- Podman - Podman List Archives

Running systemd inside a container : systemd-logind error with degraded state
by Philipp Richter 28 Apr '20

28 Apr '20

Hello, I was wondering if it's normal that systemd inside a container is in a degraded state with systemd-logind not being able to start. $ journalctl -b -a Apr 28 14:05:13 824304d0fa93 systemd[27]: systemd-logind.service: ProtectHostname=yes is configured, but UTS namespace setup is prohibited (container manager?), ignoring namespace> Apr 28 14:05:13 824304d0fa93 systemd[1]: Starting Permit User Sessions... Apr 28 14:05:13 824304d0fa93 systemd[27]: systemd-logind.service: Failed to apply hostname restrictions: Permission denied Apr 28 14:05:13 824304d0fa93 systemd[27]: systemd-logind.service: Failed at step SECCOMP spawning /usr/lib/systemd/systemd-logind: Permission denied Apr 28 14:05:13 824304d0fa93 systemd[1]: systemd-logind.service: Main process exited, code=exited, status=228/SECCOMP Apr 28 14:05:13 824304d0fa93 systemd[1]: systemd-logind.service: Failed with result 'exit-code'. Apr 28 14:05:13 824304d0fa93 systemd[1]: Failed to start Login Service. Apr 28 14:05:13 824304d0fa93 systemd[1]: systemd-logind.service: Scheduled restart job, restart counter is at 1. Apr 28 14:05:13 824304d0fa93 systemd[1]: Stopped Login Service. Apr 28 14:05:13 824304d0fa93 systemd[1]: Condition check resulted in Load Kernel Module drm being skipped. Apr 28 14:05:13 824304d0fa93 systemd[1]: Starting Login Service... Apr 28 14:05:13 824304d0fa93 systemd[31]: systemd-logind.service: ProtectHostname=yes is configured, but UTS namespace setup is prohibited (container manager?), ignoring namespace> Apr 28 14:05:13 824304d0fa93 systemd[31]: systemd-logind.service: Failed to apply hostname restrictions: Permission denied Apr 28 14:05:13 824304d0fa93 systemd[31]: systemd-logind.service: Failed at step SECCOMP spawning /usr/lib/systemd/systemd-logind: Permission denied Apr 28 14:05:13 824304d0fa93 systemd[1]: systemd-logind.service: Main process exited, code=exited, status=228/SECCOMP Apr 28 14:05:13 824304d0fa93 systemd[1]: systemd-logind.service: Failed with result 'exit-code'. Apr 28 14:05:13 824304d0fa93 systemd[1]: Failed to start Login Service. Then $ systemctl status gives : ● 824304d0fa93 State: degraded Jobs: 0 queued Failed: 1 units Since: Tue 2020-04-28 14:05:11 UTC; 23min ago CGroup: / ├─crun-exec │ ├─43 bash │ ├─70 systemctl status │ └─71 less ├─init.scope │ └─1 /sbin/init └─system.slice ├─systemd-journald.service │ └─15 /usr/lib/systemd/systemd-journald └─dbus.service └─26 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only I am starting a custom archlinux base image like this : $ sudo podman run -d --cap-add=NET_ADMIN localhost/popsulfr/archlinux-base /sbin/init The output of podman info : host: arch: arm64 buildahVersion: 1.14.8 cgroupVersion: v2 conmon: package: Unknown path: /usr/bin/conmon version: 'conmon version 2.0.15, commit: 1bddbf7051a973f4a4fecf06faa0c48e82f1e9e1' cpus: 4 distribution: distribution: archarm version: unknown eventLogger: journald hostname: rock64 idMappings: gidmap: null uidmap: null kernel: 5.6.7-1-ARCH memFree: 3530731520 memTotal: 4097687552 ociRuntime: name: crun package: Unknown path: /usr/bin/crun version: |- crun version 0.13 commit: e79e4de4ac16da0ce48777afb72c6241de870525 spec: 1.0.0 +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL os: linux rootless: false slirp4netns: executable: "" package: "" version: "" swapFree: 0 swapTotal: 0 uptime: 29m 39.39s registries: search: - docker.io - registry.fedoraproject.org - quay.io - registry.access.redhat.com - registry.centos.org store: configFile: /etc/containers/storage.conf containerStore: number: 1 paused: 0 running: 1 stopped: 0 graphDriverName: overlay graphOptions: overlay.mountopt: nodev graphRoot: /var/lib/containers/storage graphStatus: Backing Filesystem: btrfs Native Overlay Diff: "true" Supports d_type: "true" Using metacopy: "false" imageStore: number: 1 runRoot: /var/run/containers/storage volumePath: /var/lib/containers/storage/volumes Best Regards, Philipp Richter

