- Podman - Podman List Archives

"Connection refused" from inside containers to the host's public IP
by jklaiho＠iki.fi 21 Jun '23

21 Jun '23

Hi all, We have a bunch of rootless containers running as a non-privileged user on a Ubuntu 22.04 server under Podman 4.5.0. One of them is running Browserless Chrome to render PDFs of the output of a Django-served URL of another container. The Django container is set up so that its CSS/JS/etc. static files are stored on the host machine and served by the host's Nginx. To correctly display the styles, Chrome therefore needs to access the endpoint via the public URL of the site. This is not working, because any connection attempts to the public IP from within any of the running containers fail with a Connection Refused error: - - - - $ curl -vvv https://our.nice.site * Trying <redacted IPv6>:443... * connect to <redacted IPv6> port 443 failed: Connection refused * Trying <redacted IPv4>:443... * connect to <redacted IPv4> port 443 failed: Connection refused * Failed to connect to our.nice.site port 443: Connection refused * Closing connection 0 curl: (7) Failed to connect to our.nice.site port 443: Connection refused - - - - The host itself is, of course, able to access itself with the public URL/IP just fine; this only occurs inside the containers. The containers are also able to access any other public URL, just not the one pointing to the host's own public IP. We're using pasta networking. All containers are set up with quadlet. Here's the Chrome container's quadlet generator: - - - - [Unit] Description=Browserless Chrome Wants=network-online.target After=network-online.target [Container] Image=browserless/chrome:1.59.0-chrome-stable ContainerName=browserless-chrome Network=pasta:-t,auto,-T,auto LogDriver=journald [Install] WantedBy=default.target - - - - All the other containers also use "Network=pasta:-t,auto,-T,auto". I tried to add --map-gw to the command line, since it seemed possibly relevant, but without success. "Network=pasta:--map-gw,-t,auto,-T,auto" failed on container startup with this error: Error: failed to start pasta: Port forwarding mode 'none' conflicts with previous mode "Network=pasta:-t,auto,-T,auto,--map-gw" started the container fine, but did not fix the Connection Refused error. Finally, the contents of containers.conf: - - - - [containers] log_driver="journald" tz="local" [network] network_backend="netavark" [engine] runtime="crun" - - - - Is this a bug, a misconfiguration on my part, or an intentional security feature of Podman networking and/or Podman with pasta, specifically? Is there any way for the containers to access the hosts's public IP? If not, we'll need to arrange some kind of awkward static file serving container for use by the Chrome container, but we'd really like to avoid that. - JL

2 1

Wordpress container running on mac cannot create theme directory on mounted path
by Mehdi Haghgoo 20 Jun '23

20 Jun '23

Hi, I am running the following compose file with Docker Compose backed by Podman Machine on mac (Intel): services: db: image: docker.io/library/mariadb:10.5 environment: - MYSQL_DATABASE=mydb - MYSQL_USER=wpuser - MYSQL_PASSWORD=mypass - MYSQL_ROOT_PASSWORD=mypass volumes: - wpdb_vol:/var/lib/mysql wp: image: docker.io/library/wordpress:php8.2-apache environment: - WORDPRESS_DB_NAME=mydb - WORDPRESS_DB_USER=wpuser - WORDPRESS_DB_PASSWORD=mypass - WORDPRESS_DB_HOST=db depends_on: - db ports: - 8000:80 volumes: - .:/var/www/html - wp_uploads:/var/www/html/wp-content/uploads adminer: image: docker.io/library/adminer:4.6 ports: - 8080:8080 volumes: wp_uploads: {} wpdb_vol: {} When running the containers, in WordPress admin page, I cannot install a plugin. Basically, the container is not allowed to create directories under wp-content. It fails with permission error: "Could not create directory /var/www/html/wp-content/upgrade/oceanwp-3.4.4/oceanwp" I tried chmod 777 on all wp-content (with -r), but it didn't help. Not sure if this is a Podman issue or a due mechanism that needs to be properly handled. How can I fix this? Mehdi

3 4

exec - shell functions ?
by lejeczek 20 Jun '23

20 Jun '23

Hi guys. How do you 'exec' your container shell functions without going into shell interactively? many thanks, L.

