- Podman - Podman List Archives

insecure local repo - can it be insecure at all?
by lejeczek 09 Mar '22

09 Mar '22

Hi guys Various "howtos" on the net rarely mention SSL and I get - after such repo deployment - 'pull' complaining about HTTP, until I added certs. Question - perhaps it's not allowed by recent 'podman' versions to have insecure repo? my 'registries.conf': [registries.search] registries = ["mine.private:5000", "registry.fedoraproject.org", "registry.access.redhat.com", "registry.centos.org", "quay.io", "docker.io"] [registries.insecure] registries = ['mine.private:5000'] many thanks, L.

2 1

Running a pod on OSX leaves infra container running forever
by dav.alejandro＠gmail.com 08 Mar '22

08 Mar '22

I am running a pod via play kube. My container exits, but the companion infra container keeps running forever, meaning that the whole pod keeps running forever Is there a way to make infra container exit once pod's containers exit? I am running on OSX

2 1

make local repo HA
by lejeczek 05 Mar '22

05 Mar '22

Hi guys. Having a local repo - what would need to done to replicate it over to another host? Only mapped volume of the container '/var/lib/registry' being synced over does not seem to be enough, so I presume it would have to whole container image but, how would that work? And very next thing I'd wonder is - is separate storage path per image allowed or even possible? Or maybe there is another ready-made solution I'm unaware of? many thanks, L.

2 2

Help Needed - podman and bgp
by Filipe Carvalho 02 Mar '22

02 Mar '22

Hi team, First of all, thanks for Podman. I'm working in a service which will have a pod with 3 containers. This service (syslog relay) will be served in the network via an Anycast IP. I've BGP peering working with bird. Each pair peer and interface have a dedicated routing table. Pod is also working and configured in rootless mode, configured with network configures as slirp4netns:port_handler=slirp4netns Quick diagram to explain my problem. +--------+ +--------+ | | | | | peer 1 | | peer 2 | | | | | +--------+ +--------+ +------------------------------+ | | | int 1 int 2 int 3 | | | | dummy | | | | ip anycast | | | Host +------------------------------+ At this time, the pod is running and if I send syslog to IP in interface 3 (int 3, in routing table main), the messages arrive at container (tcp or udp). But if the messages are sent to Anycast IP (configured in interface dummy) it does not arrive at containers. I've already saw to possibilities to solve the problem: - Rudolf Vesely (DIY networking for rootless containers/pods)[1] - Using Calico CNI with podman But, before deep dive in more complex solutions, I'm requesting your help to see if I missing some more basic in my configuration. I'm trying to keep the configuration as simple as possible because in future this solutions will be supported by a team which as less knowledge in this than me. [1] https://lists.podman.io/archives/list/podman@lists.podman.io/thread/W6MCYO6… Thanks in advance. Filipe

1 0

Podman v4.0 Release Announcement
by Tom Sweeney 28 Feb '22

28 Feb '22

Hi All, We're very thrilled to have just posted the Release Announcement for Podman v4.0 on the https://podman.io website. The release includes a number of updates and changes to the network stack, Docker Compose improvements, podman machine working with WSL2 on Windows and more! Check out the Release Announcement for Details! (https://podman.io/releases/2022/02/22/podman-release-v4.0.0.html) Many thanks to our many contributors for their work on this release! t

3 3

systemd for a pod without infra
by Muayyad AlSadi 24 Feb '22

24 Feb '22

Hi, when creating a pod with nothing shared and without infra podman generate systemd -n pod_test Error: error generating systemd unit files: Pod "pod_test" has no infra container here is the full commands podman pod create --name=pod_test --infra=false --share= podman network create pod_net podman run --name=test_web80 -d --net pod_net --hostname web80 --pod=pod_test busybox httpd -f -p 8080 -h /etc podman run --name=test_web90 --requires=test_web80 -d --net pod_net --hostname web90 --pod=pod_test busybox httpd -f -p 9090 -h /etc podman pod ps 9a894043a1e1 pod_test Running 18 seconds ago 2 if we replace podman pod create --name=pod_test --infra=false --share= with podman pod create --name=pod_test --share= podman pod ps would display Degraded 5f2458ba5eac pod_test Degraded 18 seconds ago a3a4ca1b8e4d 3 if we remove --share= it would complain about multiple hostnames what do you suggest? and why systemd care about infra?

2 4

Show Git SHA version of podman inside podman machiine VM?
by Craig Rodrigues 23 Feb '22

23 Feb '22

Hi, On macOS, I did the following to test the HEAD version of podman: brew update brew install --HEAD podman podman version Client: Podman Engine Version: 4.0.0-dev API Version: 4.0.0-dev Go Version: go1.17.6 Git Commit: d3699bbce63f283a609053d4aca23e4abe7dae4d-dirty Built: Wed Feb 23 07:29:12 2022 OS/Arch: darwin/amd64 Server: Podman Engine Version: 4.0.0-dev API Version: 4.0.0-dev Go Version: go1.16.13 Built: Thu Feb 17 13:48:15 2022 OS/Arch: linux/amd64 podman ssh podman version Client: Podman Engine Version: 4.0.0-dev API Version: 4.0.0-dev Go Version: go1.16.13 Built: Thu Feb 17 13:48:15 2022 OS/Arch: linux/amd64 The podman CLI on macOS shows the Git Commit as part of the output of *podman** version*, but the CLI inside the podman machine VM does not. Is it possible to determine the Git commit of the podman inside the VM? -- Craig

