- Podman - Podman List Archives

Podman Community Cabal - Thu Sept 15, 2022 11:00 am EDT (UTC-4)
by Tom Sweeney 14 Sep '22

14 Sep '22

The Podman Community Cabal Meeting is happening in just under 24 hours at 11:00am EDT(UTC-4) on Thu September 15, 2022. We'll be talking Kube YAML support, ZSTD update, Confidential computing, Landlock support and more! Agenda with conference link: https://hackmd.io/gQCfskDuRLm7iOsWgH2yrg?both Free to attend and hope to see you there! t

1 0

don't understand how ip work in rootless mode
by Mikhaël MYARA 12 Sep '22

12 Sep '22

Dear all, I started with Docker a few weeks ago and understood security issues coming from the root daemon. I saw that podman was close to Doker (and it is true, my Dockerfiles worked without modification) and solved this security issue. With podman, things work well as long as I use my images / containers in root mode, using sudo. However nothing works in user mode. I guess that for security reasons, it would be better, by far, to run containers in user mode. And I cannot understand how it works. In root mode, typing "ip a" exhibits an eth0 network card, with an ip. And when I use this ip with the considered port fron the outside of the container (i.e. from the main OS), it works In rootless mode, the same command gives a tap0 interface instead, with another ip on another sob network I guess. now if I force the usage of the podman network (in rootless mode), with --network podman, now I get a eth0 network interface, on the same sub network as in root mode. It seems to correspond to the cni-podman0 network on the host OS. However, when I do : telnet 10.88.0.02 8080 from the podman container, it works, whereas from the host OS, it does not work, whereas the interface responds to ping from the host. Can someone help ? Regards, Mike

3 5

Podman Community Cabal Meeting - Thur September 15, 2022, 11:00 am EDT (UTC-4)
by Urvashi Mohnani 08 Sep '22

08 Sep '22

Hi All, The next Podman Community Cabal Meeting is happening next Thursday, September 15 2022 at 11am EDT (UTC-4). We are looking for topics! If you have anything you would like to talk about or demo please sign up in the agenda doc. Agenda with link to video conference: https://hackmd.io/gQCfskDuRLm7iOsWgH2yrg?both Hope to see you there! -- Urvashi Mohnani Senior Software Engineer, OpenShift Runtimes Red Hat <https://www.redhat.com> umohnani(a)redhat.com <https://www.redhat.com>

1 0

uidmap/gidmap in Pod Yaml
by Rudolf Vesely 08 Sep '22

08 Sep '22

Hello Everybody, I often run containers with the following mapping: podman run --uidmap 0:1:1000 --gidmap 0:1:1000 --uidmap 1000:0:1 --gidmap 1000:0:1 --uidmap 1001:1002:64535 --gidmap 1001:1002:64535 --name foo -it localhost/bar bash The reason is that "bar" image is build from containerfile that has user "foobar" and that user is configured to run processes ("USER foobar" in the containerfile) in containers run from the image. The mapping above makes sure that foobar user has same ID in the container host as the user that runs containers on that host (my user account). Could you please tell me is it possible to specify such uidmap/gidmap in Pod yaml? I tried to run a container with the given uidmap/gidmap in a Pod and then "podman generate kube abc" but that didn't give me any extra properties that would configure uidmap/gidmap. Thank you. Kind regards, Rudolf Vesely

3 3

Issues with added on/committed to docker.io/bioconductor/bioconductor_docker images
by Johannes Graumann 06 Sep '22

