- Podman - Podman List Archives

Re: Building Podman 2.x using Spack for RHEL 7
by Felder, Christian 19 Oct '20

19 Oct '20

May have a look at the kubic project on OBS https://software.opensuse.org/download/package?package=podman&project=devel… Best Christian >>> Am 19.10.2020 um 21:24 schrieb James Ault via Podman <podman(a)lists.podman.io>: >>> >> >> Hello. >> >> I learned during the community meeting on Oct 6th that Podman in RHEL 7 is unfortunately frozen at 1.6.4. >> >> Interest in Podman 2.x for RHEL 7 has caused some of our developers to ask if an effort for building Podman and associated tools (skopeo, buildah, networking, etc) with Spack could be explored. >> >> https://computing.llnl.gov/projects/spack-hpc-package-manager >> >> https://github.com/spack/spack/issues/2115 >> >> https://spack-tutorial.readthedocs.io/en/latest/tutorial_packaging.html >> >> Certainly the best option is to use RHEL distributed RPM packages, but exploring a near term option for RHEL 7 is also important to us. >> >> Are all the necessary pieces available from https://github.com/containers/podman ? >> >> If multiple git repos are required, we want to make sure to include them all. Are there any other special instructions or areas to use caution? >> >> Thanks. >> >> -James Ault >> aultj9(a)yahoo.com >> >> >> _______________________________________________ >> Podman mailing list -- podman(a)lists.podman.io >> To unsubscribe send an email to podman-leave(a)lists.podman.io

1 0

Building a Podman Jitsi Server
by Philip Rhoades 19 Oct '20

19 Oct '20

People, I want to build this and from the Jitsi Manual Installation guide I have marked up the attached diagram - can people see any issues with building this container with Fedora and Podman? - has anyone tried it already? - is anyone else interested in helping / co-operating? Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil(a)pricom.com.au

4 3

locking down network access with proxy, app, and database scheme
by Peter Buffon 13 Oct '20

13 Oct '20

I'm currently looking for advice on using Podman to implement what I think is a fairly common application scheme, deploying a WordPress instance with a MariaDB backend and Nginx as a reverse-proxy. Ideally I'd like to recreate a DMZ approach where the reverse proxy doesn't have access to the database or any other containers on the host. I have almost accomplished this with Docker Compose by attaching a frontend network to the reverse proxy and the application containers and a backend network to the application and database containers. This is a complicated approach and doesn't solve the issue of all application containers being accessible from the reverse proxy container. I have tried two different approaches to accomplish something similar with Podman, but they both ended with essentially the same result. Method one: Enclose all three containers in a single pod. These pods can access each other via localhost:port. This approach is not ideal because the reverse proxy container has access to both the application and database containers. Method two: Create a new network, cni-podman0, with the dnsname CNI plugin and each container is created in its own pod. This approach is also not ideal because any container on the cni-podman0 network can access any other container on the same network using the pod's name (even if containers and pods do not have published ports). Any suggestions on where to go from here? Could SELinux or BPF be possible solutions or am I missing an easier solution? I also thought about assigning IP addresses to each pod and using the firewall CNI plugin to lock down access by IP and port, but limited documentation on integrating Firewalld and Podman has limited me from experimenting further. I realize Kubernete's service and network policy features essentially solves this problem, but I am looking for a simplified single host approach here. Thanks, Peter

2 1

Newbie Question
by Tom Sweeney 11 Oct '20

11 Oct '20

I'm not sure why, but the original of this email was bounced by the server. I'm sending it again with my answer. -------- Forwarded Message -------- Subject: Newbie Question Date: Sat, 10 Oct 2020 05:04:01 +0000 From: Jonathan Aquilina <jaquilina(a)eagleeyet.net> To: podman-bounces(a)lists.podman.io <podman-bounces(a)lists.podman.io> Good Morning, I have a quick question regarding podman, is it meant to be a replacement for docker and or Kubernetes, or does it work hand in hand with them? Regards, Jonathan Simple answer Yes. Podman can work alongside of Docker or it can replace it. As noted on the podman.io website: Simply put: *alias docker=podman*. We also work with Kubernetes with these commands: http://docs.podman.io/en/latest/markdown/podman-generate-kube.1.html http://docs.podman.io/en/latest/markdown/podman-play-kube.1.html But for a richer Kubernetes environment, you might want to look at CRI-O https://cri-o.io/ and it's GitHub repo (https://github.com/cri-o/cri-o) Others more involved than I with the Kubernetes side of things will likely have more insight. Welcome to the Podman community! t

