- Podman - Podman List Archives

Container documentation
by Michael Ivanov 12 Oct '21

12 Oct '21

Hallo, One small question strictly not related to podman: are there any means to bundle container-related documentation to container itself, similar to perl's embedded POD) and to query it in some generic way? (say like 'podman docs <container name>')? Best regards, -- \ / | | (OvO) | Михаил Иванов | (^^^) | | \^/ | E-mail: ivans(a)isle.spb.ru | ^ ^ | |

2 1

permissions issues to host filesystem when running rootless Vs rootful and question on opening port on container/host
by Christopher.Miller＠gd-ms.com 07 Oct '21

07 Oct '21

First time poster. Coming from Docker background, using Podman since May of this year. Help me make sense of this. I am testing applying certs to a container in our dev environment, before replicating it to our production container. It was running as expected, and now I'm having issues when running the same commands (I've deleted the old container 1st before starting the work again). If I run the following command: sudo podman run -d -name hosta-nexus -p 8081:80 -v /opt/nexus:/nexus-data:Z -v /data/storage:/storage:Z docker.io/sonatype/nexus.3:30.0 [usera@hosta /]$ sudo podman run --name hosta-nexus -p 8081:80 -v /opt/nexus:/nexus-data:Z -v /data/storage:/storage:Z docker.io/sonatype/nexus3:3.30.0 mkdir: cannot create directory '../sonatype-work/nexus3': Permission denied mkdir: cannot create directory '../sonatype-work/nexus3': Permission denied Warning: Cannot open log file: ../sonatype-work/nexus3/log/jvm.log Warning: Forcing option -XX:LogFile=/tmp/jvm.log OpenJDK 64-Bit Server VM warning: Cannot open file ../sonatype-work/nexus3/log/jvm.log due to Permission denied java.io.FileNotFoundException: ../sonatype-work/nexus3/tmp/i4j_ZTDnGON8hezynsMX2ZCYAVDtQog=.lock (Permission denied) at java.io.RandomAccessFile.open0(Native Method) at java.io.RandomAccessFile.open(RandomAccessFile.java:316) at java.io.RandomAccessFile.<init>(RandomAccessFile.java:243) at com.install4j.runtime.launcher.util.SingleInstance.check(SingleInstance.java:72) at com.install4j.runtime.launcher.util.SingleInstance.checkForCurrentLauncher(SingleInstance.java:31) at com.install4j.runtime.launcher.UnixLauncher.checkSingleInstance(UnixLauncher.java:88) at com.install4j.runtime.launcher.UnixLauncher.main(UnixLauncher.java:67) java.io.FileNotFoundException: /nexus-data/karaf.pid (Permission denied) at java.io.FileOutputStream.open0(Native Method) at java.io.FileOutputStream.open(FileOutputStream.java:270) at java.io.FileOutputStream.<init>(FileOutputStream.java:213) at java.io.FileOutputStream.<init>(FileOutputStream.java:101) at org.apache.karaf.main.InstanceHelper.writePid(InstanceHelper.java:127) at org.apache.karaf.main.Main.launch(Main.java:243) at org.sonatype.nexus.karaf.NexusMain.launch(NexusMain.java:113) at org.sonatype.nexus.karaf.NexusMain.main(NexusMain.java:52) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at com.exe4j.runtime.LauncherEngine.launch(LauncherEngine.java:85) at com.install4j.runtime.launcher.UnixLauncher.main(UnixLauncher.java:69) java.lang.RuntimeException: /nexus-data/log/karaf.log (Permission denied) at org.apache.karaf.main.util.BootstrapLogManager.getDefaultHandlerInternal(BootstrapLogManager.java:102) at org.apache.karaf.main.util.BootstrapLogManager.getDefaultHandlersInternal(BootstrapLogManager.java:137) at org.apache.karaf.main.util.BootstrapLogManager.getDefaultHandlers(BootstrapLogManager.java:70) at org.apache.karaf.main.util.BootstrapLogManager.configureLogger(BootstrapLogManager.java:75) at org.apache.karaf.main.Main.launch(Main.java:244) at org.sonatype.nexus.karaf.NexusMain.launch(NexusMain.java:113) at org.sonatype.nexus.karaf.NexusMain.main(NexusMain.java:52) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at com.exe4j.runtime.LauncherEngine.launch(LauncherEngine.java:85) at com.install4j.runtime.launcher.UnixLauncher.main(UnixLauncher.java:69) Caused by: java.io.FileNotFoundException: /nexus-data/log/karaf.log (Permission denied) at java.io.FileOutputStream.open0(Native Method) at java.io.FileOutputStream.open(FileOutputStream.java:270) at java.io.FileOutputStream.<init>(FileOutputStream.java:213) at org.apache.karaf.main.util.BootstrapLogManager$SimpleFileHandler.open(BootstrapLogManager.java:193) at org.apache.karaf.main.util.BootstrapLogManager$SimpleFileHandler.<init>(BootstrapLogManager.java:182) at org.apache.karaf.main.util.BootstrapLogManager.getDefaultHandlerInternal(BootstrapLogManager.java:100) ... 12 more Error creating bundle cache. Unable to update instance pid: Unable to create directory /nexus-data/instances Exception in thread "Thread-2" java.lang.SecurityException: Could not lock User prefs. Lock file access denied. at java.util.prefs.FileSystemPreferences.checkLockFile0ErrorCode(FileSystemPreferences.java:949) at java.util.prefs.FileSystemPreferences.lockFile(FileSystemPreferences.java:937) at java.util.prefs.FileSystemPreferences.sync(FileSystemPreferences.java:741) at java.util.prefs.FileSystemPreferences.flush(FileSystemPreferences.java:836) at java.util.prefs.FileSystemPreferences.syncWorld(FileSystemPreferences.java:476) at java.util.prefs.FileSystemPreferences.access$1200(FileSystemPreferences.java:50) at java.util.prefs.FileSystemPreferences$4$1.run(FileSystemPreferences.java:454) The following directories already exist on the host: /opt/nexus and /data/storage and are owned by nexus:nexus and the file permissions are 755. BUT, if I run the following command (with user 0): sudo podman run -dit --name hosta-nexus -u 0 -p 8081:80 -v /opt/nexus:/nexus-data:Z -v /data/storage:/storage:Z docker.io/sonatype/nexus3:3.30.0 Why was the container running without the -u 0, and now I'm getting permission denied at rootless? Is there something, somewhere that is persisting that is causing the issue? Also to clear things up, I'm opening the following port on the Container to the Host: 8081:80 , but if I type in localhost:8081 or localhost:80, the UI won't come up. I have to inspect the running container, get the IP address, and then put in that ip address:8081 and then the web pages comes up. I'm not sure what I'm doing incorrectly here. Thanks Chris