06 Sep '22

Hi, In a bit for reproducible/revisitable data analysis I have been operating as follows for a while (first with docker, now with podman): 1) Get the bioconductor-provided image providing an RStudio Server installation and all OS-level libraries potentially required to install any R packages from CRAN & bioconductor: > podman pull docker.io/bioconductor/bioconductor_docker 2) Work: 2.a) > podman run -d -p 127.0.0.1:8787:8787 -v /tmp:/tmp -e ROOT=TRUE -e DISABLE_AUTH=TRUE docker.io/bioconductor/bioconductor_docker 2.b) open browser, log onto 127.0.0.1:8787 and analyze data using RStudio/bioconductor, etc. 3) After finishing: (attempt to) save the entire toolchain: 3.a) > podman commit <CONTAINER ID> <PIRVATEREGISTRY/PROJECTID:latest> 3.b) > podman push <PIRVATEREGISTRY/PROJECTID:latest> This has served me extremely well. In my field people frequently come back with minor adaptation requests YEARS after the original analysis (usually plotting prior to publication) and I can just pull the image and provide them with those edits in the context of EXACTLY the same tool chain irrespective of where Linux, Libraries, R, R packages, my own in house code etc. meanwhile has moved. Recently, however, I have had issues with not being able to connect to the RStudio server in containers from images retrieved from our private registry. The container will start fine, but No matter what I do, no RStudio ever starts/is accessible and I have not succeeded in debugging this behavior. When going through step 3.a) today, I noted the following warnings and was wondering whether I may have overlooked them and they might be at the base of my issues to access RStudio after a comitt/push/pull cycle: > podman push WARN[0024] archive: skipping > "/home/user/.local/share/containers/storage/overlay/a1785f29a13373408 > 1f82f42b53ba8e20a7b0e2d8d2fd3cdc69303d4c681aa96/merged/run/rstudio- > server/rstudio-rserver/session-server-rpc.socket" since it is a > socket > WARN[0024] archive: skipping > "/home/user/.local/share/containers/storage/overlay/a1785f29a13373408 > 1f82f42b53ba8e20a7b0e2d8d2fd3cdc69303d4c681aa96/merged/run/rstudio- > server/rstudio-rsession/rstudio-d" since it is a socket Is this likely at the basis of my woes and how might it be fixed? Sincerely, Joh

2 1

Issues with added on/committed to docker.io/bioconductor/bioconductor_docker images
by Johannes Graumann 05 Sep '22

05 Sep '22

Hi, In a bit for reproducible/revisitable data analysis I have been operating as follows for a while (first with docker, now with podman): 1) Get the bioconductor-provided image providing an RStudio Server installation and all OS-level libraries potentially required to install any R packages from CRAN & bioconductor: > podman pull docker.io/bioconductor/bioconductor_docker 2) Work: 2.a) > podman run -d -p 127.0.0.1:8787:8787 -v /tmp:/tmp -e ROOT=TRUE -e DISABLE_AUTH=TRUE docker.io/bioconductor/bioconductor_docker 2.b) open browser, log onto 127.0.0.1:8787 and analyze data using RStudio/bioconductor, etc. 3) After finishing: (attempt to) save the entire toolchain: 3.a) > podman commit <CONTAINER ID> <PIRVATEREGISTRY/PROJECTID:latest> 3.b) > podman push <PIRVATEREGISTRY/PROJECTID:latest> This has served me extremely well. In my field people frequently come back with minor adaptation requests YEARS after the original analysis (usually plotting prior to publication) and I can just pull the image and provide them with those edits in the context of EXACTLY the same tool chain irrespective of where Linux, Libraries, R, R packages, my own in house code etc. meanwhile has moved. Recently, however, I have had issues with not being able to connect to the RStudio server in containers from images retrieved from our private registry. The container will start fine, but No matter what I do, no RStudio ever starts/is accessible and I have not succeeded in debugging this behavior. When going through step 3.a) today, I noted the following warnings and was wondering whether I may have overlooked them and they might be at the base of my issues to access RStudio after a comitt/push/pull cycle: > podman push WARN[0024] archive: skipping > "/home/user/.local/share/containers/storage/overlay/a1785f29a13373408 > 1f82f42b53ba8e20a7b0e2d8d2fd3cdc69303d4c681aa96/merged/run/rstudio- > server/rstudio-rserver/session-server-rpc.socket" since it is a > socket > WARN[0024] archive: skipping > "/home/user/.local/share/containers/storage/overlay/a1785f29a13373408 > 1f82f42b53ba8e20a7b0e2d8d2fd3cdc69303d4c681aa96/merged/run/rstudio- > server/rstudio-rsession/rstudio-d" since it is a socket Is this likely at the basis of my woes and how might it be fixed? Sincerely, Joh

2 1

Rootless container with --uidmap: root loses privileges inside the container
by jklaiho＠iki.fi 01 Sep '22

