- Podman - Podman List Archives

How to pull the image to the local from additionalimagestores.
by ugiwgh＠qq.com 08 Aug '22

08 Aug '22

I have set additionalimagestores on a luster. The article is https://www.redhat.com/sysadmin/image-stores-podman. But when I run it, there is chown error. How can I pull to local, in order to run it. $ podman run --rm --userns=keep-id 5d0da3dc9764 echo "hello" Error: chown /public1/home/wugh/.local/share/containers/storage/overlay-containers/8e68d47ef64c8908bb6bff35a2255d8451632e71144a852f617d209f2e352fe7/userdata: operation not permitted

2 4

--root on a separately mounted filesystem - partly not working - ?
by lejeczek 03 Aug '22

03 Aug '22

Hi guys. I have a some bits such as images, containers on a separate disk which disk mounts at boot time, then 'podman' is called with '--root' to that mount-point - pretty regular stuff. All works until system reboots. After reboot I see: -> $ podman-apps container ls ERRO[0000] Joining network namespace for container d00badc4665ca3eae92b720925e6088e534ec81e01153d9d85f81eccf87d6a62: error retrieving network namespace at /run/user/2503/netns/netns-77b9d3b5-6522-741a-0d12-34921bf12828: failed to Statfs "/run/user/2503/netns/netns-77b9d3b5-6522-741a-0d12-34921bf12828": no such file or directory Error: error joining network namespace of container d00badc4665ca3eae92b720925e6088e534ec81e01153d9d85f81eccf87d6a62: error retrieving network namespace at /run/user/2503/netns/netns-77b9d3b5-6522-741a-0d12-34921bf12828: failed to Statfs "/run/user/2503/netns/netns-77b9d3b5-6522-741a-0d12-34921bf12828": no such file or directory at which point I can: -> $ podman-apps system reset I can re-create my containers and all seems to work until, next reboot when I get errors as above. 'podman-apps' is an alias to 'podman --root /my-mountpoint' What is failing here? Some dependencies I cannot see which cause this failure? many thanks, L.

1 0

How could I use IB in container
by ugiwgh＠qq.com 02 Aug '22

02 Aug '22

When I execute show_gids in container, it shows the IB info, like the following. [root@1fdf9c840916 ~]# /opt/user/sbin/show_gids DEV PORT INDEX GID IPv4 VER DEV --- ---- ----- --- ------------ --- --- mlx5_0 1 0 fe80:0000:0000:0000:e007:1bff:ff7f:2250 v1 n_gids_found=1 But when I execute ibv_rc_pingpong in container, it shows error. [root@1fdf9c840916 ~]# /opt/user/bin/ibv_rc_pingpong No IB devices found When I execute ibv_rc_pingpong in host, it runs right, like the following. [rhost@N0505 ~]$ ibv_rc_pingpong local address: LID 0x00b4, QPN 0x015384, PSN 0xb8046a, GID ::

3 6

Fun with uidmap/keep-id/issue 12669
by Robin Lee Powell 01 Aug '22

01 Aug '22

OK, so, I have a thing I wrote (https://github.com/lojban/lbcs) that does its own simple isolated rootless container management. It starts a pod and then starts a configurable list of containers within the pod. https://github.com/containers/podman/issues/12669#issuecomment-998845927 completely broke one of my setups. Which is fine, but I want to know what I should be doing instead. I'm sure it's possible that where I'm going wrong is not where I'm expecting, so I'm going to try to lay out the whole situation. Here's the situation. I have a pod in which I run exim, spamassassin, and clamav. I'm running it rootless, as a user made for this purpose. Let's say the user's UID is 1000, cuz, you know, tradition. I have several things mounted into the containers as a method of persistence, such as exim's spool directory, clamav's definitions dir, etc. Because I'm running rootless, all those files are owned by UID 1000, as you'd expect. I also run with --userns=keep-id, because, well, that seems cleanest and most secure? Running thigs as root in the container seems bad? I'm not sure I actually have a strong principled reason to be doing that, so let me know if it's a bad plan. However, daemons tend to want to run as their own user, so my standard pattern is: RUN for user in mail clamupdate clamscan ; \ do \ find / -xdev -user $user -print0 | xargs -r -0 chown <%= userid %> ; \ usermod -o -u <%= userid %> $user ; \ done , where "<%= userid %>" is replaced with "1000" by the templating thingy. So: change the UID of the system user that the daemon runs at to 1000, and change all files owned by that user to 1000. This all works fine, I do it in many places, it's fine. Here's the problem: exim will *only* run as UID 93. It is, I shit you not, baked in at compile time ;_;. (See https://src.fedoraproject.org/rpms/exim/blob/rawhide/f/exim-4.96-config.pat… and https://github.com/Exim/exim/blob/cf5f5988102b229ef87bc85ba3f0a9ec265f28a6/… ). I'm running from the Fedora RPMs. I do not want to roll my own. I want to pass the network connection between clamav and exim across localhost, because why have the network connection transit out of containers? So what I *used* to have was: $ podman pod create --share=net --network slirp4netns:mtu=30000,port_handler=slirp4netns --userns=keep-id -n drata -p 20280:20280 -p 20225:20225 -p 20265:20265 --network slirp4netns:outbound_addr=192.168.123.132 $ podman run --pod=drata --log-driver=none --name exim -t --uidmap 0:1:92 --uidmap 93:0:1 --uidmap 94:95:8192 -v /home/spdrata/misc-containers/shared_data/var_spool/:/var/spool -v /home/spdrata/misc-containers/shared_data/srv_lojban:/srv/lojban -i spdrata/drata-exim:1 , and that worked fine. The uidmap maps the user running the rootless container (UID 1000) on the host to UID 93 in the container. (Side comment: the documentation for uidmap is *terrible*; coming up with that uidmap set to do what I want took me *hours* of experimentation.) This now simply refuses to work. So what I'm doing instead is I moved the uidmap onto the pod, instead of remapping all the system/daemon users to UID 1000, I remap them to UID 93. This seems ... icky?, but maybe it's the right way to do it? Honestly not sure. Looking for advice. Thanks if you read this far! :D

