Containeris OverlayFS, mis on hosti Linuxi tuuma tasemel, kasutasime programm FUSE-overlay. , kuna praegu saab OverlayFS m\u00e4lu mountida ainult siis, kui anda talle SYS_ADMIN \u00f5igused Linuxi v\u00f5imaluste kaudu. Me tahame k\u00e4ivitada oma Buildah konteinerid ilma juur\u00f5igusteta. Fuse-overlay t\u00f6\u00f6tab \u00fcsna kiiresti ja on sooritusv\u00f5ime poolest parem kui storage-draiver VFS. Pange t\u00e4hele, et Buildah konteineri k\u00e4ivitamisel, mis kasutab FUSE'i, on vajalik anda seade \/dev\/fuse.<\/a><\/noindex>podman run --device \/dev\/fuse quay.io\/buildahctr ...\nRUN mkdir -p \/var\/lib\/shared\/overlay-images \/var\/lib\/shared\/overlay-layers; touch \/var\/lib\/shared\/overlay-images\/images.lock; touch \/var\/lib\/shared\/overlay-layers\/layers.lock<\/p>\n
Seej\u00e4rel loome kausta t\u00e4iendavate salvestuste jaoks.\n<\/code><\/pre>\n
\nContainer\/storage toetab lisanduvate lugemistegevusega piltide salvestusruumi kontseptsiooni. N\u00e4iteks v\u00f5ib \u00fche masina peal seadistada overlay storage area ning seej\u00e4rel NFS abil mountida selle teisele masinale ja kasutada sealt pilte ilma, et neid alla tuleks laadida. Me vajame seda salvestust, et olla v\u00f5imeline mountima m\u00f5ne salvestuse pildi hostist ja kasutama seda konteineris.<\/a><\/noindex> toetab lisatud read-only piltide salvestusruumide \u00fchendamise kontseptsiooni. N\u00e4iteks saab \u00fchendada overlay salvestusala \u00fchel masinal ja seej\u00e4rel mountida see salvestusruum teisel masinal NFS-i kaudu ning kasutada sealt pilte ilma, et neid tuleb pullida. Me vajame seda salvestusruumi, et saaksime \u00fchendada m\u00f5ne pildi salvestusruumi hostilt ja kasutada seda konteineris.<\/p>\n
# Set up environment variables to note that this is\n# not starting with user namespace and default to\n# isolate the filesystem with chroot.\nENV _BUILDAH_STARTED_IN_USERNS=\"\" BUILDAH_ISOLATION=chroot\n<\/code><\/pre>\n
\nL\u00f5puks, kasutades keskkonnamuutujat BUILDAH_ISOLATION, \u00fctleme, et vaikimisi Buildah konteiner peaks k\u00e4ima chroot-isolatsiooniga. T\u00e4iendavat isolatsiooni siin ei ole vaja, kuna t\u00f6\u00f6tame juba konteineris. Selleks, et Buildah saaks oma konteinerid luua nimede eraldamisega, on vajalik SYS_ADMIN privileeg ning selleks tuleb konteineri jaoks leevendada SELinux ja SECCOMP reegleid, mis on vastuolus meie seadistusega, et teostada koost\u00f6\u00f6d turvalisest konteinerist.<\/p>\n
K\u00e4ivitame Buildah konteineris<\/h3>\n
\nEelnevalt arutatud Buildah konteineri pildiskeem v\u00f5imaldab paindlikult varieerida selliste konteinerite k\u00e4ivitamise viise.<\/p>\n
Kiirus vs turvalisus<\/h4>\n
\nTehniline turvalisus on alati kompromiss protsessi k\u00e4ituskiiruse ja selle \u00fcmber kehtestatud kaitse vahel. See v\u00e4ide kehtib ka konteinerite koostamisel, seet\u00f5ttu vaatame allpool selle kompromissi valikute \u00fcle.<\/p>\n
Eeltoodud konteineripilt hoiab oma salvestust aadressis \/var\/lib\/containers. Seet\u00f5ttu peame sisu sellele kausta \u00fchendama ja see, kuidas me seda teeme, m\u00f5jutab tugevalt konteineri piltide koostamise kiirus.<\/p>\n
Vaatame kolme varianti.<\/p>\n
Variant 1.<\/b> Kui maksimaalne turvalisus on vajalik, saab iga konteineri jaoks luua oma kausta containers\/image ja \u00fchendada selle konteinerisse volume-mount kaudu. Lisaks saab konteksti katalooge ise konteineris paigutada, kataloogis \/build:<\/p>\n
# mkdir \/var\/lib\/containers1\n# podman run -v .\/build:\/build:z -v \/var\/lib\/containers1:\/var\/lib\/containers:Z quay.io\/buildah\/stable\nbuildah  -t image1 bud \/build\n# podman run -v \/var\/lib\/containers1:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah  push  image1 registry.company.com\/myuser\n# rm -rf \/var\/lib\/containers1\n<\/code><\/pre>\n
\nTurvalisus.<\/i> Buildah, mis t\u00f6\u00f6tab sellises konteineris, tagab maksimaalse turvalisuse: sellele ei antud mingeid root-privileege kaudu capabilities ja sellele kehtivad k\u00f5ik SECOMP ja SELinuxi piirangud. Sellist konteinerit saab isegi k\u00e4ivitada User Namespace isolatsiooniga, lisades valiku nagu \u2014uidmap 0:100000:10000.<\/p>\n
