Podman

From Gentoo Wiki
(Redirected from User:Yuri69/Drafts/libpod)
Jump to:navigation Jump to:search
This article is a stub. Please help out by expanding it - how to get started.

podman is a daemonless container engine for developing, managing, and running OCI Containers on linux.

podman aims to be a drop-in replacement for docker for most user applications running docker images, setting alias docker=podman should be enough for most pipelines to switch to podman[1]. buildah and skopeo are other tools which provide the other parts of the docker stack not provided by podman, such as building and distributing images[2].

Installation

Kernel

Important
Kernel version 3.10 or greater is recommended[3].

As of podman 1.3.2 and runc 1.0.0_rc8, there is no built-in kernel config check included. However, the runc upstream provides a method of listing its required kernel configuration via check-config.sh script

Note
Some of the config options from the check-config.sh script are deprecated. They are safe to ignore.

Rootless mode

Configure the kernel

user namespaces have to be enabled in order to use the rootless mode. Many docker images make use of fuse and overlayfs, which also need to be enabled. The tun kernel module also needs to be available and loaded for allowing rootless mode to access networking.

KERNEL Enable support for podman
General setup  --->
    -*- Namespaces support  --->
        [*]  User namespace
File systems  --->
    <*> FUSE (Filesystem in Userspace) support
    <*> Overlay filesystem support
Device Drivers --->
    -*- Network device support --->
        -*- Network core driver support --->
            <*/M> Universal TUN/TAP device driver support
Load required modules

If the tun module is not built into the kernel, it needs to be loaded manually:

FILE /etc/modules-load.d/networking.confLoad tun module
tun
Configure subuid/gid

podman requires the user to have a range of UIDs listed in /etc/subuid and /etc/subgid files. These UIDs are used for mapping the container UIDs to the host UIDs via user namespaces.

An overview for the recommended configuration of subuid/subgids is given in the wiki - Subuid subgid.

USE flags

USE flags for app-containers/podman Library and podman tool for running OCI-based containers in Pods

apparmor Enable support for the AppArmor application security system
btrfs Enables dependencies for the "btrfs" graph driver, including necessary kernel flags.
cgroup-hybrid Default to hybrid (legacy) cgroup hierarchy instead of unified (modern).
fuse Enables fuse dependencies (fuse-overlayfs is especially useful for rootless mode).
init Enables catatonit dependency required for podman run --init.
rootless Enables dependencies for running in rootless mode.
selinux !!internal use only!! Security Enhanced Linux support, this must be set by the selinux profile or breakage will occur
Data provided by the Gentoo Package Database · Last update: 2023-05-09 05:16 More information about USE flags

Emerge

It is recommended to use app-containers/crun as the OCI runtime provider, bug #723080.

root #emerge --ask --oneshot app-containers/crun app-containers/podman
root #emerge --ask app-containers/podman

Configuration

Files

  • /etc/containers/registries.conf - Specifies which container registries should be searched for images.
  • /etc/containers/policy.json - Defines policies for image validation.

Defaults are provided as /etc/containers/registries.conf.example and /etc/containers/policy.json.example.

Usage

The podman tool aims to be a drop-in replacement for docker client provided by Docker. For example, docker run becomes podman run and docker build becomes podman build.

All Container Pod-related actions are accessible via podman pod command.

Sets the tcp API service daemon

FILE /etc/conf.d/podman
#SOCKET="unix:/run/${RC_SVCNAME}/podman.sock"
SOCKET="tcp://localhost:12979" # this port is an example, choose whatever you want

Exposing containers to local network

By default, podman works in bridge mode with a separate cni-podman0 bridge, and then requests are translated to local network via NAT. It is possible, only for root, to give pods/containers real ips on the local network using macvlan mode.

First enable and start the cni-dhcp daemon:

root #rc-update add cni-dhcp default
root #rc-service cni-dhcp start

Add a new network config for podman to support macvlan networks.

FILE /etc/cni/net.d/88-macvlan.conflist
{
  "cniVersion": "0.4.0",
  "name": "macvlan",
  "plugins": [
    {
      "type": "macvlan",
      "master": "br0",
      "isGateway": true,
      "ipam": {
        "type": "dhcp"
      }
    },
    {
      "type": "portmap",
      "capabilities": {
        "portMappings": true
      }
    },
    {
      "type": "firewall"
    },
    {
      "type": "tuning"
    }
  ]
}

Here it is assumed that there is an externally configured bridge br0 already in existence. An example of such a configuration is available in the wiki - Network_bridge#Single_NIC_bridge. It is also possible to use an existing ethernet device, such as enp5s0f0 and attach to it.

Now it is possible to create a pod with this network:

root #podman pod create --name homeserver --network macvlan

To validate that the pod has the proper configuration, an alpine test container can be run inside this pod:

root #podman run -dt --pod homeserver --name alpine_test docker.io/library/alpine:latest top
root #podman exec alpine_test ifconfig

eth0      Link encap:Ethernet  HWaddr 3A:09:C6:B8:7F:DB
          inet addr:192.168.2.121  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fe80::3809:c6ff:feb8:7fdb/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:121 errors:0 dropped:0 overruns:0 frame:0
          TX packets:25 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:31480 (30.7 KiB)  TX bytes:2402 (2.3 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Troubleshooting

Not enough namespaces

When running a container an error appears: error creating libpod runtime: there might not be enough IDs available in the namespace.

In this case, increase the number of user namespaces permanently via a kernel setting:

FILE /etc/sysctl.d/local.conf
user.max_user_namespaces=15076

Slow storage in the rootless mode

Check the used storage driver:

user $podman info

If the reported storage driver is vfs, you might want to switch to a faster overlayfs.

See Choosing a storage driver

See also

References

  1. ↑ What is podman?. Retrieved on January 17, 2021
  2. ↑ A Comprehensive Container Runtime Comparison, Retrieved on January 18, 2021
  3. ↑ Container Specification - v1, github. Retrieved on August 11, 2019
Retrieved from "https://wiki.gentoo.org/index.php?title=Podman&oldid=1215036"