2 3

Podman Community Meeting Topic
by Sally O'Malley 01 Aug '22

01 Aug '22

Myself and a few others have created a Podman + GitOps tool, FetchIt <https://github.com/containers/fetchit>. We would like to introduce & demo FetchIt at tomorrow's community meeting if possible. Thanks! -- Sally O'Malley Senior Software Engineer Emerging Technologies Group CTO Office <https://www.redhat.com/>

2 1

WARN[0000] cannot toggle freezer: cgroups not configured for container
by ugiwgh＠qq.com 28 Jul '22

28 Jul '22

When I run "podman rm -a", there is the warning. $ podman rm -a WARN[0000] cannot toggle freezer: cgroups not configured for container WARN[0000] cannot toggle freezer: cgroups not configured for container WARN[0000] lstat : no such file or directory $ podman version Client: Podman Engine Version: 4.0.2 API Version: 4.0.2 Go Version: go1.16.13 Git Commit: c99f9f1b6960b98158b7f5fc4e6b5ac1a10b3542 Built: Wed Mar 23 18:33:41 2022 OS/Arch: linux/amd64

1 0

Podman Community Cabal Meeting - Thur July 21, 2022, 11:00 a.m. EDT (UTC-4)
by Tom Sweeney 20 Jul '22

20 Jul '22

Hi All, The next Podman Community Cabal Meeting is happening just under 21 hours from now at 11:00 am EDT on Thu July 21, 2022 (UTC-4). We only have 1 topic about man page cleanups, and welcome more! Agenda with link to video conference: https://hackmd.io/gQCfskDuRLm7iOsWgH2yrg?both Hope to see you there! t

1 0

Error: could not find "rootlessport"
by ugiwgh＠qq.com 15 Jul '22

15 Jul '22

When I run "podman run -p 6379:6379 -d redis:7.0", the error as following. Error: could not find "rootlessport" in one of [/usr/local/libexec/podman /usr/local/lib/podman /usr/libexec/podman /usr/lib/podman]. To resolve this error, set the helper_binaries_dir key in the `[engine]` section of containers.conf to the directory containing your helper binaries. Any help will be appreciated. ----------------------------------- $ podman version Client: Podman Engine Version: 4.0.2 API Version: 4.0.2 Go Version: go1.16.13 Git Commit: c99f9f1b6960b98158b7f5fc4e6b5ac1a10b3542 Built: Wed Mar 23 18:33:41 2022 OS/Arch: linux/amd64

4 4

Newbie network test?
by Loren Amelang 14 Jul '22

14 Jul '22

I've installed Podman on a Raspberry Pi Zero W, and want to test the network connection. I found this: pi@raspberrypi:~/tripod $ podman pull docker.io/library/httpd pi@raspberrypi:~/tripod $ podman run -dt -p 8088:80/tcp docker.io/library/httpd 54a005199e38260bae58a6a5437dd0fbde62f2f596b25d928fb346328cfc9e73 pi@raspberrypi:~/tripod $ I chose "8088:80" because incoming port 8080 is already in use and working on that Pi. Seems that is valid? It seems to run, but closes itself in under a minute: pi@raspberrypi:~/tripod $ podman ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 54a005199e38 docker.io/library/httpd httpd-foreground 26 minutes ago Exited (139) 26 minutes ago 0.0.0.0:8088->80/tcp hopeful_buck 787779b20e96 docker.io/library/httpd httpd-foreground 18 seconds ago Exited (139) 16 seconds ago 0.0.0.0:8088->80/tcp pedantic_yonath pi@raspberrypi:~/tripod $ pi@raspberrypi:~/tripod $ podman logs -l pi@raspberrypi:~/tripod $ pi@raspberrypi:~/tripod $ podman top -l Error: top can only be used on running containers pi@raspberrypi:~/tripod $ slirp4netns is already the newest version (1.0.1-2). Could someone please suggest what to check next? Loren

6 9

Chicken-and-egg problem with image signatures on CoreOS
by Mark Raynsford 11 Jul '22

11 Jul '22

Hello! I've been bounced around a couple of forums and was told that this was probably the best place to ask the question... https://discussion.fedoraproject.org/t/chicken-and-egg-problem-with-image-s… Essentially: * I want to set up multiple CoreOS VMs. * CoreOS depends on being able to run all services from containers. * I want to use podman, because all of my services can run without privileges, and podman seems "better" in general. * I only want to run code from signed images from sources that I trust. Running random Docker images doesn't really cut it. * Setting up a registry appears to require running unsigned code, because podman can't check the docker.io signatures, and podman and docker "should not" be run alongside each other on the same system. * Securing communications to the registry with TLS realistically involves running an ACME client. * Paradoxically, running an ACME client probably involves grabbing an ACME client image from the registry that I'm trying to set up. :) I can see a few ways out of this situation, but all of the various approaches seem to involve running rather a lot of infrastructure just to get roughly the same level of security that I'd get with ordinary signed packages "for free" on FreeBSD or a Debian-based distro. Is there a better way to do this? -- Mark Raynsford | https://www.io7m.com

3 2