AlmaLinux Cloud Native Overview

AlmaLinux provides a powerful foundation platform for cloud-native applications, including a complete technology stack for containers, Kubernetes, microservices, and other modern application architectures.

Cloud Native Stack Support

Container Technologies

• Podman: a daemonless container engine
• Buildah: a container image building tool
• Skopeo: a container image management tool
• CRI-O: a Kubernetes container runtime

Orchestration Platforms

• Kubernetes: a container orchestration platform
• OpenShift: an enterprise-grade Kubernetes distribution
• Docker Swarm: a lightweight container cluster

Service Mesh

• Istio: a full service mesh solution
• Linkerd: a lightweight service mesh
• Consul Connect: service discovery and configuration

AlmaLinux Cloud Native Advantages

🛡️ Enterprise-Grade Stability

# Check system stability metrics
uptime
# Show system uptime and load

systemctl status
# Check system service status

journalctl --priority=err --since="1 hour ago"
# View error logs from the last hour

🔒 Security Hardening

• SELinux container isolation: provides mandatory access control for containers
• Security scanning support: integrates security scanners such as Trivy and Clair
• Minimized attack surface: streamlined container images reduce security risk

⚡ Performance Optimization

• cgroup v2 support: better resource management and isolation
• Optimized kernel: tuned for container workloads
• Efficient storage: supports high-performance storage such as OverlayFS and ZFS

Container Image Ecosystem

Official Container Images

Image Type	Tag	Size	Purpose
Base image	almalinux:9	~200MB	General development and deployment
Minimal image	almalinux:9-minimal	~100MB	Microservices and lightweight applications
Micro image	almalinux:9-micro	~30MB	Ultra-minimal container applications
Development image	almalinux:9-devel	~400MB	Compilation and development environments

Image Pull Examples

# Pull AlmaLinux images from different registries

# Docker Hub (international)
podman pull docker.io/almalinux:9

# Alibaba Cloud Container Registry (recommended in China)
podman pull registry.cn-hangzhou.aliyuncs.com/almalinux/almalinux:9

# USTC mirror (recommended in China)
podman pull docker.mirrors.ustc.edu.cn/almalinux:9

# Verify the image
podman images | grep almalinux

Multi-Architecture Support

# View supported architectures
podman manifest inspect almalinux:9 | jq '.manifests[].platform'

# Example output:
# {
#   "architecture": "amd64",
#   "os": "linux"
# }
# {
#   "architecture": "arm64",
#   "os": "linux"
# }
# {
#   "architecture": "ppc64le",
#   "os": "linux"
# }

Kubernetes Integration

Node Readiness

AlmaLinux offers the following advantages as a Kubernetes node:

1. Kernel Feature Support

# Check the kernel features required by Kubernetes
grep CONFIG_CGROUPS /boot/config-$(uname -r)
grep CONFIG_NAMESPACES /boot/config-$(uname -r)
grep CONFIG_NET_CLS_CGROUP /boot/config-$(uname -r)

# Verify cgroup support
mount | grep cgroup
ls -la /sys/fs/cgroup/

2. Container Runtime Compatibility

# Install CRI-O (the recommended K8s container runtime)
sudo dnf install -y cri-o cri-tools

# Configure and start CRI-O
sudo systemctl enable --now crio

# Verify the installation
sudo crictl version

3. Network Plugin Support

# Install networking-related components
sudo dnf install -y iproute-tc

# Verify networking functionality
ip link show
modprobe br_netfilter
echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables

Kubernetes Installation Example

Installing with kubeadm

# 1. Install the Kubernetes repository (now migrated to pkgs.k8s.io, organized by minor version)
# Replace v1.31 with the latest stable minor version you need (refer to the official source)
cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.31/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.31/rpm/repodata/repomd.xml.key
EOF

# 2. Install Kubernetes components
sudo dnf install -y kubelet kubeadm kubectl

# 3. Enable kubelet
sudo systemctl enable --now kubelet

# 4. Initialize the cluster (master node)
sudo kubeadm init --pod-network-cidr=10.244.0.0/16 \
                  --image-repository=registry.aliyuncs.com/google_containers

# 5. Configure kubectl
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Cloud Platform Compatibility

Support from Major Cloud Providers

Cloud Platform	AlmaLinux 9	AlmaLinux 10	Image Source	Special Configuration
AWS	✅	✅	Official AMI	cloud-init
Azure	✅	✅	Official image	waagent
Google Cloud	✅	✅	Official image	gce-agent
Alibaba Cloud	✅	✅	Community image	cloud-init
Tencent Cloud	✅	✅	Community image	cloud-init
Huawei Cloud	✅	✅	Community image	cloud-init

