- Podman - Podman List Archives

Trouble with Podman secrets with v 3.2
by James Miller 23 Jun '21

23 Jun '21

Hi, I have v3.2 podman installed, but am having difficulty with the new secrets --type=env. I create the secret ok as file, but podman secret create secret_name --env=true $env_name fails. When I create the secret as file, no matter whether it is JSON or simple variable='thing', when I create the container using the command Podman run -dit --secret=secret_name,type=env --name=container_name image_id and then exec into the running container with Podman exec -it container_name bash, there is no environment variable named secret_name. Am I missing something? Regards James

3 2

rootless podman, docker-credential-gcloud, and snaps
by Ioan Rogers 21 Jun '21

21 Jun '21

Hi, I'm on Ubuntu, and I've recently encountered an issue when trying to use rootless podman with the docker-credential-gcloud helper installed via snap. This works fine when using the official google-cloud-sdk apt packages, and it used to work with snap packages until last October. Here's what I see now: ``` $ podman pull gcr.io/private/image Trying to pull gcr.io/private/image... 2021/02/01 13:19:17.474248 cmd_run.go:994: WARNING: cannot create user data directory: cannot create "/root/snap/google-cloud-sdk/166": mkdir /root/snap: permission denied cannot create user data directory: /root/snap/google-cloud-sdk/166: Permission denied error getting credentials - err: exit status 1, out: `` Error: unable to pull gcr.io/private/image: Error initializing source docker://gcr.io/private/image:latest: error getting username and password: error getting credentials - err: exit status 1, out: `` ``` So it looks like the credential helper is being executed as root now. I'm not sure in which component the problem lies, or where I should file an issue. Any pointers would be appreciated. Thanks Ioan Rogers Sent with ProtonMail Secure Email.

3 5

Trouble with Podman secrets with v 3.2
by James Miller 20 Jun '21

20 Jun '21

Hi,. I sent a previous message with this subject, but have since solved my issues Many thanks, Regards James

1 0

Podman restore container failed
by Ali Hamieh 20 Jun '21

20 Jun '21

*HI,* *When I migrated a podman container from a google cloud rhel 8.3 vm to a local rhel 8.3 vm, I got the following error when restoring (Checkpoint and restore podman uses CRIU): * persmision:1: Error (criu/files-reg.c:2182): File . has bad mode 040755 (expect 040555) (00.343223) 1: Error (criu/files.c:1357): Can't open root (00.343659) Error (criu/cr-restore.c:1560): 163252 exited, status=1 (00.343707) Warn (criu/cr-restore.c:2469): Unable to wait 163252: No child processes (00.343974) mnt: Switching to new ns to clean ghosts (00.344242) Error (criu/cr-restore.c:2483): Restoring FAILED. *And from the local rhel 8.3 vm to the google cloud rhel 8.3 vm, I got:* bad mode 040555 (expect 040755) *So bad mode in reverse.* *Any ideas on how to do a workaround? not necessarily a permanent fix.* *The container is a podman container: quay.io/adrianreber/counter <http://quay.io/adrianreber/counter>* -- Best regards, Ali Hamieh, PhD *LinkedIn <https://www.linkedin.com/in/ali-hamieh-phd/>ResearchGate <https://www.researchgate.net/profile/Ali_Hamieh>*

4 4

Podman Community Cabal Meeting - July 15, 2021 - 10:00 a.m. EDT (UTC-4)
by Tom Sweeney 18 Jun '21

18 Jun '21

Hi All, You may have seen in another discussion started by Erik Bernoth about having a community meeting that was more of an open forum than what the Podman Community Meeting is. For the past several months, Urvashi Mohnani (cc'd) has been running an internal to Red Hat meeting that we call the "Cabal". People send Urvashi discussion topics, and they're added to the list. They're generally topics about future design, interesting issues, or anything related to the containers projects, Podman, Buildah, and Skopeo. We also generally have an open forum for a good chunk of time at the end of the meetings. Given that we are not having a Podman Community Meeting in July, we decided to make the July Cabal meeting open to the entire community rather than just the people at Red Hat. If you would like to attend, please do! If you have a topic that you'd like to be sure that we discuss, please send a note to Urvashi (cc'd) or myself. Also, send one of us a note if you'd like to be added to the calendar event. The meeting is free to attend and will be held via Google meet to start. The link to the room is: meet.google.com/ieq-pxhy-jbh In addition, we are planning to hold the Podman Community Cabal Meeting for the entire community on the third Thursday of the month at 10:00 Eastern from now on. The Cabal meeting will be in addition to the Podman Community Meeting and not a replacement for it. We still plan to hold the Podman Community Meetings on the first Tuesday of each month. I will send a reminder about the Cabal meetings about a week beforehand to this list, and I will also put something up on the podman.io site about it too. Thanks all! t

