Anyone got ZeroTier working in podman containers?
People, I am just starting to make real use of podman containers but, for one particular exercise, it would be convenient if I could use zerotier in one of the containers but I get: [root@1c15d54fa274 /]# zerotier-cli info zerotier-cli: missing port and zerotier-one.port not found in /var/lib/zerotier-one - it works for other, non-container, devices - as well as VMs on KVM. Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil@pricom.com.au
On 3/16/20 09:07, Philip Rhoades wrote:
People,
I am just starting to make real use of podman containers but, for one particular exercise, it would be convenient if I could use zerotier in one of the containers but I get:
[root@1c15d54fa274 /]# zerotier-cli info zerotier-cli: missing port and zerotier-one.port not found in /var/lib/zerotier-one
- it works for other, non-container, devices - as well as VMs on KVM.
Thanks,
Phil.
How did you package up zerotier? This looks like the installation within the container image failed to install /var/lib/zerotier-one?
Daniel, On 2020-03-17 01:30, Daniel Walsh wrote:
On 3/16/20 09:07, Philip Rhoades wrote:
People,
I am just starting to make real use of podman containers but, for one particular exercise, it would be convenient if I could use zerotier in one of the containers but I get:
[root@1c15d54fa274 /]# zerotier-cli info zerotier-cli: missing port and zerotier-one.port not found in /var/lib/zerotier-one
- it works for other, non-container, devices - as well as VMs on KVM.
Thanks,
Phil.
How did you package up zerotier? This looks like the installation within the container image failed to install /var/lib/zerotier-one?
I used this (which, as I said, worked fine for all the other non-container environments): curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...' | gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil@pricom.com.au
On 3/17/20 12:48, Philip Rhoades wrote:
Daniel,
On 2020-03-17 01:30, Daniel Walsh wrote:
On 3/16/20 09:07, Philip Rhoades wrote:
People,
I am just starting to make real use of podman containers but, for one particular exercise, it would be convenient if I could use zerotier in one of the containers but I get:
[root@1c15d54fa274 /]# zerotier-cli info zerotier-cli: missing port and zerotier-one.port not found in /var/lib/zerotier-one
- it works for other, non-container, devices - as well as VMs on KVM.
Thanks,
Phil.
How did you package up zerotier? This looks like the installation within the container image failed to install /var/lib/zerotier-one?
I used this (which, as I said, worked fine for all the other non-container environments):
curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...' | gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
Thanks,
Phil.
I ran ##################################################### $ podman run -ti fedora sh # curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...' | gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi ... *** Enabling and starting zerotier-one service... Created symlink /etc/systemd/system/multi-user.target.wants/zerotier-one.service → /usr/lib/systemd/system/zerotier-one.service. System has not been booted with systemd as init system (PID 1). Can't operate. Failed to connect to bus: Host is down *** Package installed but cannot start service! You may be in a Docker *** container or using a non-standard init service. # # zerotier-cli info zerotier-cli: missing port and zerotier-one.port not found in /var/lib/zerotier-one ####################################################### This looks like the script is attempting to start a service inside of the container via systemd, which does not exists. However if I do: ##################################################### $ podman run -d fedora /sbin/init 8f841ca46ceda9d5452eca2b0459029272dc5898eb2bea4ccefa81efa076c8eb $ podman exec -ti 8f841ca46ceda9d5452eca2b0459029272dc5898eb2bea4ccefa81efa076c8eb # curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...' | gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi ... *** Enabling and starting zerotier-one service... Created symlink /etc/systemd/system/multi-user.target.wants/zerotier-one.service → /usr/lib/systemd/system/zerotier-one.service. *** Waiting for identity generation... *** Success! You are ZeroTier address [ a8057b16e9 ]. # zerotier-cli info 200 info a8057b16e9 1.4.6 OFFLINE # systemctl status zerotier-one ● zerotier-one.service - ZeroTier One Loaded: loaded (/usr/lib/systemd/system/zerotier-one.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2020-03-17 17:33:23 UTC; 4min 23s ago Main PID: 145 (zerotier-one) CGroup: /user.slice/user-3267.slice/user@3267.service/apps.slice/apps-org.gnome.Terminal.slice/vte-spawn-6856c47f-79c0-49a8-8004-771d446b888b.scope/8f841ca46ceda9d5452eca2b0459029272dc589 8eb2bea4ccefa81efa076c8eb/system.slice/zerotier-one.service └─145 /usr/sbin/zerotier-one Mar 17 17:33:23 8f841ca46ced systemd[1]: Started ZeroTier One. Mar 17 17:33:23 8f841ca46ced zerotier-one[145]: /usr/sbin/zerotier-one: WARNING: failed to drop privileges (kernel may not support required prctl features), running as root Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer ###################################################### If you run the container with systemd running inside it and then exec into the container your script will work, since it will communicate with systemd to start the service
Daniel, On 2020-03-18 04:38, Daniel Walsh wrote:
On 3/17/20 12:48, Philip Rhoades wrote:
Daniel,
On 2020-03-17 01:30, Daniel Walsh wrote:
On 3/16/20 09:07, Philip Rhoades wrote:
People,
I am just starting to make real use of podman containers but, for one particular exercise, it would be convenient if I could use zerotier in one of the containers but I get:
[root@1c15d54fa274 /]# zerotier-cli info zerotier-cli: missing port and zerotier-one.port not found in /var/lib/zerotier-one
- it works for other, non-container, devices - as well as VMs on KVM.