3 4

fcontext for rootfull volumes ?
by lejeczek 16 Jun '23

16 Jun '23

Hi guys. I map /root very often - I'd imagine many do - and I do that with Z What I get is quite puzzling to me, say host has it: system_u:object_r:container_file_t:s0 bin system_u:object_r:container_file_t:s0:c526,c622 cacert.p12 system_u:object_r:container_file_t:s0:c526,c622 kracert.p12 system_u:object_r:container_file_t:s0:c74,c78 pki in container: -> $ ls -Z1 bin pki bin: system_u:object_r:container_file_t:s0 conf system_u:object_r:container_file_t:s0 container-config ls: cannot open directory 'pki': Permission denied 'root' existed prior to container creation and 'pki' was added later, & outside of container. fcontext is not enough? SELinux says: allow container_init_t container_file_t:dir read; label=disable seems to be the way of it it but is that the right way? many thanks, L.

2 2

Podman Community Cabal Meeting Thu June 15, 2023, 11:00 a.m. EDT (UTC-4)
by Tom Sweeney 14 Jun '23

14 Jun '23

Hi All! The next Podman Community Cabal meeting is just hours away! In a little over 17 hours, at 11:00am EDT (UTC-4) on June 15, 2023, we'll be talking about Additional Layer Storage and ipfs integration. Join the fun! Video link and agenda here: https://hackmd.io/gQCfskDuRLm7iOsWgH2yrg?both Hope to see you there! t

1 0

"floating" IP with podman
by lejeczek 13 Jun '23

13 Jun '23

Hi guys. Is it possible to "attach" an IP to a container with (or perhaps outside of) podman but not create a separate/new iface for that? As if you added a "subsequent" IP to already ip-configured iface. many thanks, L.

2 3

Podman Community Cabal Meeting, Thursday June 15, 2023, 11:00 am EDT (UTC-4)
by Tom Sweeney 08 Jun '23

08 Jun '23

The Podman Community Cabal Meeting will happen in just under a week, on Thursday, Jun 15, 2023, at 11:00 am EDT (UTC-4). We'll be talking about Additional Layer Storage and possible ipfs integration. Conference link in the agenda. If you have Podman design topics to chat about, please join! https://hackmd.io/gQCfskDuRLm7iOsWgH2yrg?both t

1 0

Podman Community Meeting tomorrow, Tues June 6, 2023 11:00 a.m. EDT (UTC-5)
by Tom Sweeney 05 Jun '23

05 Jun '23

The Podman Community Meeting is happening in just under 24 hours at 11:00 am EDT (UTC-5), tomorrow, Tuesday, June 6, 2023. Topics: ChRIS project demo, Quadlet demo, Podman v4.5 Demo, and Podman Desktop updates. Video Conferenece link on the agenda: https://hackmd.io/fc1zraYdS0-klJ2KJcfC7w Hope to see you there! t

1 1

Rootless container startup failure at bootup, launches fine manually
by jklaiho＠iki.fi 30 May '23

