- Podman - Podman List Archives

Where is the doc?
by Álvaro Castillo 26 May '20

26 May '20

Hi, I want to access to doc of podman but It's does not exist (?) http://docs.podman.io/en/v1.6.4/Introduction.html Cheers!

6 27

Building a Podman Equivalent to CIS Benchmark for Docker
by Scott McCarty 15 May '20

15 May '20

All, I got a really good question on my blog [1] and I'm wondering if anybody else has started down this path? In a nutshell, the Docker CIS benchmark looks for files in certain place, etc so it's really targeted towards Docker, but I don't see any reason why we couldn't take it and build an equivalent for Podman. Not sure when I might have time to tackle this, but figured it was worth seeing if anybody had started any work around this? [1]: http://crunchtools.com/meeting-cis-benchmark/ Best Regards Scott M -- -- Moving Wordpress, Mediawiki and Request Tracker into containers: http://crunchtools.com/a-hackers-guide-to-moving-linux-services-into-contai… -- Scott McCarty Product Management - Containers, Red Hat Enterprise Linux & OpenShift Email: smccarty(a)redhat.com Phone: 312-660-3535 Cell: 330-807-1043 Web: http://crunchtools.com Using Azure Pipelines with Red Hat Universal Base Image and Quay.io: https://red.ht/2TvYo3Y

1 0

Containers terminate on shell logout
by Ryan Wilson 11 May '20

11 May '20

Hi podman team, I wanted to try out Fedora CoreOS for a couple of upcoming projects so I installed it on bare metal and logged in via ssh. I can start a container detached (as my logged in user) and then verify that the server is running but when I logout of the ssh session, the container stops. From looking at the logs, it appears that the container process is getting SIGTERM Which I assume means the container was stopped gracefully. But by what? How do I stop this behavior? If I detach a container, I would like it to outlive my session. This doesn’t happen when I sudo to root and start the container, only when running as the non-root user. Any suggestions? Ryan

6 7

Podman build and commit does not seem to use overlayfs
by Alvin Sebastian 10 May '20

10 May '20

Hi, I run podman as root, but it seems that the build and commit commands always create images that double the size on every change. I run podman on ArchLinux with F2FS disk. Is F2FS not supported? I could not find anything on the web that mentions this. # podman info host: arch: amd64 buildahVersion: 1.14.8 cgroupVersion: v1 conmon: package: Unknown path: /usr/bin/conmon version: 'conmon version 2.0.15, commit: 1bddbf7051a973f4a4fecf06faa0c48e82f1e9e1' cpus: 8 distribution: distribution: arch version: unknown eventLogger: file hostname: archasw idMappings: gidmap: null uidmap: null kernel: 5.6.10-arch1-1 memFree: 8687009792 memTotal: 16554958848 ociRuntime: name: runc package: Unknown path: /usr/bin/runc version: |- runc version 1.0.0-rc10 commit: dc9208a3303feef5b3839f4323d9beb36df0a9dd spec: 1.0.1-dev os: linux rootless: false slirp4netns: executable: "" package: "" version: "" swapFree: 0 swapTotal: 0 uptime: 20h 4m 31.66s (Approximately 0.83 days) registries: search: - docker.io - registry.fedoraproject.org - quay.io - registry.access.redhat.com - registry.centos.org store: configFile: /etc/containers/storage.conf containerStore: number: 3 paused: 0 running: 0 stopped: 3 graphDriverName: overlay graphOptions: overlay.mountopt: nodev graphRoot: /var/lib/containers/storage graphStatus: Backing Filesystem: f2fs Native Overlay Diff: "false" Supports d_type: "true" Using metacopy: "true" imageStore: number: 5 runRoot: /var/run/containers/storage volumePath: /var/lib/containers/storage/volumes Example with commit: # podman image tree centos7-systemd Image ID: 0cd1f34a88bc Tags: [localhost/centos7-systemd:latest] Size: 227.7MB Image Layers └── ID: 913cda0bf08e Size: 227.7MB Top Layer of: [localhost/centos7-systemd:latest] # podman run -it centos7-systemd /bin/bash # yum update # exit # podman commit inspiring_ganguly inspiring_ganguly # podman image tree inspiring_ganguly Image ID: feb029dfb122 Tags: [localhost/inspiring_ganguly:latest] Size: 436.4MB Image Layers ├── ID: 913cda0bf08e Size: 227.7MB Top Layer of: [localhost/centos7-systemd:latest] └── ID: 3ff0a6be06fa Size: 208.7MB Top Layer of: [localhost/inspiring_ganguly:latest] Regards, Alvin