Thanks,
Phil.
How did you package up zerotier? This looks like the installation within the container image failed to install /var/lib/zerotier-one?
I used this (which, as I said, worked fine for all the other non-container environments):
curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...' | gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
Thanks,
Phil.
I ran
#####################################################
$ podman run -ti fedora sh
# curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...' | gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
...
*** Enabling and starting zerotier-one service... Created symlink /etc/systemd/system/multi-user.target.wants/zerotier-one.service → /usr/lib/systemd/system/zerotier-one.service. System has not been booted with systemd as init system (PID 1). Can't operate. Failed to connect to bus: Host is down
*** Package installed but cannot start service! You may be in a Docker *** container or using a non-standard init service.
# # zerotier-cli info zerotier-cli: missing port and zerotier-one.port not found in /var/lib/zerotier-one
#######################################################
This looks like the script is attempting to start a service inside of the container via systemd, which does not exists.
However if I do:
#####################################################
$ podman run -d fedora /sbin/init
8f841ca46ceda9d5452eca2b0459029272dc5898eb2bea4ccefa81efa076c8eb
$ podman exec -ti 8f841ca46ceda9d5452eca2b0459029272dc5898eb2bea4ccefa81efa076c8eb
# curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...' | gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
...
*** Enabling and starting zerotier-one service... Created symlink /etc/systemd/system/multi-user.target.wants/zerotier-one.service → /usr/lib/systemd/system/zerotier-one.service.
*** Waiting for identity generation...
*** Success! You are ZeroTier address [ a8057b16e9 ].
# zerotier-cli info 200 info a8057b16e9 1.4.6 OFFLINE
# systemctl status zerotier-one ● zerotier-one.service - ZeroTier One Loaded: loaded (/usr/lib/systemd/system/zerotier-one.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2020-03-17 17:33:23 UTC; 4min 23s ago Main PID: 145 (zerotier-one) CGroup: /user.slice/user-3267.slice/user@3267.service/apps.slice/apps-org.gnome.Terminal.slice/vte-spawn-6856c47f-79c0-49a8-8004-771d446b888b.scope/8f841ca46ceda9d5452eca2b0459029272dc589 8eb2bea4ccefa81efa076c8eb/system.slice/zerotier-one.service └─145 /usr/sbin/zerotier-one
Mar 17 17:33:23 8f841ca46ced systemd[1]: Started ZeroTier One. Mar 17 17:33:23 8f841ca46ced zerotier-one[145]: /usr/sbin/zerotier-one: WARNING: failed to drop privileges (kernel may not support required prctl features), running as root Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer
######################################################
If you run the container with systemd running inside it and then exec into the container your script will work, since it will communicate with systemd to start the service
Oh wow! Thanks so much for that! - and I learnt a bit more about podman . . Regards, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil@pricom.com.au
On 2020-03-18 05:44, Philip Rhoades wrote:
Daniel,
On 2020-03-18 04:38, Daniel Walsh wrote:
On 3/17/20 12:48, Philip Rhoades wrote:
Daniel,
On 2020-03-17 01:30, Daniel Walsh wrote:
On 3/16/20 09:07, Philip Rhoades wrote:
People,
I am just starting to make real use of podman containers but, for one particular exercise, it would be convenient if I could use zerotier in one of the containers but I get:
[root@1c15d54fa274 /]# zerotier-cli info zerotier-cli: missing port and zerotier-one.port not found in /var/lib/zerotier-one
- it works for other, non-container, devices - as well as VMs on KVM.
