August 2024 - Podman - Podman List Archives

by lejeczek

Hi guys. I experience this: -> $ podman images WARN[0000] RunRoot is pointing to a path (/run/user/1007/containers) which is not writable. Most likely podman will fail. Error: creating events dirs: mkdir /run/user/1007: permission denied -> $ id uid=2001(podmania) gid=2001(podmania) groups=2001(podmania) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 I think it might have something to do with the fact that I changed UID for the user, but why would this be? How troubleshoot & fix it, ideally without system reboot? many thanks, L.

1 week, 3 days

4
11
0 / 0

shouldn't the current directory be the default context for "podman build"?

by Robert P. J. Day

"man podman-build" suggests that the context argument is optional: SYNOPSIS podman build [options] [context] podman image build [options] [context] ... If no context directory is specified, then Podman will assume the current working directory as the build context, which should contain the Containerfile. but if i have a directory with nothing but a Containerfile, i get: $ podman build Error: no context directory specified, and no containerfile specified $ OTOH, specifying context of current directory: $ podman build . STEP 1: FROM alpine:latest ... etc etc ... thoughts? rday

7 months

4
5
0 / 0

Podman Cabal Metting Tues, Sept 3, 2024 at 11:00 a.m. EDT (UTC-4)

by Tom Sweeney

Hey All! The next Podman Cabal meeting will be happening one week from today, on Tuesday, Sept 3, 2024, at 11:00 a.m. EDT (UTC-4). Currently, we only have one topic about issues internal to Red Hat, and happy to take more. Add a topic to the agenda! https://hackmd.io/gQCfskDuRLm7iOsWgH2yrg?both#opensource t

10 months, 2 weeks

2
1
0 / 0

Podman v5.2.2 Released

by Do Not Reply

Hi all, Podman v5.2.2 is now available. You may view the full details at https://github.com/containers/podman/releases/tag/v5.2.2 Release Notes: -------------- ### Bugfixes - Fixed a bug where rootless Podman could fail to validate the runtime's volume path on systems with a symlinked `/home` ([#23515](https://github.com/containers/podman/issues/23515)). ### Misc - Updated Buildah to v1.37.2 - Updated the containers/common library to v0.60.2 - Updated the containers/image library to v5.32.2 This message was generated by an automated system. Replies to the sender will bounce, be ignored and discarded.

10 months, 3 weeks

1
0
0 / 0

Podman v5.2.1 Released

by Do Not Reply

Hi all, Podman v5.2.1 is now available. You may view the full details at https://github.com/containers/podman/releases/tag/v5.2.1 Release Notes: -------------- ### Bugfixes - Fixed a bug where Podman could sometimes save an incorrect container state to the database, which could cause a number of issues including but not limited to attempting to clean up containers twice ([#21569](https://github.com/containers/podman/issues/21569)). ### Misc - Updated Buildah to v1.37.1 - Updated the containers/common library to v0.60.1 - Updated the containers/image library to v5.32.1 This message was generated by an automated system. Replies to the sender will bounce, be ignored and discarded.

11 months

1
0
0 / 0

Podman Swarm

by Daniel Perin Tavares

Hello Podmans, Is there no implementation planned for functionality similar to 'Docker swarm' in Podman? Swarm is so useful for small and medium infrastructures. Daniel Perin Tavares -- Companhia de Saneamento do Paraná www.sanepar.com.br <http://www.sanepar.com.br>

11 months

3
2
0 / 0

new updates of using podman inside k8s

by Larry Cai

Hi: I am used to follow podman setup inside k8s according to article https://www.redhat.com/sysadmin/podman-inside-kubernetes Now 3 years have passed, do we have an updated article for this? I have a vanilla k8s env, and `privileged: true` will not be allowed soon, so what is the easiest way to setup rootless-non-priv environment? apiVersion: v1 kind: Pod metadata: name: podman spec: containers: - name: podman image: registry.access.redhat.com/ubi9/podman command: ["sleep", "infinity"] securityContext: runAsUser: 1000 privileged: true Surely `hostPath` is not allowed as well? In the unix env, i can run `podman run -it -u podman:podman` to get correct env Any suggestions? (i am not security expert to understand), if I remove ` privileged: true` i got below [podman@podman ~]$ podman system info Error: mount /home/podman/.local/share/containers/storage/overlay:/home/podman/.local/share/containers/storage/overlay, flags: 0x1000: permission denied BTW: i only need the build env, maybe `buildah` image shall be used instead (but users are used to use podman command) Rgs, Larry

11 months

2
2
0 / 0

Why podman systemd units are deprecated

by Mehdi Haghgoo

I think podman systemd units were very useful. They allowed me to create reliable containerized services and websites on the server that would auto-restart on server reboot. However, I recently encountered podman inline help showing "deprecated" warning for systemd. Is there now a better alternative for the purpose they used to serve? Best regards, Mehdi

11 months

9
17
0 / 0

Best practices for restricting container network access

by François-Xavier Thomas

Hello all, I was wondering what was the current recommended way to restrict network access of containers? I'm trying to setup a web service via 'podman compose' ; I like most of my web services (proxied through Nginx) to only have access to the lo interface, and while for other services this is done via a systemd unit setting I'm having trouble finding the equivalent for podman. The following rules seem to work (I can also use -s/-d and specify the whole IP range used by containers): iptables -t filter -I NETAVARK_FORWARD -i podman2 ! -o lo,podman2 -j DROP iptables -t filter -I NETAVARK_FORWARD -o podman2 ! -i lo,podman2 -j DROP However, I'm not sure when the NETAVARK_FORWARD table is created (should I even use this table?), and the podman2 interface also does not exist before the network is created (when running 'podman compose up'). Is there a way to run these commands when the containers are brought up, like some kind of pre-up script? Is there a better way of achieving what I'm trying to do? Thanks for your help, François-Xavier

11 months

3
7
0 / 0

Logging to journald from arbitrary processes, not just the main process

by jklaiho＠iki.fi

I've got a bunch of Quadlet-based containers with LogDriver=journald. This correctly captures the stdout/stderr of the main process of the container, and the process output is then viewable using journalctl on the host side. We now have a need to run cron jobs in one of our containers. We're running `podman exec containername python /path/to/script.py` as the job on the host, but the stdout prints from the script are not forwarded to the logging driver. I see two choices: 1. Run the cron scripts as short-lived containers of their own, making them the main process for the duration and presumably causing the journald driver to capture their stdout as expected. IIRC there's a way for systemd to replace cron; what would be the correct method of using Quadlet-based containers here? (We would create a separate quadlet config per script.) 2. Somehow enable arbitrary script runs with `podman exec` against a running container to interface with the journald driver. Is this possible to do?

11 months, 1 week

3
3
0 / 0

2025

2024

2023

2022

2021

2020

2019

Podman August 2024