01 Sep '22

I've had quite a lot of success with running rootless Podman containers in a Ubuntu 22.04 Vagrant box. They're able to connect to services running on the host, and by using the --uidmap parameter, I've been able to make the container user write to bound volumes from the host with the privileges of the non-root host user that is running the service. One last hurdle remains: I have a container running as a systemd user service as a non-root user, but internally the container runs as root. I'm using --uidmap 0:0:1 so that when the container's root user writes to bound host volumes, on the host they appear to have been created by the non-root service user. What surprised me is that when this UID mapping is in place, the root user seems to lose root privileges inside the container. I was trying to install redis-tools to debug a Redis connection issue inside the running container, and ran 'apt update' as the container root user. This failed with errors: E: setgroups 65534 failed - setgroups (22: Invalid argument) E: setegid 65534 failed - setegid (22: Invalid argument) E: seteuid 100 failed - seteuid (22: Invalid argument) rm: cannot remove '/var/cache/apt/archives/partial/*.deb': Permission denied Reading package lists... Done W: chown to _apt:root of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory (22: Invalid argument) W: chown to _apt:root of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory (22: Invalid argument) E: setgroups 65534 failed - setgroups (22: Invalid argument) E: setegid 65534 failed - setegid (22: Invalid argument) E: seteuid 100 failed - seteuid (22: Invalid argument) E: Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument) E: Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument) E: Method http has died unexpectedly! E: Sub-process http returned an error code (112) If I run the container without the --uidmap parameter, this command starts working again, but naturally I lose the user mapping I described above. Honestly, I'm probably able to rebuild the image that the container uses in such a way that its application runs as a non-root user (and then I'll just use e.g. --uidmap 1000:0:1, which I've found to work elsewhere), but I'm clearly missing something about the UID mapping functionality with an in-container root user, because I don't understand what about it is causing these errors. Any ideas?

4 5

There is nothing output, when I execute "podman info"
by ugiwgh＠qq.com 22 Aug '22

22 Aug '22

There is nothing output, when I execute "podman info". The following info, I add "--log-level debug". $ podman --log-level debug info INFO[0000] podman filtering at log level debug DEBU[0000] Called info.PersistentPreRunE(podman --log-level debug info) DEBU[0000] Found default OCI runtime /export/home/rsync/.local/container/sbin/runc path via PATH environment variable DEBU[0000] Using conmon from $PATH: "/export/home/rsync/.local/container/bin/conmon" DEBU[0000] Initializing boltdb state at /tmp/1212/14810/share/containers/storage/libpod/bolt_state.db DEBU[0000] Using graph driver overlay DEBU[0000] Using graph root /tmp/1212/14810/share/containers/storage DEBU[0000] Using run root /tmp/containers-user-1212/containers DEBU[0000] Using static dir /tmp/1212/14810/share/containers/storage/libpod DEBU[0000] Using tmp dir /tmp/podman-run-1212/libpod/tmp DEBU[0000] Using volume path /tmp/1212/14810/share/containers/storage/volumes DEBU[0000] Set libpod namespace to "" DEBU[0000] Not configuring container store DEBU[0000] Initializing event backend file DEBU[0000] Configured OCI runtime crun initialization failed: no valid executable found for OCI runtime crun: invalid argument DEBU[0000] using runtime "runc" from $PATH: "/export/home/rsync/.local/container/sbin/runc" DEBU[0000] Configured OCI runtime kata initialization failed: no valid executable found for OCI runtime kata: invalid argument DEBU[0000] Configured OCI runtime runsc initialization failed: no valid executable found for OCI runtime runsc: invalid argument DEBU[0000] Configured OCI runtime krun initialization failed: no valid executable found for OCI runtime krun: invalid argument DEBU[0000] Using OCI runtime "/export/home/rsync/.local/container/sbin/runc" INFO[0000] Setting parallel job count to 4