4 4

why is --ip limited to the default network
by Gordon Messmer 08 May '20

08 May '20

I'd like to use containers for services that overlap in the ports they use. For example, I'd like to run FreeIPA and also a caching DNS server. (Or FreeIPA with Windows auth and Samba, which both use 137-139 and 445.) My preferred setup for this is bridged networking without NAT, and I've got that set up. I manually configured a bridge device with the Ethernet interface as a member, and I've configured a CNI network with "host-local" IPAM. I can create containers attached to that network, and they'll get an address that's on the host's network. Clients can connect to them. All of that is working as expected. However, especially in the case of running a DNS server, I'd really like to have a fixed address for the container, and I don't see a way to do that (other than creating another network definition with "static" IPAM, which would require a network definition for every container with a fixed address). The documentation for podman-run says that --ip can't be used when a container is joined to an "additional" network, and I don't understand that. The container is only connected to one network, as indicated by the output of "podman inspect". So, to the question in the subject, why is --ip only allowed on the default network? Is there any other mechanism for assigning a fixed IP address to a container that's on a user-defined network?

2 5

Re: Can't access ports outside host machine
by Daniel Walsh 08 May '20

08 May '20

On 5/8/20 09:18, Navdeep Uniyal wrote: > > Hi guys, > > > I am seeing a behavior: > When I run a container without root, I can reach the exposed ports > from outside the host machine. But, when I run the same container > using root access, I can't reach the port from outside.Is this an > expected behavior. If yes, please help me how can I access the ports > outside host while running using root access: > I am using following command: > > > podman run -dit -p=8000:8000 --privileged --name coa apache:latest > > Â > > Kind Regards, > > Navdeep > > > _______________________________________________ > Podman mailing list -- podman(a)lists.podman.io > To unsubscribe send an email to podman-leave(a)lists.podman.io I would expect them to behave the same, and in neither case be accessible from outside of the machine. We believe that modifications of the firewall rules should be done by the admin and not be done by podman for external access to ports.

2 1

Can't access ports outside host machine
by Navdeep Uniyal 08 May '20

08 May '20

Hi guys, I am seeing a behavior: When I run a container without root, I can reach the exposed ports from outside the host machine. But, when I run the same container using root access, I can't reach the port from outside.Is this an expected behavior. If yes, please help me how can I access the ports outside host while running using root access: I am using following command: podman run -dit -p=8000:8000 --privileged --name coa apache:latest Kind Regards, Navdeep

1 0

Re: podman pull container-registry.oracle.com auth
by Anatoliy Tishaev 03 May '20

03 May '20

Same for me on Fedora 31. Authentication via podman doesn't work for container-registry.oracle.com. With docker - works via sudo only. Without sudo I get "open /etc/docker/certs.d/container-registry.oracle.com: permission denied" error

2 1

Podman rootless and virtualbox shared folders using subuid
by Dr Giuseppe Insana 30 Apr '20

