- Podman - Podman List Archives

Locking issue?
by Alexander E. Patrakov 07 Nov '19

07 Nov '19

Hello. I have tried Podman in Fedora 31. Not a rootless setup. Software versions: podman-1.6.2-2.fc31.x86_64 containernetworking-plugins-0.8.2-2.1.dev.git485be65.fc31.x86_64 I have created two containers: # podman container run -d --name nginx_1 -p 80:80 nginx # podman container run -d --name nginx_2 -p 81:80 nginx Then I wanted to make sure that they start on boot. According to RHEL 7 documentation, https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux_atom… , I am supposed to create systemd units. OK, let's take the documented form of the unit and turn it into a template: [Unit] Description=Container %i [Service] ExecStart=/usr/bin/podman start -a %i ExecStop=/usr/bin/podman stop -t 2 %i [Install] WantedBy=multi-user.target This doesn't work if there is more than one container. The error is: Nov 04 21:35:57 podman[2268]: time="2019-11-04T21:35:57+05:00" level=error msg="Error adding network: failed to allocate for range 0: 10.88.0.19 has been allocated to ace2de4405205a9a7674a2524cd67c1f0e395a9234b0456c55881a1a4add6019, duplicate allocation is not allowed" Nov 04 21:35:57 podman[2268]: time="2019-11-04T21:35:57+05:00" level=error msg="Error while adding pod to CNI network \"podman\": failed to allocate for range 0: 10.88.0.19 has been allocated to ace2de4405205a9a7674a2524cd67c1f0e395a9234b0456c55881a1a4add6019, duplicate allocation is not allowed" Nov 04 21:35:57 podman[2268]: Error: unable to start container ace2de4405205a9a7674a2524cd67c1f0e395a9234b0456c55881a1a4add6019: error configuring network namespace for container ace2de4405205a9a7674a2524cd67c1f0e395a9234b0456c55881a1a4add6019: failed to allocate for range 0: 10.88.0.19 has been allocated to ace2de4405205a9a7674a2524cd67c1f0e395a9234b0456c55881a1a4add6019, duplicate allocation is not allowed (as you can see, the conflict is against the container itself) Apparently different runs of podman need to be serialized against each other. This works: [Unit] Description=Container %i Wants=network-online.target After=network-online.target [Service] Type=oneshot RemainAfterExit=yes ExecStart=flock /run/lock/subsys/container.lck /usr/bin/podman start %i ExecStop=/usr/bin/podman stop -t 2 %i [Install] WantedBy=multi-user.target Questions: a) Why isn't some equivalent of this unit shipped with podman? Or, am I missing some package that ships it? b) Why isn't the necessary locking built into podman itself? Or, is it a bug in containernetworking-plugins? -- Alexander E. Patrakov

4 8

suggestions for container security vulnerability scanners?
by Robert P. J. Day 06 Nov '19

06 Nov '19

not really a podman-related question, but a colleague asked about the options for open source container security scanners. i know about commercial offerings like black duck; what are the choices of the denizens of this list? thank you kindly. rday -- ======================================================================== Robert P. J. Day Ottawa, Ontario, CANADA http://crashcourse.ca Twitter: http://twitter.com/rpjday LinkedIn: http://ca.linkedin.com/in/rpjday ========================================================================

3 2

userns=keep-id and volumes requires all paths as user?
by mh 06 Nov '19

06 Nov '19

Hi All, trying to do the following, but it won't work neither on fedora nor EL7 $ cat /etc/fedora-release Fedora release 30 (Thirty) $ podman version Version: 1.6.2 RemoteAPI Version: 1 Go Version: go1.12.10 OS/Arch: linux/amd64 $ id -u 1000 $ id -g 1000 $ mkdir /tmp/foo/bar -p $ chmod 0750 /tmp/foo /tmp/foo/bar $ echo hello > /tmp/foo/bar/msg $ podman run -it --userns=keep-id -v \ /tmp/foo/bar:/data:rw,Z fedora:31 cat /data/msg hello -> this works $ sudo chown root /tmp/foo $ ls -anl /tmp/foo total 0 drwxr-x---. 3 0 1000 60 5. Nov 23:29 . drwxrwxrwt. 30 0 0 2420 5. Nov 23:34 .. drwxr-x---. 2 1000 1000 60 5. Nov 23:30 bar $ podman run -it --userns=keep-id -v \ /tmp/foo/bar:/data:rw,Z fedora:31 cat /data/msg Error: time="2019-11-05T23:35:13+01:00" level=warning msg="exit status 1" time="2019-11-05T23:35:13+01:00" level=error msg="container_linux.go:346: starting container process caused \"process_linux.go:449: container init caused \\\"rootfs_linux.go:58: mounting \\\\\\\"/tmp/foo/bar\\\\\\\" to rootfs \\\\\\\"/home/mh/.local/share/containers/storage/overlay/d7b7bfe26e90a616a818c9210ad63da0d74c0c13c0b78c671034c7a6bb9e5cde/merged\\\\\\\" at \\\\\\\"/data\\\\\\\" caused \\\\\\\"stat /tmp/foo/bar: permission denied\\\\\\\"\\\"\"" container_linux.go:346: starting container process caused "process_linux.go:449: container init caused \"rootfs_linux.go:58: mounting \\\"/tmp/foo/bar\\\" to rootfs \\\"/home/mh/.local/share/containers/storage/overlay/d7b7bfe26e90a616a818c9210ad63da0d74c0c13c0b78c671034c7a6bb9e5cde/merged\\\" at \\\"/data\\\" caused \\\"stat /tmp/foo/bar: permission denied\\\"\"": OCI runtime permission denied error -> this fails somehow, although my user has rights in that path. $ sudo chmod 0755 /tmp/foo $ ls -anl /tmp/foo total 0 drwxr-xr-x. 3 0 1000 60 5. Nov 23:29 . drwxrwxrwt. 30 0 0 2420 5. Nov 23:35 .. drwxr-x---. 2 1000 1000 60 5. Nov 23:30 bar $ podman run -it --userns=keep-id -v \ /tmp/foo/bar:/data:rw,Z fedora:31 cat /data/msg hello So whenever a directory in the path to the volume that should go into my container is not browseable by my uid (although my group can!) I cannot mount it as a volume. debug logs won't give any further info. Why do I want to do that? I have userdirectories that are purely used as chroots for SFTP through sshd. Thus they *must* be root owned, but group readable/listable, so the root of the chroot can't be overwritten. See sshd_config for more details. Now I'd like to run containers as the particular user, operating on some directories within that chroot path. By default these chroot-directories are setup with 0750 and thus failing in my case. While 0755 might still be an option/workaround, I am wondering what the reason for that requirement is? It looks like a bug to me. Shall I open an issue, but where? ~mh