3 19

Podman Community Meeting October 2021 Recording
by Tom Sweeney 06 Oct '21

06 Oct '21

HI All, The recording from today's Podman Community Meeting is now available at: https://bluejeans.com/s/X3NY6qgSlKQ. I'll try to get the meeting notes together and posted by early next week. t

1 0

syscalls: native or translated
by Tobias Wendorff 05 Oct '21

05 Oct '21

Hi there, I just had a talk with some LXC nerds. Their opinion is that unprivileged LXC is more secure than Docker and similar solutions. These would translate the syscalls to userspace, to not have a direct interface to the kernel. In LXC, the syscalls themselves would have built-in namespace awareness in the kernel itself, but without a translation layer. How does this statement relate to the security of a container running in rootless Podman in a normal user? Could the "translation layer" introduce trouble? Best regards, Tobias

4 6

Nagios check_icmp error in rootless container
by Michael Ivanov 04 Oct '21

04 Oct '21

Hallo again! I'm trying to run /usr/lib64/nagios/plugins/check_icmp in rootless container and I get the following error: check_icmp: Failed to obtain ICMP socket: Operation not permitted check_icmp permissions are as following: -rwsr-x--- 1 root nagios 75800 Apr 2 2021 /usr/lib64/nagios/plugins/check_icmp I am running it as root (container's root of course) ping localhost and /usr/lib64/nagios/plugins/check_ping -H localhost work without problems. /bin/ping is *not* suid, but has caps cap_net_admin,cap_net_raw+p set. /usr/lib64/nagios/plugins/check_icmp is setuid root and had no capabilities set. Ok, I remived suid bit from it and set same caps as for ping: -rwxr-x--- 1 root nagios 75800 Apr 2 2021 /usr/lib64/nagios/plugins/check_icmp /usr/lib64/nagios/plugins/check_icmp = cap_net_admin,cap_net_raw+p When I run it I still get same error. In which direction to dig? Best regards, -- \ / | | (OvO) | Михаил Иванов | (^^^) | | \^/ | E-mail: ivans(a)isle.spb.ru | ^ ^ | |