30 Apr '20

Dear Podman users and developers I wonder if you have encountered a similar problem to mine and whether you may have a solution. Description of the problem: I cannot run containers where non-root users of the container (e.g. uid 101 of nginx for a nginx container) have possibility to write to a mounted folder from virtualbox. Even when mounting the shared folder with full writing permissions (dmode/fmode 0777), the new files created appear as belonging to nobody (uid 65534). This prevents any application which creates new files or directories (e.g. wordpress). The setup: * I have a linux virtual machine (Alpine 3.11.6, tested on both 5.4.27 and 5.4.34 kernels) running over a linux host (Ubuntu 18.04.4 LTS) on which I create and run rootless pods and containers. * virtualbox version: 5.2.34 * podman version: tried both 1.8.2 and 1.9.1 * shared folder and its contents are owned by 1001:1001 on the host * the folder is mounted in the vm with the command /sbin/mount.vboxsf -o rw,uid=100100,gid=1001,dmode=0775,fmode=0664 wpcontent /media/sf_wpcontent * the user running the container in the vm has id/gid 1001:1001 and subuid 100000:65536 Investigation: I'll paste the result of commands run at three levels: the host, the vm and the container. * This is on the underlying host: $ ls -ln uploads/sites/3/2020 total 36 drwxrwxr-x 2 1001 1001 20480 Jan 31 16:05 01 drwxrwxr-x 2 1001 1001 12288 Feb 18 08:34 02 drwxrwxr-x 2 1001 1001 4096 Apr 21 16:48 04 $ touch uploads/sites/3/2020/host-touched $ ls -ln uploads/sites/3/2020 total 36 drwxrwxr-x 2 1001 1001 20480 Jan 31 16:05 01 drwxrwxr-x 2 1001 1001 12288 Feb 18 08:34 02 drwxrwxr-x 2 1001 1001 4096 Apr 21 16:48 04 -rw-rw-r-- 1 1001 1001 0 Apr 22 15:10 host-touched $ sudo chown 100100:100100 uploads/sites/3/2020/host-touched $ ls -ln uploads/sites/3/2020 total 36 drwxrwxr-x 2 1001 1001 20480 Jan 31 16:05 01 drwxrwxr-x 2 1001 1001 12288 Feb 18 08:34 02 drwxrwxr-x 2 1001 1001 4096 Apr 21 16:48 04 -rw-rw-r-- 1 100100 100100 0 Apr 22 15:10 host-touched * This is in the VM: $ ls -ln /media/sf_wpcontent/uploads/sites/3/2020 total 36 drwxrwxr-x 1 100100 1001 20480 Jan 31 16:05 01 drwxrwxr-x 1 100100 1001 12288 Feb 18 08:34 02 drwxrwxr-x 1 100100 1001 4096 Apr 21 16:48 04 -r-xr-xr-x 1 100100 1001 0 Apr 22 15:10 host-touched $ touch /media/sf_wpcontent/uploads/sites/3/2020/vm-touched $ ls -ln /media/sf_wpcontent/uploads/sites/3/2020 total 36 drwxrwxr-x 1 100100 1001 20480 Jan 31 16:05 01 drwxrwxr-x 1 100100 1001 12288 Feb 18 08:34 02 drwxrwxr-x 1 100100 1001 4096 Apr 21 16:48 04 -r-xr-xr-x 1 100100 1001 0 Apr 22 15:10 host-touched -r-xr-xr-x 1 100100 1001 0 Apr 22 15:28 vm-touched $ chown 100100:100100 /media/sf_wpcontent/uploads/sites/3/2020/vm-touched $ ls -ln /media/sf_wpcontent/uploads/sites/3/2020 total 36 drwxrwxr-x 1 100100 1001 20480 Jan 31 16:05 01 drwxrwxr-x 1 100100 1001 12288 Feb 18 08:34 02 drwxrwxr-x 1 100100 1001 4096 Apr 21 16:48 04 -r-xr-xr-x 1 100100 1001 0 Apr 22 15:10 host-touched -r-xr-xr-x 1 100100 1001 0 Apr 22 15:28 vm-touched This is in the container: # ls -ln uploads/sites/3/2020 total 36 drwxrwxr-x 1 101 0 20480 Jan 31 16:05 01 drwxrwxr-x 1 101 0 12288 Feb 18 08:34 02 drwxrwxr-x 1 101 0 4096 Apr 21 16:48 04 -r-xr-xr-x 1 65534 1001 0 Apr 22 15:10 host-touched -r-xr-xr-x 1 65534 1001 0 Apr 22 15:28 vm-touched # touch uploads/sites/3/2020/cont-touched $ ls -ln uploads/sites/3/2020 total 36 drwxrwxr-x 1 101 0 20480 Jan 31 16:05 01 drwxrwxr-x 1 101 0 12288 Feb 18 08:34 02 drwxrwxr-x 1 101 0 4096 Apr 21 16:48 04 -r-xr-xr-x 1 65534 1001 0 Apr 22 15:31 cont-touched -r-xr-xr-x 1 65534 1001 0 Apr 22 15:10 