Thanks,
Phil.
How did you package up zerotier? This looks like the installation within the container image failed to install /var/lib/zerotier-one?
I used this (which, as I said, worked fine for all the other non-container environments):
curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...' | gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
Thanks,
Phil.
I ran
#####################################################
$ podman run -ti fedora sh
# curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...' | gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
...
*** Enabling and starting zerotier-one service... Created symlink /etc/systemd/system/multi-user.target.wants/zerotier-one.service → /usr/lib/systemd/system/zerotier-one.service. System has not been booted with systemd as init system (PID 1). Can't operate. Failed to connect to bus: Host is down
*** Package installed but cannot start service! You may be in a Docker *** container or using a non-standard init service.
# # zerotier-cli info zerotier-cli: missing port and zerotier-one.port not found in /var/lib/zerotier-one
#######################################################
This looks like the script is attempting to start a service inside of the container via systemd, which does not exists.
However if I do:
#####################################################
$ podman run -d fedora /sbin/init
8f841ca46ceda9d5452eca2b0459029272dc5898eb2bea4ccefa81efa076c8eb
$ podman exec -ti 8f841ca46ceda9d5452eca2b0459029272dc5898eb2bea4ccefa81efa076c8eb
# curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...' | gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
...
*** Enabling and starting zerotier-one service... Created symlink /etc/systemd/system/multi-user.target.wants/zerotier-one.service → /usr/lib/systemd/system/zerotier-one.service.
*** Waiting for identity generation...
*** Success! You are ZeroTier address [ a8057b16e9 ].
# zerotier-cli info 200 info a8057b16e9 1.4.6 OFFLINE
# systemctl status zerotier-one ● zerotier-one.service - ZeroTier One Loaded: loaded (/usr/lib/systemd/system/zerotier-one.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2020-03-17 17:33:23 UTC; 4min 23s ago Main PID: 145 (zerotier-one) CGroup: /user.slice/user-3267.slice/user@3267.service/apps.slice/apps-org.gnome.Terminal.slice/vte-spawn-6856c47f-79c0-49a8-8004-771d446b888b.scope/8f841ca46ceda9d5452eca2b0459029272dc589 8eb2bea4ccefa81efa076c8eb/system.slice/zerotier-one.service └─145 /usr/sbin/zerotier-one
Mar 17 17:33:23 8f841ca46ced systemd[1]: Started ZeroTier One. Mar 17 17:33:23 8f841ca46ced zerotier-one[145]: /usr/sbin/zerotier-one: WARNING: failed to drop privileges (kernel may not support required prctl features), running as root Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer
######################################################
If you run the container with systemd running inside it and then exec into the container your script will work, since it will communicate with systemd to start the service
Oh wow! Thanks so much for that! - and I learnt a bit more about podman . .
OK, now I should be able to use ZeroTier to ssh to the container but although I have installed and started the sshd server and allowed a root login I get: # ssh 10.147.18.191 ssh: connect to host 10.147.18.191 port 22: No route to host I can ssh to other (non container) ZT IPs OK . . Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil@pricom.com.au
On 3/17/20 23:26, Philip Rhoades wrote:
On 2020-03-18 05:44, Philip Rhoades wrote:
Daniel,
On 2020-03-18 04:38, Daniel Walsh wrote:
On 3/17/20 12:48, Philip Rhoades wrote:
Daniel,
On 2020-03-17 01:30, Daniel Walsh wrote:
On 3/16/20 09:07, Philip Rhoades wrote:
People,
I am just starting to make real use of podman containers but, for one particular exercise, it would be convenient if I could use zerotier in one of the containers but I get:
[root@1c15d54fa274 /]# zerotier-cli info zerotier-cli: missing port and zerotier-one.port not found in /var/lib/zerotier-one
- it works for other, non-container, devices - as well as VMs on KVM.
Thanks,
Phil.
How did you package up zerotier? This looks like the installation within the container image failed to install /var/lib/zerotier-one?
I used this (which, as I said, worked fine for all the other non-container environments):
curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...'
| gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
Thanks,
Phil.
I ran
#####################################################
$ podman run -ti fedora sh
# curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...'
| gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
...
*** Enabling and starting zerotier-one service... Created symlink /etc/systemd/system/multi-user.target.wants/zerotier-one.service → /usr/lib/systemd/system/zerotier-one.service. System has not been booted with systemd as init system (PID 1). Can't operate. Failed to connect to bus: Host is down
*** Package installed but cannot start service! You may be in a Docker *** container or using a non-standard init service.