4 6

Podman on OpenWrt as user other than root
by W. Michael Petullo 18 Jun '21

18 Jun '21

I am trying to modify OpenWrt and its podman package to allow users other than root to manage containers on that system. I have made some progress, including working through some "bugs" in podman and the OpenWrt packages: https://github.com/containers/podman/issues/9687 https://github.com/containers/storage/pull/851 https://github.com/openwrt/packages/pull/15673 A summary of my work so far exists at https://github.com/openwrt/packages/issues/15096. There are two things I do not yet understand, so I am looking for a summary of how these things work or some recommended reading regarding them. (1) Non-root users cannot write to /sys/fs/cgroup/*. I am not sure how to safely handle this, and I have not yet figured out how other distributions do it. Does a privileged agent exist that performs the updates to /sys/fs/cgroup that are necessary to setup a container? (2) Running "podman run ..." wants to mount /proc and so on in the container. This fails when run as non-root with "mounting '/proc' to rootfs at '/proc' caused: operation not permitted." Again, I am not sure what performs these privileged operations on other distributions. Thank you, -- Mike :wq

2 2

Transitioning from docker: Problems with nftables
by Simon Szustkowski 17 Jun '21

17 Jun '21

Hi list, I am currently experimenting with podman with the ultimate goal to migrate my small private server from docker to podman. So far so good, but currently i am struggling with the nftables ruleset which i was managing the firewall with. This setup was quite good for docker, and i hoped that all i needed to do is to add the cni-podman0 interface to the list of container interfaces and am good to go. Unfortunately this is not the case. This is clearly an issue with nftables and podman's CNI, since i am able to access any running containers when i completely flush the ruleset. However i want to post this question here and not in any nftables related communitys because maybe that's just my misunderstanding of the way how podman handles networks. To clarify: I am speaking about rootful containers, since that required me to do the least changes to my ansible playbooks ;) So, currently i have a running traefik container, port forwarding to port 80 and 443 on the host, traefik is connected to the default network. This is an excerpt of my nftables ruleset: #!/usr/sbin/nft -f flush ruleset define podman = cni-podman0 define wan = eth0 table inet firewall { set tcp_accepted { type inet_service; flags interval; elements = { 80,443 } } set container_interfaces { type ifname; elements = { docker0,dck-backend,cni-podman0 } } chain icoming { ... #iifname @container_interfaces accept iifname $podman accept ... iif $wan tcp dport @tcp_accepted ct state new accept } chain forwarding { type filter hook forward priority 0; policy drop; # Forward all established and related traffic. Drop invalid traffic. ct state established,related accept ct state invalid drop # Docker #iifname @container_interfaces ct state new accept iifname $podman ct state new accept } chain outgoing { type filter hook output priority 0; policy drop; ct state new,established,related accept ct state invalid drop } } table ip router { chain prerouting { type nat hook prerouting priority 0 } chain postrouting { type nat hook postrouting priority 100 oif $wan masquerade persistent } } As you can see i tried to just add the cni-podman0 interface to the set of container interfaces, since that worked fine when i created additional docker networks. However this did not allow any incoming traffic to be routed towards the containers, but traffic originating from the containers could reach the internet without problems. Afterwards i tried to separate the podman interface from that set of interfaces because ultimately i hope to just need one single podman network, but this is also not working. However, i am able to access the containers from the host itself, a curl localhst:80 is returning a proper response. As i said, this ruleset was very fine with docker containers, so maybe there is something about podman networking internals i am not yet aware of? Hopefully someone of you could kindly point me to the right direction. Thank you very much.

1 0

Anyone run Jitsi Meet with Podman on Fedora?
by Philip Rhoades 14 Jun '21

14 Jun '21

People, I am interested in getting Jitsi running and like any first consideration of this sort of thing, my first thought is using Podman to do what I want - has anyone had got Jitsi Meet running satisfactorily? Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil(a)pricom.com.au

3 5

Podman Community Meeting - Tues June 1, 2021 11:00 a.m. EDT (UTC-4)
by Tom Sweeney 10 Jun '21

10 Jun '21

Hi All, Just a quick note that the next Podman Community Meeting is coming up a week from this coming Tuesday. It will be Tuesday June 1, 2021 at 11:00 a.m. EDT (UTC-4). We're overloaded with topics this time and will be talking about Podman and TYE, Podman v3.2.0 updates, Podman in Kubernetes and Podman Machine updates. The full agenda with the link to the video conference is here (https://podman.io/community/meeting/agenda/) Check out the link to WorldTImeBuddy at the top of the web page for the agenda for an easy time converter for your local time. As usual, no charge to attend! Also, I just posted the meeting notes from the May 2021 meeting. They include links to the slides on Sysbox runtime, a link to the video recording and my bad attempt at taking notes during the meeting. https://podman.io/community/meeting/notes/2021-05-04/ As a quick note, given the number of people that we've heard from who will be on vacation in early July, we have decided to not hold the meeting that month. Our following meeting will be Tuesday August 3rd, also at 11:00 a.m. EDT (UTC-4). t

6 17

Container ID 1000 cannot be mapped to a host ID - from pulling an image
by lejeczek 09 Jun '21

09 Jun '21

Hi guys. what is that below -> $ podman pull ... ... copying blob caccdbcee96e done Copying config 482386bf57 done Writing manifest to image destination Storing signatures Error processing tar file(exit status 1): Container ID 1000 cannot be mapped to a host ID Error: Error committing the finished image: error adding layer with blob "sha256:caccdbcee96ed12576a8ccc6350ba68fc2342695b8747fc8dcb60c0c9434d407": Error processing tar file(exit status 1): Container ID 1000 cannot be mapped to a host ID would anybody know? many thanks, L.

3 3