30 May '23

We've got a Ubuntu 22.04 server running a rootless container as a systemd user service on Podman 4.4.2, using Quadlet. Podman and its dependencies are installed from binary releases on GitHub and/or from source. Last night the server required a reboot due to some security updates, but the service/container failed to come back up after the boot. In the morning, I was able to manually start it up with `systemctl --user start cms_backend` with no changes to any configuration in the meantime. Here's the full journalctl output for this unit from last night after the reboot (timestamps removed for brevity): systemd[746]: cms_backend.service: unit configures an IP firewall, but not running as root. systemd[746]: (This warning is only shown for the first unit using IP firewalling.) systemd[746]: Starting CMS Backend... cms_backend[787]: time="2023-05-25T03:01:58+03:00" level=error msg="Refreshing container 8f03c9c90e6f8aab02344284ba760fe8ddbf52becb7ba95c383fb80c3bd04405: retrieving temporary directory for container 8f03c9c90e6f8aab02344284ba760fe8ddbf52becb7ba95c383fb80c3bd04405: no such container" podman[787]: 2023-05-25 03:01:59.000295722 +0300 EEST m=+0.107418901 system refresh cms_backend[787]: time="2023-05-25T03:01:59+03:00" level=warning msg="Found incomplete layer \"b767c3f7da27350a451d15f1e972cdd874ea0e6f4c38fad1f644686f0831786f\", deleting it" cms_backend[787]: time="2023-05-25T03:01:59+03:00" level=error msg="Free container lock: no such file or directory" podman[787]: 2023-05-25 03:01:59.037410032 +0300 EEST m=+0.144533221 container remove 8f03c9c90e6f8aab02344284ba760fe8ddbf52becb7ba95c383fb80c3bd04405 (image=<redacted>:latest, name=cms_backend, com.<redacted>.cms.commit_sha=99d36804, com.<redacted>.cms.component=server, com.<redacted>.cms.pipeline_id=25445, PODMAN_SYSTEMD_UNIT=cms_backend.service) cms_backend[787]: Error: remove /run/user/1001/cms_backend.cid: no such file or directory podman[787]: 2023-05-25 03:01:59.00150107 +0300 EEST m=+0.108624239 image pull <redacted>:latest systemd[746]: cms_backend.service: Main process exited, code=exited, status=125/n/a systemd[746]: cms_backend.service: Failed with result 'exit-code'. systemd[746]: Failed to start CMS Backend. Here's the Quadlet generator we use: [Unit] Description=CMS Backend Wants=network-online.target After=network-online.target [Container] Image=<redacted>:latest ContainerName=cms_backend Exec=/bin/bash -c "pip install -q -e . \ && python project/manage.py migrate -v 1 \ && python project/manage.py tailwind install \ && python project/manage.py tailwind build \ && python project/manage.py collectstatic --noinput \ && python -Wd project/manage.py check \ && exec gunicorn --workers 8 --threads 4 --worker-class gthread --worker-tmp-dir /dev/shm --error-logfile - --bind 0.0.0.0:8000 --pythonpath project cms_site.wsgi:application EnvironmentFile=/home/cms/.cms_backend.env RemapUsers=manual RemapUid=0:0:1 RemapUid=100:1:1 RemapGid=0:0:1 RemapGid=65534:1:1 Network=pasta:-t,auto,-T,auto # TODO change to native format after Podman 4.5 upgrade PodmanArgs=--log-driver=journald \ --mount type=bind,source=/var/log/cms,target=/logs \ --mount type=bind,source=/srv/cms/staticfiles,target=/staticfiles [Install] WantedBy=default.target - - - - - The container itself is a lightly customized official Python 3.11 image running a Django application, practically identical to others that we're running with no similar issues. The entry point of the image is ["/usr/bin/dumb-init", "--"]. Like I said, the service came up manually just fine several hours after the initial failure, so it doesn't seem likely that this is a problem in our application code. I can't decipher the error messages, can someone?

2 3

Announcement: New release: Podman v4.5.1
by Lokesh Mandvekar 30 May '23

30 May '23

Podman v4.5.1 was released last Friday. v4.5.1 fixes many podman remote bugs along with some others. Please visit the release page for a full list of fixes and changes: https://github.com/containers/podman/releases/tag/v4.5.1 The MacOS installer release artifacts are currently being worked on and will be uploaded on the release page soon as they are ready. Thank you. -- Lokesh Libera, GitLab, GitHub, Fedora: lsm5 Matrix: @lsm5:lsm5.ems.host GPG: 0xC7C3A0DD https://keybase.io/lsm5

1 0