Cloud-init Configuration Example

#cloud-config
# AlmaLinux cloud native environment initialization

package_update: true
package_upgrade: true

packages:
  - podman
  - buildah
  - skopeo
  - git
  - wget
  - curl

# Configure container image acceleration
write_files:
  - path: /etc/containers/registries.conf
    content: |
      [[registry]]
      prefix = "docker.io"
      location = "docker.mirrors.ustc.edu.cn"
      
      [[registry]]
      prefix = "k8s.gcr.io"
      location = "registry.aliyuncs.com/google_containers"

runcmd:
  # Enable the Podman service
  - systemctl enable --now podman
  
  # Configure the firewall
  - firewall-cmd --permanent --add-port=6443/tcp  # K8s API Server
  - firewall-cmd --permanent --add-port=10250/tcp # kubelet
  - firewall-cmd --reload
  
  # Tune kernel parameters
  - echo 'net.bridge.bridge-nf-call-iptables = 1' >> /etc/sysctl.conf
  - echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
  - sysctl -p

DevOps Toolchain

CI/CD Platform Support

GitLab CI/CD

# .gitlab-ci.yml example
variables:
  CONTAINER_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG

stages:
  - build
  - test
  - deploy

build:
  stage: build
  image: registry.cn-hangzhou.aliyuncs.com/almalinux/almalinux:9
  script:
    - dnf install -y podman
    - podman build -t $CONTAINER_IMAGE .
    - podman push $CONTAINER_IMAGE

Jenkins Pipeline

pipeline {
    agent {
        node {
            label 'almalinux'
        }
    }
    
    stages {
        stage('Build') {
            steps {
                sh 'podman build -t myapp:${BUILD_NUMBER} .'
            }
        }
        
        stage('Test') {
            steps {
                sh 'podman run --rm myapp:${BUILD_NUMBER} npm test'
            }
        }
        
        stage('Deploy') {
            steps {
                sh 'kubectl set image deployment/myapp myapp=myapp:${BUILD_NUMBER}'
            }
        }
    }
}

Monitoring and Logging

Prometheus + Grafana

# Deploy the monitoring stack
kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/main/bundle.yaml

# Create a Prometheus instance
cat <<EOF | kubectl apply -f -
apiVersion: monitoring.coreos.com/v1
kind: Prometheus
metadata:
  name: prometheus
spec:
  serviceAccountName: prometheus
  serviceMonitorSelector:
    matchLabels:
      team: frontend
  resources:
    requests:
      memory: 400Mi
EOF

Log Aggregation (ELK Stack)

# Deploy Elasticsearch with Podman
podman run -d --name elasticsearch \
  -p 9200:9200 -p 9300:9300 \
  -e "discovery.type=single-node" \
  docker.elastic.co/elasticsearch/elasticsearch:8.11.0

# Deploy Kibana
podman run -d --name kibana \
  -p 5601:5601 \
  --link elasticsearch:elasticsearch \
  docker.elastic.co/kibana/kibana:8.11.0

Performance Benchmarking

Container Performance Testing

# Install benchmarking tools
dnf install -y sysbench fio

# Container startup time test
time podman run --rm almalinux:9 echo "Hello AlmaLinux"

# Container memory overhead test
podman stats --no-stream almalinux:9

# Storage performance test
podman run --rm -v /tmp:/data almalinux:9 \
  fio --name=test --filename=/data/testfile --size=1G --rw=randwrite --bs=4k --runtime=30

Kubernetes Performance Testing

# Install Kubernetes performance testing tools
wget https://github.com/kubernetes/perf-tests/archive/master.zip
unzip master.zip

# Run the cluster load test
cd perf-tests-master/clusterloader2
go run cmd/clusterloader.go --testconfig=testing/load/config.yaml

Best Practices

1. Container Image Optimization

# Multi-stage build example
FROM almalinux:9 AS builder

RUN dnf install -y gcc make
COPY . /src
WORKDIR /src
RUN make build

FROM almalinux:9-minimal

RUN dnf install -y --setopt=install_weak_deps=False \
    ca-certificates && \
    dnf clean all

COPY --from=builder /src/app /usr/local/bin/
USER 1001
EXPOSE 8080
CMD ["/usr/local/bin/app"]

2. Security Configuration

# Run an unprivileged container
podman run --user 1001:1001 almalinux:9

# Read-only root filesystem
podman run --read-only almalinux:9

# Restrict system calls
podman run --security-opt seccomp=default.json almalinux:9

3. Resource Management

# Set resource limits
podman run --memory=512m --cpus=1.0 almalinux:9

# Use cgroup v2
echo 'cgroup_manager = "systemd"' >> /etc/containers/containers.conf

---

Next steps:

• Container Support in Detail - dive deeper into container technology
• Kubernetes Integration Guide - K8s cluster deployment practices