Kernel version 3.10 or greater is recommended.
As of libpod 1.3.2 and runc 1.0.0_rc8, there is no built-in kernel config check included. However, the runc upstream provides a method of listing its required kernel configuration via check-config.sh script.
User namespaces have to be enabled in order to use the rootless mode. Also, docker images make use of fuse and overlayfs, these should also be enabled:
General setup ---> -*- Namespaces support ---> [*] User namespace File systems ---> <*> FUSE (Filesystem in Userspace) support <*> Overlay filesystem support
USE flags for app-emulation/libpod Library and podman tool for running OCI-based containers in Pods
||Enable AppArmor support.|
||Enables dependencies for the "btrfs" graph driver, including necessary kernel flags.|
||Enables fuse dependencies (fuse-overlayfs is especially useful for rootless mode).|
||Enables dependencies for running in rootless mode.|
||!!internal use only!! Security Enhanced Linux support, this must be set by the selinux profile or breakage will occur|
emerge --ask app-emulation/libpod
- /etc/containers/registries.conf - Specifies which container registries should be searched for images.
- /etc/containers/policy.json - Defines policies for image validation.
Defaults are provided as /etc/containers/registries.conf.example and /etc/containers/policy.json.example.
Libpod requires the user running podman to have a range of UIDs listed in /etc/subuid and /etc/subgid files. These UIDs are used for mapping the container UIDs to the host UIDs via user namespaces.
It is possible to edit them manually, although the recommended way is using usermod:
usermod --add-subuids 1065536-1131071 --add-subgids 1065536-1131071 larry
The podman tool aims to be a drop-in replacement for docker client provided by Docker. For example, docker run becomes podman run and docker build becomes podman build.
All Container Pod-related actions are accessible via podman pod command.
Not enough namespaces
When running a container an error appears: error creating libpod runtime: there might not be enough IDs available in the namespace.
In this case, increase the number of user namespaces permanently via a kernel setting: