Basic settings, usage and volumes in podman rootless environment

Basic setup and use of Podman in a rootless environment

User operation

Before allowing users without root privileges to run Podman, the administrator must install or build Podman and complete the following configuration

cgroup V2Linux kernel function allows users to limit the resources that can be used by ordinary user containers. If you use cgroupV2 to enable the Linux distribution running Podman, you may need to change the default OCI runtime. Some older versions of runc are not applicable to cgroupV2. You must switch to the standby OCI runtime crun.

[root@localhost ~]# rpm -qa |grep crun
[root@localhost ~]# yum -y install crun / / I don't have it here, so I need to install it. Most centos8 systems come with it

[root@localhost ~]# cd /usr/share/containers/
[root@localhost containers]# pwd 
/usr/share/containers
[root@localhost containers]# ls
containers.conf  mounts.conf  seccomp.json  selinux
[root@localhost containers]# vim containers.conf 

# Default OCI runtime
#
runtime = "crun"				//Uncomment and change runc to crun
#runtime = "runc"

[root@localhost ~]# podman run -d --name web1 -p 80:80 httpd
3ddfdbef3bdb893f09a1c6fcff27cffa8d465db68dccc83be1f5ad57eb31e1a2
[root@localhost ~]# podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS               NAMES
3ddfdbef3bdb  docker.io/library/httpd:latest  httpd-foreground  4 seconds ago  Up 4 seconds ago  0.0.0.0:80->80/tcp  web1
[root@localhost ~]# 

Install slirp4netns and fuse overlay FS

When using Podman in an ordinary user environment, it is recommended to use fuse overlayfs instead of VFS file system, which requires at least version 0.7.6. Now the new version defaults to it.
No, just follow this command
yum -y install slirp4netns
yum -y install fuse-overlayfs

[root@localhost ~]# rpm -qa |grep slirp4netns
slirp4netns-1.1.8-1.module_el8.5.0+890+6b136101.x86_64
[root@localhost ~]# rpm -qa |grep fuse-overlayfs
fuse-overlayfs-1.7.1-1.module_el8.5.0+890+6b136101.x86_64
[root@localhost ~]# 
[root@localhost ~]# cd /etc/containers/
[root@localhost containers]# vim storage.conf 

# directly.
mount_program = "/usr/bin/fuse-overlayfs"		 //note off

[root@localhost containers]# Which fuse overlayfs / / search to see if it can be found. If it is found, it means that the startup is successful
/usr/bin/fuse-overlayfs
[root@localhost containers]# 

/etc / subuid and / etc / subgid configuration

Podman requires the user running it to list a series of UIDs in the / etc / subuid and / etc / subgid files. Shadow utils or newuid packages provide these files

[root@localhost ~]# DNF - y install shadow utils. / / podman is usually installed

You can/ etc / subuid and/ etc / subgid The value of each user must be unique and there is no overlap.
[root@localhost ~]# useradd laoliu
[root@localhost ~]# id laoliu
uid=1001(laoliu) gid=1001(laoliu) groups=1001(laoliu)
[root@localhost ~]# 
[root@localhost ~]# cat /etc/subuid
cys:100000:65536
laoliu:165536:65536
[root@localhost ~]# 

// Start non privileged ping 
[root@localhost ~]# vim /etc/sysctl.conf 

net.ipv4.ping_group_range=0 200000		//If it is greater than 100000, it means that laoliu can operate podman

The format of this file is / etc/passwd in USERNAME:UID:RANGE or the user name getpwent listed in the output.

The initial UID assigned to the user.
The size of the UID range assigned to the user.
The usermod program can be used to assign UID s and GID S to users instead of directly updating files.

[root@localhost ~]# usermod --del-subuids 165536-231072 --del-subgids 165536-231072 laoliu
[root@localhost ~]# cat /etc/subuid
cys:100000:65536
[root@localhost ~]# usermod --add-subuids 200000-201000 --add-subgids 200000-201000 laoliu
[root@localhost ~]# cat /etc/subuid
cys:100000:65536
laoliu:200000:1001
[root@localhost ~]# 

User profile

The three main configuration files are container.conf, storage.conf and registers.conf. Users can modify these files as needed.

container.conf

// User profile
[root@localhost ~]# cat /usr/share/containers/containers.conf
[root@localhost ~]# cat /etc/containers/containers.conf
[root@localhost ~]# cat ~/.config/containers/containers.conf / / the highest priority

If they exist in this order. Each file can overwrite the previous file for a specific field.

Configure the storage.conf file

1./etc/containers/storage.conf
2.$HOME/.config/containers/storage.conf

In normal users, some fields in / etc/containers/storage.conf will be ignored

[root@localhost ~]#  vi /etc/containers/storage.conf
[storage]

# Default Storage Driver, Must be set for proper operation.
driver = "overlay"    #Change to overlay here
.......
mount_program = "/usr/bin/fuse-overlayfs"    #note off

[root@localhost ~]# vim /etc/sysctl.conf 
user.max_user_namespaces=15000

In normal users, these fields are default

graphroot="$HOME/.local/share/containers/storage"
runroot="$XDG_RUNTIME_DIR/containers"

registries.conf

The configuration is read in in this order. These files are not created by default. You can copy / etc/containers from / usr/share/containers and modify them.

[root@localhost ~]# find / -name registries.conf
/etc/containers/registries.conf
[root@localhost ~]# 


1./etc/containers/registries.conf
2./etc/containers/registries.d/*
3.HOME/.config/containers/registries.conf

The password of the docker account is written in this file and displayed in encrypted form
No root user and root user naming authorization are the same

//No root user
[root@localhost ~]# su - laoliu
[laoliu@localhost ~]$ find / -name auth.json

[laoliu@localhost ~]$ cat /tmp/podman-run-1001/containers/auth.json
{
	"auths": {
		"docker.io": {
			"auth": "MGI4ZDU3MmQxYzdkOjEyMzQ1Njc4OQ=="
		}
	}
}[laoliu@localhost ~]$ 


//This is the root user
[root@localhost ~]# podman login 
Username: 0b8d572d1c7d
Password: 
Login Succeeded!
[root@localhost ~]# find / -name auth.json
/run/user/0/containers/auth.json
[root@localhost ~]# cat /run/user/0/containers/auth.json 
{
	"auths": {
		"docker.io": {
			"auth": "MGI4ZDU3MmQxYzdkOjEyMzQ1Njc4OQ=="
		}
	}
}[root@localhost ~]# 

Ordinary users cannot see the image of the root user

//root user
[root@localhost ~]# podman images
REPOSITORY                  TAG      IMAGE ID       CREATED       SIZE
docker.io/library/httpd     latest   ea28e1b82f31   11 days ago   146 MB

//Ordinary user
[root@localhost ~]# su - laoliu
[zz@localhost ~]$ podman images
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE

volume

If the container runs with the root user, the user in the root container is actually the user on the host.
UID GID is the first UID GID specified in the user mapping in / etc/subuid and / etc/subgid.
If you mount a file from the host directory to the container as an ordinary user and create a file as a root user in the directory, you will see that it is actually owned by your user on the host.
Use volume


Tags: Linux Operation & Maintenance server

Posted by moneytree on Wed, 07 Sep 2022 01:44:12 +0930