2 2

Procedure to join community
by Simran Jain 25 Apr '20

25 Apr '20

Good evening Please provide me a appropriate process to join podman community. Thank you

3 2

SubUID limitations?
by Gordon Messmer 22 Apr '20

22 Apr '20

Is there a limit on the size of UID ranges usable for subuid? I'm trying to run a rootless container, and in that container use sssd user info from Active Directory. sssd produces very large UID and GID values, which I think is the problem that's being reported. First of all, the host system can resolve information for a user named build: [gitlab-runner@dvpackerbld03 ~]$ id build uid=1985001175(build) gid=1985001156(development) groups=1985001156(development),987(docker) And I can run the container that I've created, and resolve information for that user there, too: [gitlab-runner@dvpackerbld03 ~]$ podman run -it \ > --volume=/var/lib/sss/pipes/:/var/lib/sss/pipes/:rw \ > --volume=/etc/sssd/:/etc/sssd/:ro \ > --volume=/etc/krb5.conf:/etc/krb5.conf:ro \ > --volume=/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro \ > --volume=/etc/nsswitch.conf:/etc/nsswitch.conf:ro \ > e1f5919f1888 id build uid=1985001175(build) gid=1985001156(development) groups=1985001156(development),996(docker) But if I try to run "su build" within that container, I get an error: [gitlab-runner@dvpackerbld03 ~]$ podman run -it \ --volume=/var/lib/sss/pipes/:/var/lib/sss/pipes/:rw \ --volume=/etc/sssd/:/etc/sssd/:ro \ --volume=/etc/krb5.conf:/etc/krb5.conf:ro \ --volume=/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro \ --volume=/etc/nsswitch.conf:/etc/nsswitch.conf:ro \ e1f5919f1888 su build -c ls su: cannot set groups: Invalid argument subuid and subgid are set up as: [gitlab-runner@dvpackerbld03 ~]$ cat /etc/subuid gitlab-runner:110000:3000000000 [gitlab-runner@dvpackerbld03 ~]$ cat /etc/subgid gitlab-runner:110000:3000000000

3 3

Podman v2 development update
by Brent Baude 17 Apr '20

17 Apr '20

In the last few days, the Podman development team has been working to release Podman-1.9.0. This is likely to be the last Podman-1.X release before we transition to Podman-2.x. We have been working since November 2019 to make a significant overhaul of Podman’s architecture. And if we did our job correctly, most casual Podman users will not notice a difference. We will continue to investigate and fix issues in Podman-1.x versions but severity of the bug and priority will dictate our response. What some users who follow upstream development may notice is that while we make the final push to a 2.x release, our GitHub repository will look drastically different. For some period of time, certain Podman commands, if built based on upstream, may not function exactly as expected nor even exist. We already know we will need to disable some of our CI testing framework as part of this final push until we have a more complete Podman v2.x. We will not release Podman 2.0 until we are satisfied that it is ready. While upstream development will be impacted by the announced migration to Podman v2.x, you can still open issues and contribute pull requests to the project. As has been the standard with our project, we will remain transparent in our development activities and try to keep our community appraised of our progress. We are excited for some of the technical advancements that Podman v2.x will give our users. Subsequent blog posts will be written on those advancements and why they matter to our users. Brent

4 8

Possible to customize outgoing IP in rootless container
by mh+podman＠scrit.ch 17 Apr '20

17 Apr '20

Hi assuming a host has 2 ips: 192.168.1.1 and 192.168.1.2 (as an ip alias). By default outgoing traffic is on 192.168.1.1 - is it possible to tell a rootless container (actually slirp4netns), that 192.168.1.2 should be used as the src ip? I would assume that this would need to be done be slirp4netns, but I wasn't able to find such an option. thanks and best mh

4 3

ZFS Support
by Ingvar.Bogdahn＠itzbund.de 16 Apr '20

16 Apr '20

Hello, I would like to know to which extent ZFS is supported as filesystem for podmain containers. In particular, I'd like to know if it is possible to use ZFS clones as a backend for the container filesystem layering and if zfs datasets are usable for rootless containers (using zfs delegation). Is ZFS integration done transparently, i.e. are zfs dataset clones created when a new layer is created in a transparent way without explicit zfs commands? Thank you Best regards, Ingvar Bogdahn

