- Podman - Podman List Archives

Container Plumbing Days Conference - March 9th and 10th 2021 - 9:30 a.m. to 2:00 p.m. (UTC-5)
by Tom Sweeney 04 Mar '21

04 Mar '21

Hi All, Next Tuesday March 9th and Wednesday March 10th from 9:30 a.m. to 2:00 p.m. Eastern (UTC-5), the first ever Container Plumbing Days Conference will be happening. It's free to attend, all virtual, and we'll be using the hopin conferencing system. If you've attended one of the DevConf conferences lately, it's the same system that they use. The schedule of talks is up here (https://containerplumbing.org/schedule) and we've a wide range of speakers and topics. Again, registration if free and you can do so on this page: https://containerplumbing.org/register Hope to see a bunch of you there! t

1 1

Macvlan
by Rusty Sapper 03 Mar '21

03 Mar '21

I’m having trouble setting up a macvlan. I created my config under /etc/cni/net.d and can successfully start my continater with the macvlan network. However, when I exec into the container, it has no network access to anything except itself. I apologize, I'm new to podman. I need to be able to ssh into other hosts(jenkins nodes) to run tests. I am unable to use the host network due to other requirements. Any help would be appreciated. here is my macvlan config: { "cniVersion": "0.4.0", "name": "testmac1", "plugins": [ { "type": "macvlan", "master": "eno1np0", "ipam": { "type": "host-local", "routes": [ { "dst": "0.0.0.0/0" } ], "ranges": [ [ { "subnet": "10.89.0.0/24", "gateway": "10.89.0.1" } ] ] } }, { "type": "portmap", "capabilities": { "portMappings": true } } ] } ~

4 5

March 2, 2021 Podman Community Meeting Video Recording
by Tom Sweeney 02 Mar '21

02 Mar '21

Hi All, We held the March Podman Community Meeting earlier today and in case you missed it, the video is up for replay at: https://bluejeans.com/s/w9MNLQGTmf3 It was a jam packed agenda with some really great demos on krunvm and tent. I'm working on the notes from the meeting now and will add a link to the video there once they are posted on podman.io. I'll also include approximate start times inside the notes if you want to peruse that way later. However, I may not get those posted for a few days, so thought I'd send out this video link. Thanks to all who attended and hope to see some new faces at the Tuesday April 6, 2021 meeting as that will be held at 8:00 p.m. Eastern (UTC-4) to try and make it a bit more friendly to the folks in the Asia regions. t

1 0

Pushing image tagged with multiple tags to remote repo with the same digest
by Marcin Zajączkowski 02 Mar '21

02 Mar '21

Hi. I might miss something obvious - I don't have deep knowledge about containers, however, trying to migrate my docker-in-docker image building CI job to buildah, I've encountered the following problem. My image should be tagged with its real version and in addition with a special marker tag (such as "devel" or "stable" or "latest"). It seems to be a common practice with images. While in docker, I could just call: > docker build -t "$CI_REGISTRY_IMAGE:$VERSION" -t "$CI_REGISTRY_IMAGE:$MARKER_TAG" > docker push $CI_REGISTRY_IMAGE" with buildah, it is more problematic as I cannot use multiple tags on push (--all-tags switch has been also abandoned). I tried: > buildah bud -t "$CI_REGISTRY_IMAGE:$VERSION" -t "$CI_REGISTRY_IMAGE:$MARKET_TAG" > buildah push "$CI_REGISTRY_IMAGE:$VERSION" "$CI_REGISTRY_IMAGE:$VERSION" > buildah push "$CI_REGISTRY_IMAGE:$MARKET_TAG" "$CI_REGISTRY_IMAGE:$MARKET_TAG" but while "buildah images --digests" shows the same digest for those two tags, in the remote repository (GitLab CI container repository) these tags have two different digests (also both differ from the local one). I suspect there could be something changed in the manifest. Q. How can I have one image (with one digests) tagged multiple times in a container repository using buildah? buildah version 1.18.0 (image-spec 1.0.1-dev, runtime-spec 1.0.2-dev) on Fedora 33. Marcin P.S. I've seen https://github.com/containers/buildah/issues/2034, but I don't know if it is related.

2 3

Announcement: Support for Older Distros on Kubic Project/OBS
by Lokesh Mandvekar 02 Mar '21

02 Mar '21

Hi list, I'd like to get your eyes on this blog post: https://podman.io/blogs/2021/03/02/podman-support-for-older-distros.html It outlines our plans for support on older distros. In today's community meeting, I will also talk about plans for the other distro versions, both current and upcoming. See you there. -- Lokesh IRC, GitHub: lsm5 GPG: 0xC7C3A0DD https://keybase.io/lsm5

1 0

firewalling pods - how?
by lejeczek 01 Mar '21

01 Mar '21

Hi guys. I'm thinking of rootfull + macvlan pods and I wonder how to firewall those. Is there a preferred way or perhaps best practice for such a setup would anybody recommend? many thanks, L.