# # zerotier-cli info zerotier-cli: missing port and zerotier-one.port not found in /var/lib/zerotier-one
#######################################################
This looks like the script is attempting to start a service inside of the container via systemd, which does not exists.
However if I do:
#####################################################
$ podman run -d fedora /sbin/init
8f841ca46ceda9d5452eca2b0459029272dc5898eb2bea4ccefa81efa076c8eb
$ podman exec -ti 8f841ca46ceda9d5452eca2b0459029272dc5898eb2bea4ccefa81efa076c8eb
# curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...'
| gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
...
*** Enabling and starting zerotier-one service... Created symlink /etc/systemd/system/multi-user.target.wants/zerotier-one.service → /usr/lib/systemd/system/zerotier-one.service.
*** Waiting for identity generation...
*** Success! You are ZeroTier address [ a8057b16e9 ].
# zerotier-cli info 200 info a8057b16e9 1.4.6 OFFLINE
# systemctl status zerotier-one ● zerotier-one.service - ZeroTier One Loaded: loaded (/usr/lib/systemd/system/zerotier-one.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2020-03-17 17:33:23 UTC; 4min 23s ago Main PID: 145 (zerotier-one) CGroup: /user.slice/user-3267.slice/user@3267.service/apps.slice/apps-org.gnome.Terminal.slice/vte-spawn-6856c47f-79c0-49a8-8004-771d446b888b.scope/8f841ca46ceda9d5452eca2b0459029272dc589
8eb2bea4ccefa81efa076c8eb/system.slice/zerotier-one.service └─145 /usr/sbin/zerotier-one
Mar 17 17:33:23 8f841ca46ced systemd[1]: Started ZeroTier One. Mar 17 17:33:23 8f841ca46ced zerotier-one[145]: /usr/sbin/zerotier-one: WARNING: failed to drop privileges (kernel may not support required prctl features), running as root Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer
######################################################
If you run the container with systemd running inside it and then exec into the container your script will work, since it will communicate with systemd to start the service
Oh wow! Thanks so much for that! - and I learnt a bit more about podman . .
OK, now I should be able to use ZeroTier to ssh to the container but although I have installed and started the sshd server and allowed a root login I get:
# ssh 10.147.18.191 ssh: connect to host 10.147.18.191 port 22: No route to host
I can ssh to other (non container) ZT IPs OK . .
Thanks,
Phil.
Why do you want to ssh into a container? You can just podman exec into the container?
Daniel, On 2020-03-19 00:39, Daniel Walsh wrote:
On 3/17/20 23:26, Philip Rhoades wrote:
On 2020-03-18 05:44, Philip Rhoades wrote:
Daniel,
On 2020-03-18 04:38, Daniel Walsh wrote:
On 3/17/20 12:48, Philip Rhoades wrote:
Daniel,
On 2020-03-17 01:30, Daniel Walsh wrote:
On 3/16/20 09:07, Philip Rhoades wrote: > People, > > I am just starting to make real use of podman containers but, for > one > particular exercise, it would be convenient if I could use > zerotier in > one of the containers but I get: > > [root@1c15d54fa274 /]# zerotier-cli info > zerotier-cli: missing port and zerotier-one.port not found in > /var/lib/zerotier-one > > - it works for other, non-container, devices - as well as VMs on > KVM. > > Thanks, > > Phil.
How did you package up zerotier? This looks like the installation within the container image failed to install /var/lib/zerotier-one?
I used this (which, as I said, worked fine for all the other non-container environments):
curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...'
| gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
Thanks,
Phil.
I ran
#####################################################
$ podman run -ti fedora sh
# curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...'
| gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
...
*** Enabling and starting zerotier-one service... Created symlink /etc/systemd/system/multi-user.target.wants/zerotier-one.service → /usr/lib/systemd/system/zerotier-one.service. System has not been booted with systemd as init system (PID 1). Can't operate. Failed to connect to bus: Host is down
*** Package installed but cannot start service! You may be in a Docker *** container or using a non-standard init service.
# # zerotier-cli info zerotier-cli: missing port and zerotier-one.port not found in /var/lib/zerotier-one
#######################################################
This looks like the script is attempting to start a service inside of the container via systemd, which does not exists.
However if I do:
#####################################################
$ podman run -d fedora /sbin/init
8f841ca46ceda9d5452eca2b0459029272dc5898eb2bea4ccefa81efa076c8eb
$ podman exec -ti 8f841ca46ceda9d5452eca2b0459029272dc5898eb2bea4ccefa81efa076c8eb
# curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40...'
| gpg --import && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
...