3 6

podman logging as user from systemd
by Ryan Wilson 22 Aug '22

22 Aug '22

The previous thread about logging was timely as I've been experimenting with a setup to make sure I'm capturing all the logs from a few important containers I've got running. But I'm still having some inconsistencies in what shows up in the logs. Some of my containers I want to run as root (rootful podman) and some as a user (rootless podman). I'd like to get all of their logs to journald if possible. This systemd service file runs as a user and works correctly, but doesn't log anything to journald. I can't make it work with "type=forking" (the container starts, but is immediately stopped then killed for some reason): [Unit] Description=Hello After=network-online.target Wants=network-online.target user-runtime-dir(a)1000.service [Service] Type=simple User=core Group=core TimeoutStartSec=70 ExecStart=/usr/bin/podman run --name hello --replace alpine /bin/sh -c "while true; do date; logger $(date); echo hello; logger hello; sleep 60; done" ExecStop=/usr/bin/podman stop --ignore hello ExecStopPost=/usr/bin/podman rm -f --ignore hello [Install] WantedBy=multi-user.target This systemd service file works correctly and logs to journald, but only as root: [Unit] Description=Hello After=network-online.target Wants=network-online.target [Service] Type=forking TimeoutStartSec=70 ExecStart=/usr/bin/podman run --name hello -d --replace alpine /bin/sh -c "while true; do date; logger $(date); echo hello; logger hello; sleep 60; done" ExecStop=/usr/bin/podman stop --ignore hello ExecStopPost=/usr/bin/podman rm -f --ignore hello [Install] WantedBy=multi-user.target How do I make the logging work to journald from rootless podman? Ryan

2 4

Podman logs container output in duplicate with journald
by jklaiho＠iki.fi 21 Aug '22

21 Aug '22

I'm experimenting with Podman on a Ubuntu 22.04 Vagrant box. I installed Podman and its dependencies manually from GitHub releases rather than using the outdated version in the Ubuntu repositories. This means I had to rely on web sources for my configuration files, and I may have gotten something a bit wrong. Here's the systemd service file: [Unit] Description=TileServer GL After=network-online.target Requires=network-online.target [Service] Restart=always ExecStartPre=/usr/bin/podman pull maptiler/tileserver-gl:v3.1.1 ExecStart=/usr/bin/podman container run --rm \ --name tileserver -u www-data -p 8083:8080 \ -v /vagrant_data/resources/tiles:/data \ maptiler/tileserver-gl:v3.1.1 \ -c /etc/tileserver.json \ --public_url https://devserver.local/tiles [Install] WantedBy=default.target /etc/containers/containers.conf: [containers] log_driver="journald" tz="local" [network] network_backend="netavark" registries.conf and policy.json are minimal and have nothing related to this issue. When I run the service and do `journalctl -u tileserver`, this is what gets logged after the container has been pulled and started: Aug 17 14:53:51 mapapi-dev tileserver[11742]: Starting tileserver-gl v3.1.1 Aug 17 14:53:51 mapapi-dev podman[11671]: Starting tileserver-gl v3.1.1 Aug 17 14:53:51 mapapi-dev tileserver[11742]: No MBTiles specified, using zurich_switzerland.mbtiles Aug 17 14:53:51 mapapi-dev podman[11671]: No MBTiles specified, using zurich_switzerland.mbtiles Aug 17 14:53:51 mapapi-dev tileserver[11742]: [INFO] Automatically creating config file for zurich_switzerland.mbtiles Aug 17 14:53:51 mapapi-dev tileserver[11742]: [INFO] Only a basic preview style will be used. Aug 17 14:53:51 mapapi-dev podman[11671]: [INFO] Automatically creating config file for zurich_switzerland.mbtiles Aug 17 14:53:51 mapapi-dev podman[11671]: [INFO] Only a basic preview style will be used. Aug 17 14:53:51 mapapi-dev podman[11671]: [INFO] See documentation to learn how to create config.json file. Aug 17 14:53:51 mapapi-dev tileserver[11742]: [INFO] See documentation to learn how to create config.json file. Aug 17 14:53:51 mapapi-dev tileserver[11742]: Run with --verbose to see the config file here. Aug 17 14:53:51 mapapi-dev podman[11671]: Run with --verbose to see the config file here. Aug 17 14:53:51 mapapi-dev tileserver[11742]: Starting server Aug 17 14:53:51 mapapi-dev podman[11671]: Starting server Aug 17 14:53:51 mapapi-dev tileserver[11742]: Listening at http://[::]:8080/ Aug 17 14:53:51 mapapi-dev podman[11671]: Listening at http://[::]:8080/ Aug 17 14:53:51 mapapi-dev tileserver[11742]: Startup complete Aug 17 14:53:51 mapapi-dev podman[11671]: Startup complete So, everything that tileserver prints to stdout, podman repeats. If I run the container as a simple terminal command outside systemd, everything is only printed out once. Any ideas for a fix? I don't particularly care whether it's the 'tileserver' or 'podman' rows out of the duplicated ones that end up in the logs, but I'd rather not have both logged.

3 3