T\u00f5husus.<\/i> Kuid siin on j\u00f5udlus minimaalne, kuna k\u00f5ik pildid konteineriregioonides kopeeritakse iga kord hostile, ja vahem\u00e4lu ei t\u00f6\u00f6ta \u00fcldse. Oma t\u00f6\u00f6 l\u00f5petades peab Buildah konteiner saatma pildi registrisse ja h\u00e4vitama sisu hostis. Kui konteineripilt j\u00e4rgmine kord koostatakse, tuleb see j\u00e4lle registrist alla laadida, kuna sel hetkel ei j\u00e4\u00e4 hostile enam midagi.<\/p>\n
Variant 2.<\/b> Kui on vaja Docker'i tasemel j\u00f5udlust, saab hosti container\/storage otse konteinerisse mountida.<\/p>\n
# podman run -v .\/build:\/build:z -v \/var\/lib\/containers:\/var\/lib\/containers --security-opt label:disabled quay.io\/buildah\/stable buildah  -t image2 bud \/build\n# podman run -v \/var\/lib\/containers:\/var\/lib\/containers --security-opt label:disabled  quay.io\/buildah\/stable buildah push image2 registry.company.com\/myuser\n<\/code><\/pre>\n
\nTurvalisus.<\/i> See on k\u00f5ige v\u00e4hem turvaline viis konteinerite koostamiseks, kuna konteineril on lubatud muuta hosti salvestust, ja see v\u00f5ib potentsiaalselt sisestada Podmanile v\u00f5i CRI-O pahatahtliku kujundi. Lisaks tuleb v\u00e4lja l\u00fclitada SELinux'i eraldus, et Buildah konteineris olevad protsessid saaksid suhelda hosti salvestusega. Pange t\u00e4hele, et see variant on siiski parem kui Docker socket, kuna konteiner on blokeeritud teiste turvafunktsioonidega ja ei saa lihtsalt v\u00f5tta ja k\u00e4ivitada m\u00f5nda konteinerit hostis.<\/p>\n
T\u00f5husus.<\/i> Siin on see maksimaalne, kuna t\u00e4ielikult kasutatakse vahem\u00e4lu. Kui Podman v\u00f5i CRI-O on juba vajalikku kujundit hosti alla laadinud, ei pea Buildah-protsess konteineris seda uuesti alla laadima, ja sellele tuginevad j\u00e4rgmised koostamised saavad samuti vajaliku vahem\u00e4lust.<\/p>\n
Variant 3.<\/b> Selle meetodi olemus on \u00fchendada mitu kujundit \u00fchte projekti koos \u00fchise kaustaga konteinerite kujundite jaoks.<\/p>\n
# mkdir \/var\/lib\/project3\n# podman run --security-opt label_level=s0:C100, C200 -v .\/build:\/build:z \n-v \/var\/lib\/project3:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah  -t image3 bud \/build\n# podman run --security-opt label_level=s0:C100, C200 \n-v \/var\/lib\/project3:\/var\/lib\/containers quay.io\/buildah\/stable buildah push image3  registry.company.com\/myuser\n<\/code><\/pre>\n
\nSelles n\u00e4ites me ei eemalda projekti kausta (\/var\/lib\/project3) k\u00e4ivituste vahel, seega kasutavad k\u00f5ik j\u00e4rgmised koostamised projekti raames vahem\u00e4lu eeliseid.<\/p>\n
Turvalisus.<\/i> Midagi vahepealset variantide 1 ja 2 vahel. \u00dchelt poolt ei ole konteineritel juurdep\u00e4\u00e4su hosti sisule ja seega ei saa nad sisestada midagi halba Podman \/ CRI-O kujudesse. Teiselt poolt saab konteiner seoses oma projektiga teistes konteinerites koostamisse sekkuda.<\/p>\n
T\u00f5husus.<\/i> Siin on see halvem kui hosti tasemel \u00fchise vahem\u00e4lu kasutamisel, kuna ei saa kasutada juba varem Podman \/ CRI-O vahenditega alla laaditud kujundeid. Kuid p\u00e4rast seda, kui Buildah on kujundi alla laadinud, saab seda kasutada k\u00f5igis j\u00e4rgnevates koostamistes projekti raames.<\/p>\n
Lisa salvestused<\/h4>\n
\nUus containers\/storage<\/a><\/noindex> On olemas \u00fclihea asi nagu t\u00e4iendavad salvestused (additional stores), mille abil konteinerimootorid saavad konteinerite k\u00e4ivitamise ja koostamise ajal kasutada v\u00e4liseid pildisalvestusi ainult lugemisre\u017eiimis. Lisaks saab faili storage.conf lisada \u00fche v\u00f5i mitu \u201eainult lugemiseks\u201c salvestust, et konteinerimootor otsiks neid vajadusel pildist k\u00e4ivitamisel. Seej\u00e4rel laadib ta pildi registrist ainult juhul, kui ei leia seda \u00fchelgi nendest salvestustest. Konteinerimootor suudab kirjutada ainult kirjutamiseks saadaval olevatesse salvestustesse\u2026<\/p>\n