4 4

Issues Pulling Multiarch Containers
by Adam Kimball 14 Apr '20

14 Apr '20

Hello all, Recently I’ve been attempting to get podman to pull containers on a ppc64le centos 8 node, and have found that it grabs the amd64 versions of these containers regardless of the architecture flag that’s set. See [1] for an example output. This is on a standard centos8-cloud image. I’m wondering if this is a known bug, and if there are any known workarounds. Thanks! Adam Kimball [1] - http://paste.openstack.org/show/792053/

3 2

Docker Compose Standardization News
by Scott McCarty 13 Apr '20

13 Apr '20

List, I'm sharing these articles because I know we have a community and some are keeping their eye on Docker Compose and thinking about how this will work with podman-compose as well as the Podman API V2 work. I would comment that I think "podman generate kube" and "podman play kube" are a better solution to simplify the construction of Kubernetes YAML (addressing the first sentence in this blog): https://codeengineered.com/blog/2020/docker-compose-spec/ I'm confused on how "The Compose Specification works with other tools such as Helm charts and Kubernetes YAML to make your user experiences simpler and portable." but curious of other people's thoughts: https://www.compose-spec.io/ Best Regards Scott M -- -- [image: Summit Virtual Experience] <https://www.redhat.com/en/summit?sc_cid=7013a000002D2QxAAK> Scott McCarty Product Management - Containers, Red Hat Enterprise Linux & OpenShift Email: smccarty(a)redhat.com Phone: 312-660-3535 Cell: 330-807-1043 Web: http://crunchtools.com Using Azure Pipelines with Red Hat Universal Base Image and Quay.io: https://red.ht/2TvYo3Y

1 0

Docker Compose is now the "Compose Specification"
by Neal Gompa 09 Apr '20

09 Apr '20

Hey all, I don't know if any of y'all saw this yet, but Docker, Inc. has announced[1] this new thing called the "Compose Specification[2]". It looks like they're attempting to generalize the Docker Compose format for broader use. What do you folks think of it? [1]: https://www.docker.com/blog/announcing-the-compose-specification/ [2]: https://www.compose-spec.io/ -- 真実はいつも一つ！/ Always, there's only one truth!

4 4

IndiMail (updated and enhanced QMail) mail server in a Podman Container
by Philip Rhoades 02 Apr '20

02 Apr '20

People, I have wanted to get my old QMail mail server system up to date for some years (it has been going more-or-less unchanged for about 21 years!). Some years ago I started using docker for my Jekyll and Rails sites and more recently I became quite interested in Podman - which I thought was a much nicer environment for me - I used RH from version 4.0 to 9.0 (before RHEL came on the scene) and have been using Fedora since the beginning - so the whole environment was very interesting for me - as well as for Atomic, CoreOS and SilverBlue etc. I became interested in IndiMail: http://www.indimail.org a while ago because it was a well maintained and enhanced version of QMail with everything you would need in a modern MTA. So as time went on it seemed natural to think of moving over to IndiMail but having it running in a Podman container. Anyway, after a lot of time spent both by me and Indimail creator, Manvendra, and with the generous help of people on this list, we have finally gotten the "light" version, IndiMail-MTA, working. A quick summary of the current situation: 1. I install the image with: podman pull cprogrammer/indimail:fc31 2. I create a container with: podman run -d -h pricom.com.au \ -v /home:/home \ --net=host \ --name $imv \ `podman images | grep "$imv" | awk '{ print $3 }'` \ $imv 3. Make manual changes to stuff in /etc to correspond to the users in the mounted /home dir - soon I will look at the previous suggestions from people here to see if I can make that situation nicer. There are some domain specific changes that need to be made to the files in: /etc/indimail/control We had to make some changes to the SMTP setup so it could talk to RoundCubeMail - RCM was attempting to try the last AUTH SMTP method advertised (DIGEST-MD5) instead of AUTH PLAIN or AUTH LOGIN. The unconfigured AUTH methods were disabled by setting env variables in the SMTP config. As of now, I think it is a pretty seamless process to get up and running. The light -mta version is quite adequate for my needs but the full indimail install can handle lots of domains, millions of users and very high volumes of mail - and it is very fast ie it has kept all the features that the original QMail was popular for but has all the enhancements needed for a modern mail server. As we move from F31 to F32 and future versions, I will streamline my process for pulling the image, building the container and making custom changes. I will also, start building from the Docker files and, at some stage when I have more time, repeat the exercise with the full IndiMail suite to also get that going painlessly. Regards, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil(a)pricom.com.au

1 0