3 2

October 6, 2020 Podman Community Meeting Notes
by Tom Sweeney 09 Oct '20

09 Oct '20

Hi All, Just a quick thank you to the 34 attendees that joined us for the very first Podman Community Meeting this past Tuesday October 6, 2020. As mentioned previously, we're planning to hold these meetings on the first Tuesday of the month at 11:00 a.m. Eastern time. The next meeting will be on Tuesday November 3, 2020 at 11:00 a.m. Eastern again. As this coincides with Election day in the US, we plan to record the meeting for later consumption in case that time works best for you to get out and vote. More details on the meeting will be sent with the agenda about a week prior. We've a couple of discussion points already, please feel free to send others to me. Also I've just posted the meeting notes from the last meeting up on the podman.io site at: https://podman.io/community/meeting/2020-10-06/. I need to add a link on the "Join Our Community" to the new meeting page, that's a WIP. Thanks again to all of you who attended and looking forward to seeing you on November 3! t

1 0

Reminder: Podman Community Meeting - Tuesday October 6, 2020 - 11:00 a.m. Eastern.
by Tom Sweeney 05 Oct '20

05 Oct '20

Hi All! The Podman Community Meeting is less that 24 hours away! We'll be meeting by BlueJeans video conference on Tuesday October 6, 2020 at 11:00 a.m (UTC-4) and all are welcome. For more information on the topics and the video conference link, please see the agenda on Podman.io. (https://podman.io/blogs/2020/09/30/Oct-6-Agenda.html) Hope to see you there! t

1 0

Podman Community Meeting - Tuesday October 3, 2020 - 11:00 a.m. Eastern
by Tom Sweeney 01 Oct '20

01 Oct '20

The first Podman Community Meeting will be this coming Tuesday October 3, 2020 at 11:00 a.m Eastern. This meeting will be one hour and all are welcome. There's no cost to attend and we'll be holding the meeting using BlueJeans (https://www.bluejeans.com) video conferencing. Agenda with more information below my signature and also on podman.io (https://podman.io/blogs/2020/09/30/Oct-6-Agenda.html) Hope to see you there! t Podman Community Meeting Agenda Tuesday October 6, 2020 11:00 a.m. to 12:p.m. Eastern (UTC−04:00) Bluejeans: https://bluejeans.com/796412039 (If you have trouble connecting, please reach out in IRC freenode #podman) Attendees: Agenda: 11:00 to 11:05 Welcoming Remarks 11:10 to 11:20 Introductions - All Attendees 11:20 to 11:30 Upcoming Podman Release Features and Schedule - Matt Heon 11:30 to 11:40 Podman 3.0 Planning - Dan Walsh 11:40 to 12:00 Open Forum/Questions and Answers Session Next Meeting:Tuesday November 3, 2020 11:00 a.m. Eastern (UTC-04:00) Meeting Notes:

2 4

Podman logs to Splunk HEC
by Osama Elswah 30 Sep '20

30 Sep '20

Is there a way to send podman logs to Splunk HEC as docker does? https://docs.docker.com/config/containers/logging/splunk/ Regards Osama

4 3

Bind to HTTP(S) ports in a rootful container executing application as a non-root user
by Chintan from Rebhu 22 Sep '20

22 Sep '20

Hello!! I am starting a container using the following command `sudo podman run -p 80:80 -v ./envoy.yaml:/etc/envoy/envoy.yaml:Z --name dev-envoy --network dev --security-opt label=type:envoy.process envoyproxy/envoy:v1.15.0` The application starts but exits. It cannot bind to container's port 80.Here is an excerpt from logs: `cannot bind '0.0.0.0:80': Permission denied` The SEModule policy was generated using Udica. It can be reviewed here <https://pastebin.com/3Du3GTzt>. Steps for this process are discussed in an earlier thread named 'Logs show permission denied error'. The containerfile used to created this container image executes the application as a non-root user. As the container exits right after it starts, it is impossible to access the container's terminal and attempt elementary troubleshooting steps. How to bind to HTTP(S) and other lower ports in a rootful container when the application executes as a non-root user? Thank you. -- Chintan Mishra

2 3

Security Announcement
by Matt Heon 22 Sep '20

22 Sep '20

Today, we're releasing updates to fix CVE-2020-14370 [1], a security issue in Podman. This is a medium-severity information disclosure vulnerability that affects containers created using Podman’s Varlink API or the Docker-compatible version of its REST API. If two or more containers are created using these APIs, and the first container had environment variables added to it when it was created, all subsequent containers created using the Varlink or Docker-compatible REST APIs will also have these environment variables added. This effect does not persist after restarting the Podman API service. Podman v2.0.5 and higher contain a fix for the CVE. If you use either of these APIs, please update to Podman v2.0.5 or later. We will also be patching the long-term support v1.6.4 release used in RHEL and CentOS. [1] https://access.redhat.com/security/cve/cve-2020-14370

1 0