Kui kerida tagasi \u00fcles ja vaadata Dockerfile'i, mida kasutame quay.io\/buildah\/stable pildi koostamiseks, on seal sellised read:<\/p>\n
# Adjust storage.conf to enable Fuse storage.\nRUN sed -i -e 's|^#mount_program|mount_program|g' -e '\/additionalimage.*\/a \"\/var\/lib\/shared\",' \/etc\/containers\/storage.conf\nRUN mkdir -p \/var\/lib\/shared\/overlay-images \/var\/lib\/shared\/overlay-layers; touch \/var\/lib\/shared\/overlay-images\/images.lock; touch \/var\/lib\/shared\/overlay-layers\/layers.lock\n<\/code><\/pre>\n
\nEsimeses reas muudame konteineripildi \/etc\/containers\/storage.conf, \u00f6eldes storage-draiverile, et kasutaks \u201eadditionalimagestores\u201c kaustas \/var\/lib\/shared. J\u00e4rgmises reas loome jagatud kausta ja lisame paar lukufaili, et v\u00e4listada container\/storage'ilt tulevad vead. Tegelikult loome lihtsalt t\u00fchja konteerimisruumi. <\/p>\n
Kui mountida containers\/storage selle kausta taseme v\u00f5rra k\u00f5rgemal, suudab Buildah kasutada pilte.<\/p>\n
N\u00fc\u00fcd naaseme varem k\u00e4sitletud variandi 2 juurde, kus Buildah konteiner suudab lugeda ja kirjutada containers\/store'is hostidel ning seega saavutab maksimaalse j\u00f5udluse piltide vahem\u00e4llu salvestamise kaudu Podman\/CRI-O tasemel, kuid see annab minimaalset turvalisust, kuna v\u00f5ib kirjutada otse salvestustesse. N\u00fc\u00fcd l\u00fclitame siia sisse t\u00e4iendavad salvestused ja saame parima m\u00f5lema maailma.<\/p>\n
# mkdir \/var\/lib\/containers4\n# podman run -v .\/build:\/build:z -v \/var\/lib\/containers\/storage:\/var\/lib\/shared:ro -v  \/var\/lib\/containers4:\/var\/lib\/containers:Z  quay.io\/buildah\/stable \n buildah  -t image4 bud \/build\n# podman run -v \/var\/lib\/containers\/storage:\/var\/lib\/shared:ro  \n-v >\/var\/lib\/containers4:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah push image4  registry.company.com\/myuser\n# rm -rf \/var\/lib\/continers4\n<\/code><\/pre>\n
\nPange t\u00e4hele, et hosti \/var\/lib\/containers\/storage on mountitud konteineris \/var\/lib\/shared lugemisre\u017eiimis. Seet\u00f5ttu saab Buildah t\u00f6\u00f6tades konteineris kasutada k\u00f5iki juba varem Podman\/CRI-O vahenditega alla laaditud pilte (tere, kiirus), kuid kirjutada saab ainult oma salvestusse (tere, turvalisus). Samuti pidage meeles, et seda tehakse ilma SELinux'i eraldusjoont konteineris v\u00e4lja l\u00fclitamata.<\/p>\n
Oluline n\u00fcanss<\/h4>\n
\nIgal juhul ei tohi kustutada \u00fchtegi pilti madalamast salvestusest. Vastasel juhul v\u00f5ib Buildah konteiner crashida.<\/p>\n
Ja see ei ole sugugi k\u00f5ik eelised<\/h4>\n
\nT\u00e4iendavate salvestusv\u00f5imaluste v\u00f5imalused ei piirdu ainult \u00fclaltoodud stsenaariumiga. N\u00e4iteks saab k\u00f5ik konteineripildid paigutada \u00fchte \u00fcldisesse v\u00f5rgu salvestusse ja anda sellele ligip\u00e4\u00e4su k\u00f5igile Buildah-konteineritele. Oletame, et meil on sadu pilte, mida meie CI\/CD s\u00fcsteem regulaarselt kasutab konteinerit\u00fc\u00fcpide kogumiseks. Kogume k\u00f5ik need pildid \u00fchel host-salvestusel ja avame siis, kasutades eelistatud v\u00f5rgu salvestusmeetodeid (NFS, Gluster, Ceph, ISCSI, S3...), selle salvestuse \u00fchise ligip\u00e4\u00e4su k\u00f5igile Buildah'i v\u00f5i Kubernetes'i s\u00f5lmedele.<\/p>\n
N\u00fc\u00fcd piisab, kui monteerida see v\u00f5rgusalvestus Buildah konteineris aadressile \/var\/lib\/shared ja k\u00f5ik \u2013 Buildah konteinerid ei pea enam kunagi pilte l\u00e4bi pull-i alla laadima. Nii et me kaotame eelt\u00e4iendamise etapi ja oleme kohe valmis konteinerite v\u00e4lja laskmiseks.<\/p>\n
