Libpod

From Gentoo Wiki
Jump to: navigation, search
This article is a stub. You can help by expanding it.

Libpod provides a library for applications looking to use the Container Pod concept, popularized by Kubernetes. Libpod also contains the Pod Manager tool - podman.

Unlike Docker, libpod is a daemonless container engine for interacting with OCI Containers. Optionally, a rootless operation mode is provided (see rootless USE flag).

Installation

Kernel

Important
Kernel version 3.10 or greater is recommended[1].

As of libpod 1.3.2 and runc 1.0.0_rc8, there is no built-in kernel config check included. However, the runc upstream provides a method of listing its required kernel configuration via check-config.sh script.

Rootless mode

User namespaces have to be enabled in order to use the rootless mode. Also, docker images make use of fuse and overlayfs, these should also be enabled:

KERNEL Enable support for libpod
General setup  --->
    -*- Namespaces support  --->
        [*]  User namespace
File systems  --->
    <*> FUSE (Filesystem in Userspace) support
    <*> Overlay filesystem support

USE flags

USE flags for app-emulation/libpod Library and podman tool for running OCI-based containers in Pods

apparmor Enable AppArmor support.
btrfs Enables dependencies for the "btrfs" graph driver, including necessary kernel flags.
fuse Enables fuse dependencies (fuse-overlayfs is especially useful for rootless mode).
rootless Enables dependencies for running in rootless mode.
selinux !!internal use only!! Security Enhanced Linux support, this must be set by the selinux profile or breakage will occur

Emerge

root #emerge --ask app-emulation/libpod

Configuration

Files

  • /etc/containers/registries.conf - Specifies which container registries should be searched for images.
  • /etc/containers/policy.json - Defines policies for image validation.

Defaults are provided as /etc/containers/registries.conf.example and /etc/containers/policy.json.example.

Rootless mode

Libpod requires the user running podman to have a range of UIDs listed in /etc/subuid and /etc/subgid files. These UIDs are used for mapping the container UIDs to the host UIDs via user namespaces[2].

It is possible to edit them manually, although the recommended way is using usermod:

root #usermod --add-subuids 1065536-1131071 --add-subgids 1065536-1131071 larry

Usage

The podman tool aims to be a drop-in replacement for docker client provided by Docker. For example, docker run becomes podman run and docker build becomes podman build.

All Container Pod-related actions are accessible via podman pod command.

Troubleshooting

Not enough namespaces

When running a container an error appears: error creating libpod runtime: there might not be enough IDs available in the namespace.

In this case, increase the number of user namespaces permanently via a kernel setting:

FILE /etc/sysctl.d/local.conf
user.max_user_namespaces=15076

See also

References

  1. Container Specification - v1, github. Retrieved on August 11, 2019
  2. [1], man7.org. Retrieved on August 4, 2019