1 0

Podman Community Meeting Tomorrow - Tues March 2, 2021 - 11:00 a.m. EST (UTC-5)
by Tom Sweeney 01 Mar '21

01 Mar '21

Hi All, Just a quick reminder that the Podman Community Meeting will be starting in 23.5 hours from now at 11:00 a.m. Eastern (UTC-5) The Agenda is here: https://podman.io/community/meeting/agenda/ Video Conference link here: https://bluejeans.com/796412039 Free to attend and if you check out the agenda, you'll see we're packed full with a number of interesting topics. Hope to see you there! t

1 0

Podman networking best practices
by Youri LACAN-BARTLEY 01 Mar '21

01 Mar '21

Hi all! I'm scratching my head a little bit about how to set up my containers especially when it comes to networking. I've created a rootful pod with two containers to run nginx-proxy-manager (https://nginxproxymanager.com/) and be able to publish low ports (80 and 443). However, I now wish to run a variety of services that can be hosted in rootless containers. My main issue is how to have a reliable way of declaring these various rootless containers in nginx-proxy-manager without having to rely on static IPs. I know I can't use the dnsname plugin since the rootful and rootless containers won't be sharing the same podman network. The only workaround I've found so far is to publish high ports for my rootless containers and accessing them from within the nginx-proxy-manager rootful container using the default gateway of podman network (10.88.0.1) and the published high port in question. Is this the right way to go ? Thanks!

3 3

OCI runtime error when starting hub.docker.com/r/rocker images as non-root - how to troubleshoot?
by boardbill_unpretended＠simplelogin.co 01 Mar '21

01 Mar '21

Dear Podman list, I am just starting to dip my toes into running containers in Podman 2.2.1 on RHEL 8.3 (Linux kernel 4.18) and would appreciate guidance on how to diagnose and solve an error I get when running as non-root. My goal is to do R language development in containers, and I used `podman pull` to get these R images from the popular Rocker project (https://www.rocker-project.org/) https://hub.docker.com/r/rocker/r-base https://hub.docker.com/r/rocker/tidyverse https://hub.docker.com/r/rocker/rstudio The `r-base` image is just the R interpreter and it starts fine where I can just attach it to a terminal to run R commands. However, the other images (`tidyverse` and `rstudio`) are built on top of `r-base` and when I run them as non-root (e.g. `podman run -ti rocker/tidyverse`) they give this error: ``` Error: OCI runtime error: container_linux.go:370: starting container process caused: process_linux.go:459: container init caused: Running hook #0:: error running hook: exit status 1, stdout: , stderr: ``` I have no idea how to interpret and understand this error message. The only clue I have is that these two images run without errors if I append `sudo` to my `podman run` command. I also checked the Dockerfiles (such as this one: https://github.com/rocker-org/rocker-versioned/blob/master/tidyverse/3.6.3.…) and it's not clear what might be giving the error. Oh, and the `rocker/rstudio` image allows you to specify ports i.e. `-p 8787:8787` but even if I leave out this argument, I still get the error above when running `podman run` on this image. So I don't think it's an issue with opening or mapping ports (and Podman allows this as non-root, right?). How should I begin to diagnose the root of this problem and start fixing it? To be clear, my goal is to run the images listed above ideally as a non-root user. Thank you!

3 8

OCI permission denied
by lejeczek 24 Feb '21

24 Feb '21

Hi guys. Here are errors from my unsuccessful attempt to create a rootless container, which to novices such as myself are quite cryptic: -> $ podman run -d --restart=always --pod=jat-${HOSTNAME%%.*} --security-opt label=disable --volume /srv/containers/podmania/jat-redis:/data --name redis docker.io/library/redis ERRO[0000] error starting some container dependencies ERRO[0000] "container_linux.go:370: starting container process caused: process_linux.go:459: container init caused: rootfs_linux.go:59: mounting \"sysfs\" to rootfs at \"/sys\" caused: operation not permitted: OCI permission denied" Error: error starting some containers: internal libpod error I'm trying to drop the container into a pod which is rootless too. The error persist also with/in 'Permissive' selinux. Somebody could help decrypt & troubleshoot this? I'm on Centos Steam with: podman-3.0.0-0.33rc2.module_el8.4.0+673+eabfc99d.x86_64 many thanks, L.

3 5