Ja loomulikult saab seda kasutada olemasoleva Kubernetes s\u00fcsteemi v\u00f5i konteinerite infrastruktuuri raames, et k\u00e4ivitada ja t\u00f6\u00f6delda konteinerite kuskil ilma igasuguste pull-piltide allalaadimist. Veelgi enam, konteineriregister, kui see saab postitamissoovi \u00fcles laadida uuendatud pilti, v\u00f5ib automaatselt saata selle pildi \u00fchisesse v\u00f5rgusalvestusse, kus see on koheselt kergesti k\u00e4tte saada k\u00f5ikidele s\u00f5lmedele.<\/p>\n
Konteineripiltide suurused v\u00f5ivad m\u00f5nikord ulatuda mitme gigabaidini. T\u00e4iendavate salvestuste funktsionaalsus v\u00f5imaldab v\u00e4ltida selliste piltide kopeerimist s\u00f5lmedesse ja muudab konteinerite k\u00e4ivitamise praktiliselt koheseks.<\/p>\n
Lisaks t\u00f6\u00f6tame hetkel uue overlay volume mounts funktsiooni kallal, mis teeb konteinerite koostamise veelgi kiiremaks.<\/p>\n
Kokkuv\u00f5te<\/h3>\n
\nBuildah'i kasutamine konteineris Kubernetes\/CRI-O, Podman v\u00f5i isegi Docker keskkonnas on t\u00e4iesti v\u00f5imalik, ning see on lihtne ja palju turvalisem kui docker.socket'i kasutamine. Oleme oluliselt suurendanud paindlikkust piltidega t\u00f6\u00f6tamisel ning n\u00fc\u00fcd saate neid k\u00e4ivitada erinevatel viisidel, et saavutada optimaalne tasakaal turvalisuse ja j\u00f5udluse vahel.<\/p>\n
T\u00e4iendavate salvestuste funktsionaalsus v\u00f5imaldab kiirendada v\u00f5i isegi t\u00e4ielikult kaotada piltide allalaadimise s\u00f5lmedesse.
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0447\u0435\u043c \u043f\u0440\u0435\u043b\u0435\u0441\u0442\u044c \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u044b \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435? \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043a\u043e\u043c\u0431\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u043e\u043d\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u043b\u0438 \u0434\u0440\u0443\u0433 \u0434\u0440\u0443\u0433\u0430. \u041c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0438\u0434\u0435\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0441\u0431\u043e\u0440\u043a\u0443 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 OCI-\u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 Kubernetes \u0438\u043b\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0414\u043e\u043f\u0443\u0441\u0442\u0438\u043c, \u0443 \u043d\u0430\u0441 \u0435\u0441\u0442\u044c CI\/CD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0437\u044b, \u0442\u043e\u0433\u0434\u0430 \u0447\u0442\u043e-\u0442\u043e \u0442\u0438\u043f\u0430 Red Hat OpenShift\/Kubernetes \u0431\u044b\u043b\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38785","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Soovitused Buildah'i k\u00e4itamiseks konteineris | ProHoster","description":"Millised on konteinerite k\u00e4itusaja keskkonna eraldamise eelised erinevate t\u00f6\u00f6riistakomponendina?","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0443 Buildah \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 | ProHoster","og:description":"\u0412 \u0447\u0435\u043c \u043f\u0440\u0435\u043b\u0435\u0441\u0442\u044c \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u044b \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435?","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:25:55+00:00","article:modified_time":"2019-10-31T19:25:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38785","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 23:24:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:03:14","updated":"2026-01-23 23:24:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=38785"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38785\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/29093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=38785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=38785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=38785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}