*** Enabling and starting zerotier-one service... Created symlink /etc/systemd/system/multi-user.target.wants/zerotier-one.service → /usr/lib/systemd/system/zerotier-one.service.
*** Waiting for identity generation...
*** Success! You are ZeroTier address [ a8057b16e9 ].
# zerotier-cli info 200 info a8057b16e9 1.4.6 OFFLINE
# systemctl status zerotier-one ● zerotier-one.service - ZeroTier One Loaded: loaded (/usr/lib/systemd/system/zerotier-one.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2020-03-17 17:33:23 UTC; 4min 23s ago Main PID: 145 (zerotier-one) CGroup: /user.slice/user-3267.slice/user@3267.service/apps.slice/apps-org.gnome.Terminal.slice/vte-spawn-6856c47f-79c0-49a8-8004-771d446b888b.scope/8f841ca46ceda9d5452eca2b0459029272dc589
8eb2bea4ccefa81efa076c8eb/system.slice/zerotier-one.service └─145 /usr/sbin/zerotier-one
Mar 17 17:33:23 8f841ca46ced systemd[1]: Started ZeroTier One. Mar 17 17:33:23 8f841ca46ced zerotier-one[145]: /usr/sbin/zerotier-one: WARNING: failed to drop privileges (kernel may not support required prctl features), running as root Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer Mar 17 17:33:41 8f841ca46ced zerotier-one[145]: recv: Connection reset by peer
######################################################
If you run the container with systemd running inside it and then exec into the container your script will work, since it will communicate with systemd to start the service
Oh wow! Thanks so much for that! - and I learnt a bit more about podman . .
OK, now I should be able to use ZeroTier to ssh to the container but although I have installed and started the sshd server and allowed a root login I get:
# ssh 10.147.18.191 ssh: connect to host 10.147.18.191 port 22: No route to host
I can ssh to other (non container) ZT IPs OK . .
Thanks,
Phil.
Why do you want to ssh into a container? You can just podman exec into the container?
I should have been clearer - I need a remote login for a developer who is helping me to produce a variety of QMail in a podman container. With help from people on this list I have got the container set up but while I am interested in continuing to learn about podman, the QMail developer is only interested in sorting out the QMail issues and just wants to log in and do that . . I am not in a position to tell him to set up his own podman environment and finish the work at his end . . I realise that ssh'ing into a remote container does not fit with the conceptual framework of how containers are supposed to work but if I can get it to work, I am prepared to break with convention . . Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil@pricom.com.au
On Wed, Mar 18, 2020 at 7:29 PM Philip Rhoades <phil@pricom.com.au> wrote:
I realise that ssh'ing into a remote container does not fit with the conceptual framework of how containers are supposed to work but if I can get it to work, I am prepared to break with convention . .
This is only a convention. For LXC, nobody would blame you for connecting to your container via ssh, in fact they encourage you to do so. And I would imagine that it is a valid and natural option for any container that runs systemd inside. -- Alexander E. Patrakov CV: http://pc.cd/PLz7
On 3/18/20 10:42, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 7:29 PM Philip Rhoades <phil@pricom.com.au> wrote:
I realise that ssh'ing into a remote container does not fit with the conceptual framework of how containers are supposed to work but if I can get it to work, I am prepared to break with convention . . This is only a convention. For LXC, nobody would blame you for connecting to your container via ssh, in fact they encourage you to do so. And I would imagine that it is a valid and natural option for any container that runs systemd inside.
Sure, but I would say that is closer to a VM. You can enable the sshd daemon within the container if you want, or you could just setup an account for the user to ssh to on your host and then setup sudo to run podman exec to enter the container. If you want to setup sshd to get into the container, then you need to pick a port on the host for sshd to listen on. And map port 22 from the container to a different port on the host, and then have the remote user ssh to the external port.
On Wed, Mar 18, 2020 at 10:21 PM Daniel Walsh <dwalsh@redhat.com> wrote:
On 3/18/20 10:42, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 7:29 PM Philip Rhoades <phil@pricom.com.au> wrote:
I realise that ssh'ing into a remote container does not fit with the conceptual framework of how containers are supposed to work but if I can get it to work, I am prepared to break with convention . . This is only a convention. For LXC, nobody would blame you for connecting to your container via ssh, in fact they encourage you to do so. And I would imagine that it is a valid and natural option for any container that runs systemd inside.