host-touched -r-xr-xr-x 1 65534 1001 0 Apr 22 15:28 vm-touched # chown 100100:100100 uploads/sites/3/2020/cont- touched chown: uploads/sites/3/2020/cont-touched: Invalid argument # chown nginx:nginx uploads/sites/3/2020/cont-to uched # ls -ln uploads/sites/3/2020 total 36 drwxrwxr-x 1 101 0 20480 Jan 31 16:05 01 drwxrwxr-x 1 101 0 12288 Feb 18 08:34 02 drwxrwxr-x 1 101 0 4096 Apr 21 16:48 04 -r-xr-xr-x 1 65534 1001 0 Apr 22 15:31 cont-touched -r-xr-xr-x 1 65534 1001 0 Apr 22 15:10 host-touched -r-xr-xr-x 1 65534 1001 0 Apr 22 15:28 vm-touched rm -f uploads/sites/3/2020/cont-touched rm: can't remove 'uploads/sites/3/2020/cont-touched': Value too large for data type The behaviour is inconsistent, for example: in the vm: $ ls -ln uploads/sites/ total 16 drwxrwxr-x 1 100100 1001 4096 Apr 22 15:52 2 drwxrwxr-x 1 100100 1001 4096 Apr 22 08:52 3 drwxrwxr-x 1 100100 1001 4096 Jan 21 14:30 4 drwxrwxr-x 1 100100 1001 4096 Jun 14 2017 5 inside the container: # ls -ln uploads/sites/ total 16 drwxrwxr-x 1 65534 1001 4096 Apr 22 15:52 2 drwxrwxr-x 1 101 0 4096 Apr 22 08:52 3 drwxrwxr-x 1 65534 1001 4096 Jan 21 14:30 4 drwxrwxr-x 1 65534 1001 4096 Jun 14 2017 5 To clear the inconsistencies I can use the command (as vm's root): # echo 3 > /proc/sys/vm/drop_caches This appears to "correct" the problem by realigning the id of the directories. But everytime a new file or directory is created, they are still created as user nobody (65534). Even for applications where no new files/directories are created (e.g. appending to existing file), the drop_caches command would need to be applied everytime the machine is rebooted, thus rendering the whole system not really stable/usable. The only two "solutions" that "work" are: 1) to have containers where the services run as root. Thus not using subuid and files are created as the user running podman. Mounting the shared folder with uid equal to the podman user is ok. Obviously this is not always possible/desirable, as containers often have a different user running the command. 2) mounting the shared folder with full permissions and without using a subuid, i.e. like this: /sbin/mount.vboxsf -o rw,uid=1001,gid=101,dmode=0777,fmode=0555 wpcontent /media/sf_wpcontent this is obviously far from desirable, as it allows any user of the vm permission to write into the folder or delete files If you have used rootless containers writing on shared virtual folders and have found a working solution, please let me know. Thank you very much! Best regards Giuseppe PS: I've also tried adding a user with uid/gid 100100:100100 in the vm. This does not make any difference to the problems reported above PPS: I've also tried changing id/gid of host folder or of the user in the vm running podman. No changes.

1 0

Q re errors pulling a docker image
by Philip Rhoades 29 Apr '20

29 Apr '20

People, When I run this: # podman run \ --publish 3085:3085 \ -d \ --name coda \ codaprotocol/coda-demo:sandbox-32a.1 I get this: ERRO[0003] Error deleting network: missing prevResult from earlier plugin ERRO[0003] Error while removing pod from CNI network "podman": missing prevResult from earlier plugin ERRO[0003] Error refreshing container 19e58fe9a7c81de33fb8833610cd9a0be3edadf867acf7acf9b3c78a32483835: missing prevResult from earlier plugin Trying to pull docker.io/codaprotocol/coda-demo:sandbox-32a.1... . . The container starts up OK and I am about to see if it is actually doing what it is supposed to (I am just getting started with Coda Protocol) but should I be concerned about those errors? Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil(a)pricom.com.au

2 2