- Podman - Podman List Archives

Trouble with mounting /sys/fs/cgroup from host to podman container
by Per Lundberg 16 Oct '19

16 Oct '19

Hi, While trying to use podman for a current task where I am testing an Ansible role being developed with the Molecule testing framework (https://molecule.readthedocs.io) I am running into some trouble with the /sys/fs/cgroup mounting. All the containers I'm trying to run with this volume being mounted into the container (to allow systemd to run inside podman) gives me errors like these: $ podman run -d --name centos7 --privileged=True --volume /sys/fs/cgroup:/sys/fs/cgroup:rw --tty=True molecule_local/centos:7 /sbin/init Error: container_linux.go:345: starting container process caused "process_linux.go:430: container init caused \"rootfs_linux.go:58: mounting \\\"/sys/fs/cgroup\\\" to rootfs \\\"/home/per/.local/share/containers/storage/vfs/dir/41434e3e7d6979474c6a4829745acba3d124189037c7fef34455594823a91a2c\\\" at \\\"/home/per/.local/share/containers/storage/vfs/dir/41434e3e7d6979474c6a4829745acba3d124189037c7fef34455594823a91a2c/sys/fs/cgroup\\\" caused \\\"operation not permitted\\\"\"": OCI runtime permission denied error $ podman run -d --name ubuntu16.04 --privileged=True --volume /sys/fs/cgroup:/sys/fs/cgroup:rw --tty=True molecule_local/ubuntu:16.04 /sbin/init Error: container_linux.go:345: starting container process caused "process_linux.go:430: container init caused \"rootfs_linux.go:58: mounting \\\"/sys/fs/cgroup\\\" to rootfs \\\"/home/per/.local/share/containers/storage/vfs/dir/ff8d8b2f47aacc6a30522091aad2cad6e81d9f0cc011d7e1fb1f09b62bc7210b\\\" at \\\"/home/per/.local/share/containers/storage/vfs/dir/ff8d8b2f47aacc6a30522091aad2cad6e81d9f0cc011d7e1fb1f09b62bc7210b/sys/fs/cgroup\\\" caused \\\"operation not permitted\\\"\"": OCI runtime permission denied error $ podman run --log-opt debug -d --name ubuntu18.04 --privileged=True --volume /sys/fs/cgroup:/sys/fs/cgroup:rw --tty=True molecule_local/ubuntu:18.04 /sbin/init Error: container_linux.go:345: starting container process caused "process_linux.go:430: container init caused \"rootfs_linux.go:58: mounting \\\"/sys/fs/cgroup\\\" to rootfs \\\"/home/per/.local/share/containers/storage/vfs/dir/0740c9c17a0fe13542746fbd248e0c3cb35aaf7c965e56cac5875840b2aab235\\\" at \\\"/home/per/.local/share/containers/storage/vfs/dir/0740c9c17a0fe13542746fbd248e0c3cb35aaf7c965e56cac5875840b2aab235/sys/fs/cgroup\\\" caused \\\"operation not permitted\\\"\"": OCI runtime permission denied error Running "podman run -it molecule_local/centos:7" works fine. Any ideas? I guess I could run podman with sudo (and this might be required for this particular use case), but if possible, I'd prefer avoiding it. This is btw on Debian buster/bullseye, with the 1.6.1-1~ubuntu19.04~ppa3 package installed. Since there was no native Debian package installed, I added the Ubuntu PPA and was hoping (*cough*) that it would work reasonably well... Kernel is 4.19.0-6-amd64. Best regards, -- Per Lundberg

2 2

rootless config
by Lou DeGenaro 11 Oct '19

11 Oct '19

I start with an empty /home/degenaro/.config/containers directory. I run podman info. I see that files libpod.conf and storage.conf have been created. I grep for "/home" and see: libpod.conf:volume_path = "/home/degenaro/.local/share/containers/storage/volumes" libpod.conf:static_dir = "/home/degenaro/.local/share/containers/storage/libpod" storage.conf: graphroot = "/home/degenaro/.local/share/containers/storage" What's wanted is to configure podman so that "/home" is replaced by "/tmp". That is, if I were to erase these .conf files and run podman info again I want to see: ibpod.conf:volume_path = "/tmp/degenaro/.local/share/containers/storage/volumes" libpod.conf:static_dir = "/tmp/degenaro/.local/share/containers/storage/libpod" storage.conf: graphroot = "/tmp/degenaro/.local/share/containers/storage" The desire is to have all rootless users use /tmp instead of /home, since /home is on a shared filesystem which seems to be problematic for podman. Thx. Lou.

3 4

ubi7 kernel-headers
by bryan.hepworth＠gmail.com 06 Oct '19

06 Oct '19

Hi all Not sure this is the best place to ask or not, scenario is as follows: - building container with podman locally to check it does build - trying it in quay.io and I'm bumping up against a vulnerability I can't seem to correct which I'm thinking is something I'm doing. I'm uploading a Dockerfile (for want of a better file name) to start the build, but it always finds a vulnerability in kernel-headers for ubi7 which I can't seem to get to update from the build despite yum -y update - it's the gcc package that it loads up. Dockerfile looks like this: - FROM registry.access.redhat.com/ubi7/ubi RUN yum -y update && yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm && yum -y update && yum -y install python2 && yum -y install make && yum -y install gcc && yum -y install redhat-rpm-config && yum -y install zlib-devel && yum -y install bzip2 && yum -y install xz-devel && yum -y install python2-devel && yum -y install git && yum -y install python2-pip && yum -y install wget && yum -y install sudo && yum -y install bash && yum clean all CMD ["/bin/bash"] USER 0 RUN curl -o miniconda.sh https://repo.continuum.io/miniconda/Miniconda2-latest-Linux-x86_64.sh RUN bash miniconda.sh -b -p /opt/miniconda RUN ln -s /opt/miniconda/bin/python /usr/local/bin/python RUN ln -s /opt/miniconda/bin/pip /usr/local/bin/pip RUN ln -s /opt/miniconda/bin/conda /usr/local/bin/conda RUN conda config --add channels defaults RUN conda config --add channels bioconda RUN conda config --add channels conda-forge RUN conda init bash RUN echo y | conda create -n clairvoyante-conda-env -c bioconda clairvoyante The quay.io creation is here: - https://quay.io/repository/bryanhepworth/clairvoyante?tab=tags Any help most gratefully received. Bryan