Sure, but I would say that is closer to a VM. You can enable the sshd daemon within the container if you want, or you could just setup an account for the user to ssh to on your host and then setup sudo to run podman exec to enter the container.
Right. However, some people do want lightweight VM lookalikes, and such two-step procedure is sometimes inconvenient e.g. with IDEs or if there are things like umask that are nicely enforced by PAM in the container.
If you want to setup sshd to get into the container, then you need to pick a port on the host for sshd to listen on. And map port 22 from the container to a different port on the host, and then have the remote user ssh to the external port.
Yes. Or just use IPv6 to ssh directly into the container ;) -- Alexander E. Patrakov CV: http://pc.cd/PLz7
Alexander, Daniel, On 2020-03-19 04:26, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 10:21 PM Daniel Walsh <dwalsh@redhat.com> wrote:
On 3/18/20 10:42, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 7:29 PM Philip Rhoades <phil@pricom.com.au> wrote:
I realise that ssh'ing into a remote container does not fit with the conceptual framework of how containers are supposed to work but if I can get it to work, I am prepared to break with convention . . This is only a convention. For LXC, nobody would blame you for connecting to your container via ssh, in fact they encourage you to do so. And I would imagine that it is a valid and natural option for any container that runs systemd inside.
Sure, but I would say that is closer to a VM. You can enable the sshd daemon within the container if you want, or you could just setup an account for the user to ssh to on your host and then setup sudo to run podman exec to enter the container.
Right. However, some people do want lightweight VM lookalikes, and such two-step procedure is sometimes inconvenient e.g. with IDEs or if there are things like umask that are nicely enforced by PAM in the container.
If you want to setup sshd to get into the container, then you need to pick a port on the host for sshd to listen on. And map port 22 from the container to a different port on the host, and then have the remote user ssh to the external port.
Yes. Or just use IPv6 to ssh directly into the container ;)
The point of using ZeroTier is that it provides me with a secure "VPN" - and this works quite happily for all my real machines and VMs - but I want to get this QMail project working with Podman - for all the reasons people like to use containers - but there is still an issue with podman . . Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil@pricom.com.au
On 3/18/20 16:08, Philip Rhoades wrote:
Alexander, Daniel,
On 2020-03-19 04:26, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 10:21 PM Daniel Walsh <dwalsh@redhat.com> wrote:
On 3/18/20 10:42, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 7:29 PM Philip Rhoades <phil@pricom.com.au> wrote:
I realise that ssh'ing into a remote container does not fit with the conceptual framework of how containers are supposed to work but if I can get it to work, I am prepared to break with convention . . This is only a convention. For LXC, nobody would blame you for connecting to your container via ssh, in fact they encourage you to do so. And I would imagine that it is a valid and natural option for any container that runs systemd inside.
Sure, but I would say that is closer to a VM. You can enable the sshd daemon within the container if you want, or you could just setup an account for the user to ssh to on your host and then setup sudo to run podman exec to enter the container.
Right. However, some people do want lightweight VM lookalikes, and such two-step procedure is sometimes inconvenient e.g. with IDEs or if there are things like umask that are nicely enforced by PAM in the container.
If you want to setup sshd to get into the container, then you need to pick a port on the host for sshd to listen on. And map port 22 from the container to a different port on the host, and then have the remote user ssh to the external port.
Yes. Or just use IPv6 to ssh directly into the container ;)
The point of using ZeroTier is that it provides me with a secure "VPN" - and this works quite happily for all my real machines and VMs - but I want to get this QMail project working with Podman - for all the reasons people like to use containers - but there is still an issue with podman . .
Thanks,
Phil.
How is this an issue with Podman. You need to setup your container with sshd and it should handle the situation you want.
Daniel, On 2020-03-19 07:11, Daniel Walsh wrote:
On 3/18/20 16:08, Philip Rhoades wrote:
Alexander, Daniel,
On 2020-03-19 04:26, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 10:21 PM Daniel Walsh <dwalsh@redhat.com> wrote:
On 3/18/20 10:42, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 7:29 PM Philip Rhoades <phil@pricom.com.au> wrote:
I realise that ssh'ing into a remote container does not fit with the conceptual framework of how containers are supposed to work but if I can get it to work, I am prepared to break with convention . . This is only a convention. For LXC, nobody would blame you for connecting to your container via ssh, in fact they encourage you to do so. And I would imagine that it is a valid and natural option for any container that runs systemd inside.