3 2

Re: pasta (passt) draft integration patch and demo
by Paul Holzinger 23 Feb '22

23 Feb '22

> > [Note: you didn't send this to the list, I guess it's by accident, but > I'm answering in private just in case -- if it's really by accident, > I'll also answer on list ;)] > That was by accident, let me put this back into the list. So, to recap, I guess the to-do list is: > > - drop automatic port bindings (both ways) in default configuration > options passed by Podman > > - drop also the loopback trick (by default) > > - add option to bind ports to specific addresses, per-port > > ...anything else? I would wait a couple more days for any > additional feedback and then come back with the changes. > I think one big question would be packaging passt/pasta in distros. I don't think it is a good user experience when users cannot get this from the official repos. Dan, Brent, Matt, Giuseppe WDYT? On Wed, Feb 23, 2022 at 5:46 PM Stefano Brivio <sbrivio(a)redhat.com> wrote: > [Note: you didn't send this to the list, I guess it's by accident, but > I'm answering in private just in case -- if it's really by accident, > I'll also answer on list ;)] > > On Wed, 23 Feb 2022 16:35:54 +0100 > Paul Holzinger <pholzing(a)redhat.com> wrote: > > > > > > > Perhaps it would be reasonable to make it non-default in the options > > > passed by Podman ("-t none -u none" if no ports are passed), and keep > > > it the default in pasta (it saves some typing). > > > > That would be fine, I don't care about the pasta default as long as > podman > > uses the secure option by default this is fine for me. > > Okay, I'll change that in the patch (and in the demo). > > > > Perhaps we could also allow restricting the amount of ports (say, five) > > > that can be bound automatically. Would something like that preferable > as > > > default? > > > > I don't think this helps much, we should only add ports that were > > explicitly set with podman run -p ... > > A container should not be able to alter the host by default. > > > > > The interface isn't really shared, but yes, ports can be directly bound > > > both ways. > > > > I see, I got confused because reverse mapping was working. > > > > > > Another question, does pasta support binding only a specific host > address? > > I only see the port:port syntax in the man page. In podman you can do -p > > ipv4:port:port or [ipv6]:port:port. > > Not explicitly: one can pass a host interface that's used to source the > address -- by default, that's the interface with the first returned > least-specific route for IPv4, i.e. the default gateway, or for IPv6 if > IPv4 is disabled/not available. > > Addresses can also be overridden with "-a" (separately for IPv4 and IPv6) > -- > and the configured address will be used. > > ...but not with different per-port addresses. I can definitely add an > option for that. > > Now, passt doesn't use dynamic memory allocation (for security reasons), so > I'll need to move the binding routines to the command line argument parsing > stage (ports are stored as bitmaps, I can't store an arbitrary number of > addresses), but it's a quick change. > > So, to recap, I guess the to-do list is: > > - drop automatic port bindings (both ways) in default configuration > options passed by Podman > > - drop also the loopback trick (by default) > > - add option to bind ports to specific addresses, per-port > > ...anything else? I would wait a couple more days for any > additional feedback and then come back with the changes. > > -- > Stefano > >

3 2

Re: pasta (passt) draft integration patch and demo
by Stefano Brivio 23 Feb '22

23 Feb '22

[Just for the records, original email sent to Paul, also missing in list] On Wed, 23 Feb 2022 16:35:54 +0100 Paul Holzinger <pholzing(a)redhat.com> wrote: > > > > Perhaps it would be reasonable to make it non-default in the options > > passed by Podman ("-t none -u none" if no ports are passed), and keep > > it the default in pasta (it saves some typing). > > That would be fine, I don't care about the pasta default as long as podman > uses the secure option by default this is fine for me. Okay, I'll change that in the patch (and in the demo). > > Perhaps we could also allow restricting the amount of ports (say, five) > > that can be bound automatically. Would something like that preferable as > > default? > > I don't think this helps much, we should only add ports that were > explicitly set with podman run -p ... > A container should not be able to alter the host by default. > > > The interface isn't really shared, but yes, ports can be directly bound > > both ways. > > I see, I got confused because reverse mapping was working. > > > Another question, does pasta support binding only a specific host address? > I only see the port:port syntax in the man page. In podman you can do -p > ipv4:port:port or [ipv6]:port:port. Not explicitly: one can pass a host interface that's used to source the address -- by default, that's the interface with the first returned least-specific route for IPv4, i.e. the default gateway, or for IPv6 if IPv4 is disabled/not available. Addresses can also be overridden with "-a" (separately for IPv4 and IPv6) -- and the configured address will be used. ...but not with different per-port addresses. I can definitely add an option for that. Now, passt doesn't use dynamic memory allocation (for security reasons), so I'll need to move the binding routines to the command line argument parsing stage (ports are stored as bitmaps, I can't store an arbitrary number of addresses), but it's a quick change. So, to recap, I guess the to-do list is: - drop automatic port bindings (both ways) in default configuration options passed by Podman - drop also the loopback trick (by default) - add option to bind ports to specific addresses, per-port ...anything else? I would wait a couple more days for any additional feedback and then come back with the changes. -- Stefano

1 0

pasta (passt) draft integration patch and demo
by Stefano Brivio 23 Feb '22

23 Feb '22

Hi, I played around with Podman to integrate pasta (if you never heard of it: https://passt.top/passt/about/#pasta-pack-a-subtle-tap-abstraction -- pasta is functionally similar to slirp4netns but without the Slirpiness). I prepared a demo at: https://passt.top/passt/about/#pasta_2 (the one on the right) from the out-of-tree patch at: https://passt.top/passt/tree/contrib/podman/0001-libpod-Add-pasta-networkin… Let me know if you have questions, comments, interest in it, etc. Thanks, -- Stefano

2 2