2 2

can you define only a "RUN" runlabel for a container?
by Robert P. J. Day 06 Nov '19

06 Nov '19

reading brent's recent piece on security, and noticed the "podman container runlabel" command which allows one to define a label for convenience. however, every example i've seen of that uses precisely the label of "RUN," as if that's the only possibility. can you not define multiple runlabels for a single image? that seems like the obvious thing to support, but if one looks at examples, it's not clear. what's the story here? rday -- ======================================================================== Robert P. J. Day Ottawa, Ontario, CANADA http://crashcourse.ca Twitter: http://twitter.com/rpjday LinkedIn: http://ca.linkedin.com/in/rpjday ========================================================================

2 4

terminology: why "podman container runlabel", not "podman image runlabel"?
by Robert P. J. Day 06 Nov '19

06 Nov '19

more pedantic nitpickery, but i'm a stickler for terminology and i've always defined "image" (or "container image") as, well, something that *can* be run, and "container" as an image in the process of execution. so "podman container runlabel" seems awkward as it clearly(?) refers to an image, not a container. am i overthinking this? rday

2 2

Basic security principles for containers and container runtimes
by Brent Baude 06 Nov '19

06 Nov '19

Folks, We recently published an article on some basic security ideas around Podman and container images. Socialize as you see fit. https://www.redhat.com/sysadmin/users/brent-baude

2 1

A Global Marketplace connecting Engineers and Businesses
by kaitlyn.kristy9494＠gmail.com 06 Nov '19

06 Nov '19

A Cisco Certified Network Professional executes and configures EIGRP-based solutions. Certified professionals must develop multi-area OSPF networks and configure OSPF routing as well. It is further the responsibility of Certified Professionals to develop eBGP-based solutions and perform routing configuration. Professionals must know how to set up an IPv6-based solution, and they must record all the results of their implementation. Certified Professionals are responsible for IPv4 and IPv6 redistribution solutions as well. They further must design and develop Layer 3 Path Control Solutions and broadband connections. Certified professionals must also have a strong understanding of what resources are required, and they must implement VLAN-based solutions. Read More: https://www.fieldengineer.com/skills/cisco-certified-network-professional

3 3

Cloud Integration Engineer
by rozerfederatfieldengineer＠gmail.com 06 Nov '19

06 Nov '19

A cloud integration engineer is somebody who helps migrate existing company network and IT assets into the cloud. By integrating a firm’s systems with the cloud services, cloud integration engineers help firms improve accessibility, backup, and connectivity. https://www.fieldengineer.com/skills/cloud-integration-engineer-ericsson

1 0

Site & Process Automation Engineer
by ashaikfe＠gmail.com 06 Nov '19

06 Nov '19

A site and Process Automation Engineer is somebody who helps organizations automate their production processes. The role of a site and Process Automation Engineer includes both installing, testing, troubleshooting, and maintaining automation systems. Many firms in the IT and telecom sector need people with the skills to help them automate repetitive tasks or tasks that require a high level of precision. Site and process automation engineers focus on reducing the labor required to perform operational activities in these industries, helping firms to cut costs. Read More: https://www.fieldengineer.com/skills/site-process-automation-engineer-erics…

1 0

feasible to upgrade podman on CentOS 8 to current version?
by Robert P. J. Day 05 Nov '19

05 Nov '19

i just upgraded a CentOS box to CentOS 8, and i can see that the version of podman is (unsurprisingly) a bit dated: $ podman --version podman version 1.0.2-dev compared to my fedora 30 system: $ podman --version podman version 1.6.1 is it feasible to try to download and build from source to get the latest version on my CentOS system, or would that just be more trouble than it's worth? rday -- ======================================================================== Robert P. J. Day Ottawa, Ontario, CANADA http://crashcourse.ca Twitter: http://twitter.com/rpjday LinkedIn: http://ca.linkedin.com/in/rpjday ========================================================================

4 5