Sure, but I would say that is closer to a VM. You can enable the sshd daemon within the container if you want, or you could just setup an account for the user to ssh to on your host and then setup sudo to run podman exec to enter the container.
Right. However, some people do want lightweight VM lookalikes, and such two-step procedure is sometimes inconvenient e.g. with IDEs or if there are things like umask that are nicely enforced by PAM in the container.
If you want to setup sshd to get into the container, then you need to pick a port on the host for sshd to listen on. And map port 22 from the container to a different port on the host, and then have the remote user ssh to the external port.
Yes. Or just use IPv6 to ssh directly into the container ;)
The point of using ZeroTier is that it provides me with a secure "VPN" - and this works quite happily for all my real machines and VMs - but I want to get this QMail project working with Podman - for all the reasons people like to use containers - but there is still an issue with podman . .
Thanks,
Phil.
How is this an issue with Podman. You need to setup your container with sshd and it should handle the situation you want.
? I have done that - that's how I know there is a problem - from a previous mail: "OK, now I should be able to use ZeroTier to ssh to the container but although I have installed and started the sshd server and allowed a root login I get: # ssh 10.147.18.191 ssh: connect to host 10.147.18.191 port 22: No route to host I can ssh to other (non container) ZT IPs OK . ." Thanks, Phil. -- Philip Rhoades Life Extension Villages PO Box 896 Cowra NSW 2794 Australia E-mail: phr@lev.com.au Web: http://lev.com.au
On 3/18/20 16:29, Philip Rhoades wrote:
Daniel,
On 2020-03-19 07:11, Daniel Walsh wrote:
On 3/18/20 16:08, Philip Rhoades wrote:
Alexander, Daniel,
On 2020-03-19 04:26, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 10:21 PM Daniel Walsh <dwalsh@redhat.com> wrote:
On 3/18/20 10:42, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 7:29 PM Philip Rhoades <phil@pricom.com.au> wrote:
> I realise that ssh'ing into a remote container does not fit with the > conceptual framework of how containers are supposed to work but if I can > get it to work, I am prepared to break with convention . . This is only a convention. For LXC, nobody would blame you for connecting to your container via ssh, in fact they encourage you to do so. And I would imagine that it is a valid and natural option for any container that runs systemd inside.
Sure, but I would say that is closer to a VM. You can enable the sshd daemon within the container if you want, or you could just setup an account for the user to ssh to on your host and then setup sudo to run podman exec to enter the container.
Right. However, some people do want lightweight VM lookalikes, and such two-step procedure is sometimes inconvenient e.g. with IDEs or if there are things like umask that are nicely enforced by PAM in the container.
If you want to setup sshd to get into the container, then you need to pick a port on the host for sshd to listen on. And map port 22 from the container to a different port on the host, and then have the remote user ssh to the external port.
Yes. Or just use IPv6 to ssh directly into the container ;)
The point of using ZeroTier is that it provides me with a secure "VPN" - and this works quite happily for all my real machines and VMs - but I want to get this QMail project working with Podman - for all the reasons people like to use containers - but there is still an issue with podman . .
Thanks,
Phil.
How is this an issue with Podman. You need to setup your container with sshd and it should handle the situation you want.
? I have done that - that's how I know there is a problem - from a previous mail:
"OK, now I should be able to use ZeroTier to ssh to the container but although I have installed and started the sshd server and allowed a root login I get:
# ssh 10.147.18.191 ssh: connect to host 10.147.18.191 port 22: No route to host
I can ssh to other (non container) ZT IPs OK . ."
Thanks,
Phil.
Podman setup the container properly. You did not tell your container to start the sshd daemon inside and you did not run the container with ports to listen on. Basically the container is running within its own network environment and does not have sshd running. You can exec into the container and start the sshd service.
Daniel, On 2020-03-19 07:40, Daniel Walsh wrote:
On 3/18/20 16:29, Philip Rhoades wrote:
Daniel,
On 2020-03-19 07:11, Daniel Walsh wrote:
On 3/18/20 16:08, Philip Rhoades wrote:
Alexander, Daniel,
On 2020-03-19 04:26, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 10:21 PM Daniel Walsh <dwalsh@redhat.com> wrote:
On 3/18/20 10:42, Alexander E. Patrakov wrote: > On Wed, Mar 18, 2020 at 7:29 PM Philip Rhoades <phil@pricom.com.au> wrote: > >> I realise that ssh'ing into a remote container does not fit with the >> conceptual framework of how containers are supposed to work but if I can >> get it to work, I am prepared to break with convention . . > This is only a convention. For LXC, nobody would blame you for > connecting to your container via ssh, in fact they encourage you to do > so. And I would imagine that it is a valid and natural option for any > container that runs systemd inside. > Sure, but I would say that is closer to a VM. You can enable the sshd daemon within the container if you want, or you could just setup an account for the user to ssh to on your host and then setup sudo to run podman exec to enter the container.