1 0

Podman Community Meeting Tommorow at this tme!
by Tom Sweeney 04 Oct '21

04 Oct '21

Hi All! The Podman Community Meeting is in 24 hours! https://podman.io/community/meeting/agenda/ Hope to see you there, free to attend, and link to the video conference there on the agenda. t

1 0

client address in rootless container
by Michael Ivanov 04 Oct '21

04 Oct '21

Greetings! I have observer a strange networking issue when running a service in rootless container. When connecting to this service from outside client ip address is reported by the accept() is local container address (the one from tap0 interface inside a container). Is this expected? Best regards, -- \ / | | (OvO) | Михаил Иванов | (^^^) | | \^/ | E-mail: ivans(a)isle.spb.ru | ^ ^ | |

1 0

October 5, 2021 Podman Community Meeting Agenda
by Tom Sweeney 27 Sep '21

27 Sep '21

Hey All, The next Podman Community Meeting is next Tues Oct 5, 2021, at 11:00 a.m. EDT (UTC-4). We have a jammed-packed agenda, with a lot of demos, updates on Podman v3.2, Podman on Mac, and more! Agenda here: https://podman.io/community/meeting/agenda/ The video conference link on the agenda. Hope to see you there! t

1 0

volume ownership changes in rootless mode
by Michael Ivanov 22 Sep '21

22 Sep '21

Greetings, I observe the following strange behavior as regarding volume ownership in rootless mode. I have user oracle with uid 502 and group oinstall with gid 501 both on host system and in my container. I create a volume and change it's ownership as follows: podman volume create data podman unshare chown 502:501 ~/.local/share/containers/storage/volumes/rdata/_data ls -ld ~/.local/share/containers/storage/volumes/rdata/_data drwxr-xr-x 1 200501 200500 0 мар 14 2021 /home/ivans/.local/share/containers/storage/volumes/rdata/_data/ So far so good. I run my test container: podman run --name test --detach --volume rdata:/mnt test And check the volume ownership inside the container: podman exec -it test ls -ld /mnt The owner reported for /mnt is the one configured with --user, when container was built, not oracle:oinstall! I stop the container and check volume owner. It has changed: ls -ld ~/.local/share/containers/storage/volumes/rdata/_data drwxr-xr-x 1 201000 200999 0 мар 14 2021 /home/ivans/.local/share/containers/storage/volumes/phsdata/_data/ I change volume owner again: podman unshare chown 502:501 ~/.local/share/containers/storage/volumes/rdata/_data and run the container using same command: podman run --name test --detach --volume rdata:/mnt test The second time everything is correct: podman exec -it test ls -ld /mnt drwxr-xr-x 1 oracle oinstall 0 Mar 14 2021 /mnt And same outside of container: drwxr-xr-x 1 200501 200500 0 мар 14 2021 /home/ivans/.local/share/containers/storage/volumes/rdata/_data/ If I remove the volume and create it again, then the ownership is again changed to default container user. So expected ownership is set only after second mount of the volume. What might be wrong here? Best regards, -- \ / | | (OvO) | Михаил Иванов | (^^^) | | \^/ | E-mail: ivans(a)isle.spb.ru | ^ ^ | |

3 3

RHEL 8.4 - No private unshared labels
by Jorge Fábregas 22 Sep '21

22 Sep '21

Hi, I have a RHEL 8.4 box , totally updated, using the "container-tools" module (with the default rolling stream) and noticed that there's no distinction between creating a volume with "z" or "Z". If I use "Z" I never get a "private unshared label" in the corresponding folder (no MLS fields). Is this really not available in RHEL 8.4 or am I missing something? Thanks, Jorge

2 10