3 3

GraphRoot
by Lou DeGenaro 03 Oct '19

03 Oct '19

I made a change to storage.conf as follows: graphroot = "/tmp/degenaro/.local/share/containers/storage" Yet, when I run podman info: GraphRoot: /tmp/podman/degenaro/.local/share/containers/storage Why does the string /podman still appear in GraphRoot? Thanks. Lou.

4 10

rootless ping not working for external IP???
by Lou DeGenaro 03 Oct '19

03 Oct '19

Dunno what I'm doing wrong. Please advise. Thx! Lou. ===== [root@ducc-client-centos-7x-v1 etc]# podman run busybox ping -c 2 localhost PING localhost (127.0.0.1): 56 data bytes 64 bytes from 127.0.0.1: seq=0 ttl=64 time=0.107 ms 64 bytes from 127.0.0.1: seq=1 ttl=64 time=0.080 ms --- localhost ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 0.080/0.093/0.107 ms [root@ducc-client-centos-7x-v1 etc]# podman run busybox ping -c 2 176.32.103.205 PING 176.32.103.205 (176.32.103.205): 56 data bytes 64 bytes from 176.32.103.205: seq=0 ttl=226 time=28.471 ms 64 bytes from 176.32.103.205: seq=1 ttl=226 time=28.708 ms --- 176.32.103.205 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 28.471/28.589/28.708 ms [root@ducc-client-centos-7x-v1 etc]# su - podtest Last login: Thu Oct 3 09:39:03 CDT 2019 on pts/0 [podtest@ducc-client-centos-7x-v1 ~]$ podman run busybox ping -c 2 localhost PING localhost (127.0.0.1): 56 data bytes 64 bytes from 127.0.0.1: seq=0 ttl=64 time=0.079 ms 64 bytes from 127.0.0.1: seq=1 ttl=64 time=0.084 ms --- localhost ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 0.079/0.081/0.084 ms [podtest@ducc-client-centos-7x-v1 ~]$ podman run busybox ping -c 2 176.32.103.205 PING 176.32.103.205 (176.32.103.205): 56 data bytes --- 176.32.103.205 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss

3 2

Restart bash during a build
by bryan.hepworth＠gmail.com 03 Oct '19

03 Oct '19

Hi all One of the containers I'm trying to build has a component that requires restarting the current she'll to continue. I've seen other suggestions via Google but haven't had any success. Would be grateful if any one could comment. Thank you Bryan

2 3

linking of containers
by Filak, Jakub 26 Sep '19

26 Sep '19

Greetings! Do you plan to add `--link` to`podman run`? Regards, Jakub

3 2

Re: linking of containers
by Filak, Jakub 25 Sep '19

25 Sep '19

I probably misused podman. I do not use it for creating pods. I use podman as a substitute for Docker. I want to build a GitHub Pull Requst builder for ABAP projects. I want to start a fresh container for every build. Every new container gets its own IP - (not as Docker which starts with 172.17.0.2). My host is RHEL with not so recent Node which I need to run some ABAP transformations, thus I use another container with the most recent Node and Python. The tools container must know hostname or IP of the ABAP system container because ABAP systems are reachable only via TCP. (I cannot rely on the fact that IPs are assigned sequentially from 172.17.0.2 ...) I wanted to use `run --link` but it is not supported at all. I thought I can use `run --net` to share Network NS with the ABAP system but it seems that `--net` has different semantics than Docker's `--net`. Eventually I use IP=$(podman inspect --format {{ .NetworkSettings.IPAddress }} abap) and `podman run --add-host abap:$IP ...` It so not so convenient but it works for me. ________________________________ From: Matt Heon Sent: Monday, September 23, 2019 18:54 To: Filak, Jakub Cc: podman(a)lists.podman.io Subject: Re: [Podman] linking of containers On 2019-09-23 16:07, Filak, Jakub wrote: >Greetings! > >Do you plan to add `--link` to`podman run`? > > >Regards, >Jakub >_______________________________________________ >Podman mailing list -- podman(a)lists.podman.io >To unsubscribe send an email to podman-leave(a)lists.podman.io No, we don't presently have plans to add `--link` support. We prefer pods for allowing inter-container communication. If you have a use-case for which pods don't work, we'd be interested in hearing about it. Thanks, Matt Heon

2 1

name resolution between containers
by Brent Baude 20 Sep '19

20 Sep '19

Folks, There is a proof of concept available now that can allow name resolution between containers on the same network. The enablement is done by a CNI plugin and dnsmasq. I have added a tutorial on how to try this out in https://github.com/containers/dnsname/pull/7 . You need to be using the latest upstream Podman code as well until 1.6 is officially released.

1 0

proper way to detect running inside a container?
by Robert P. J. Day 15 Sep '19

15 Sep '19

dropped into existing project, where all Makefiles do the following test to see if they're running inside docker: ifneq ($(wildcard /.dockerenv),) i'm pretty sure that's just asking for trouble, and i've perused a github issue related to that: https://github.com/containers/libpod/issues/648 so what is the *proper* way to detect if one is running inside a container? the way that seems most reliable is to check /proc/1/sched. thoughts? rday

3 2