Right. However, some people do want lightweight VM lookalikes, and such two-step procedure is sometimes inconvenient e.g. with IDEs or if there are things like umask that are nicely enforced by PAM in the container.
If you want to setup sshd to get into the container, then you need to pick a port on the host for sshd to listen on. And map port 22 from the container to a different port on the host, and then have the remote user ssh to the external port.
Yes. Or just use IPv6 to ssh directly into the container ;)
The point of using ZeroTier is that it provides me with a secure "VPN" - and this works quite happily for all my real machines and VMs - but I want to get this QMail project working with Podman - for all the reasons people like to use containers - but there is still an issue with podman . .
Thanks,
Phil.
How is this an issue with Podman. You need to setup your container with sshd and it should handle the situation you want.
? I have done that - that's how I know there is a problem - from a previous mail:
"OK, now I should be able to use ZeroTier to ssh to the container but although I have installed and started the sshd server and allowed a root login I get:
# ssh 10.147.18.191 ssh: connect to host 10.147.18.191 port 22: No route to host
I can ssh to other (non container) ZT IPs OK . ."
Thanks,
Phil.
Podman setup the container properly. You did not tell your container to start the sshd daemon inside and you did not run the container with ports to listen on.
Basically the container is running within its own network environment and does not have sshd running.
You can exec into the container and start the sshd service.
? That's what I have done . . but I get the above problem . . P. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil@pricom.com.au
On 3/18/20 16:29, Philip Rhoades wrote:
Daniel,
On 2020-03-19 07:11, Daniel Walsh wrote:
On 3/18/20 16:08, Philip Rhoades wrote:
Alexander, Daniel,
On 2020-03-19 04:26, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 10:21 PM Daniel Walsh <dwalsh@redhat.com> wrote:
On 3/18/20 10:42, Alexander E. Patrakov wrote:
On Wed, Mar 18, 2020 at 7:29 PM Philip Rhoades <phil@pricom.com.au> wrote:
> I realise that ssh'ing into a remote container does not fit with the > conceptual framework of how containers are supposed to work but if I can > get it to work, I am prepared to break with convention . . This is only a convention. For LXC, nobody would blame you for connecting to your container via ssh, in fact they encourage you to do so. And I would imagine that it is a valid and natural option for any container that runs systemd inside.
Sure, but I would say that is closer to a VM. You can enable the sshd daemon within the container if you want, or you could just setup an account for the user to ssh to on your host and then setup sudo to run podman exec to enter the container.
Right. However, some people do want lightweight VM lookalikes, and such two-step procedure is sometimes inconvenient e.g. with IDEs or if there are things like umask that are nicely enforced by PAM in the container.
If you want to setup sshd to get into the container, then you need to pick a port on the host for sshd to listen on. And map port 22 from the container to a different port on the host, and then have the remote user ssh to the external port.
Yes. Or just use IPv6 to ssh directly into the container ;)
The point of using ZeroTier is that it provides me with a secure "VPN" - and this works quite happily for all my real machines and VMs - but I want to get this QMail project working with Podman - for all the reasons people like to use containers - but there is still an issue with podman . .
Thanks,
Phil.
How is this an issue with Podman. You need to setup your container with sshd and it should handle the situation you want.
? I have done that - that's how I know there is a problem - from a previous mail:
"OK, now I should be able to use ZeroTier to ssh to the container but although I have installed and started the sshd server and allowed a root login I get:
# ssh 10.147.18.191 ssh: connect to host 10.147.18.191 port 22: No route to host
I can ssh to other (non container) ZT IPs OK . ."
Thanks,
Phil.
In order to connect to a container port from the outside you need to make the ports available. man podman run ... --publish, -p=ip:hostPort:containerPort | ip::containerPort | hostPort:containerPort | containerPort Publish a container's port, or range of ports, to the host. Both hostPort and containerPort can be specified as a range of ports. When specifying ranges for both, the number of container ports in the range must match the number of host ports in the range. Use podman port to see the actual mapping: podman port $CONTAINER $CONTAINERPORT.
participants (4)
-
Alexander E. Patrakov -
Daniel Walsh -
Philip Rhoades -
Philip Rhoades