Podman : Use by common users2021/08/28 |
It's possible to use Podman containers by common users.
|
|
[1] | By default, sub UID/GID that are used on user name spaces are asigned to run containers. |
# sub UID/GID mapping file # 100000 to 165535 (100000 + 65536 - 1) UID are used for running processes in containers on [debian] user root@dlp:~# cat /etc/subuid debian:100000:65536 root@dlp:~# cat /etc/subgid debian:100000:65536 # when added new users, sub UID/GID are also added # n=0, n++ # [start UID/GID = 100000 + (65536 * n)] # [end UID/GID = (start UID/GID) + 65536 - 1] root@dlp:~# adduser bullseye root@dlp:~# adduser buster root@dlp:~# cat /etc/subgid /etc/subgid debian:100000:65536 bullseye:165536:65536 buster:231072:65536 debian:100000:65536 bullseye:165536:65536 buster:231072:65536 # on Debian 11 default, Cgroupv2 is enabled, # so, run follows to allow to use [podman] for each common user root@dlp:~# loginctl enable-linger 1000
|
[2] | It's possible to run [podman] by common users. |
debian@dlp:~$ podman pull debian debian@dlp:~$ podman images REPOSITORY TAG IMAGE ID CREATED SIZE docker.io/library/debian latest fe3c5de03486 11 days ago 129 MB
debian@dlp:~$
podman run debian echo "run rootless containers" run rootless containers # containers related files are located under the [$HOME/.local] directory debian@dlp:~$ ll ~/.local/share/containers/storage total 36 drwx------ 2 debian debian 4096 Aug 28 03:10 cache drwx------ 2 debian debian 4096 Aug 28 03:09 libpod drwx------ 2 debian debian 4096 Aug 28 03:09 mounts drwx------ 5 debian debian 4096 Aug 28 03:26 overlay drwx------ 3 debian debian 4096 Aug 28 03:26 overlay-containers drwx------ 3 debian debian 4096 Aug 28 03:10 overlay-images drwx------ 2 debian debian 4096 Aug 28 03:26 overlay-layers -rw-r--r-- 1 debian debian 64 Aug 28 03:26 storage.lock drwx------ 2 debian debian 4096 Aug 28 03:09 tmp -rw-r--r-- 1 debian debian 0 Aug 28 03:09 userns.lock # possible to create Pods debian@dlp:~$ podman pod create -p 8081:80 -n test-pod debian@dlp:~$ podman pod ls POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS 3f5056cf53dd test-pod Created 6 seconds ago fe2d25ff6f4e 1 # for port mapping, # it's impossible to use less than [1024] ports on Host machine by common users # possible to use over [1024] ports debian@dlp:~$ podman run -d -p 1023:80 srv.world/debian-nginx Error: rootlessport cannot expose privileged port 1023, you can add 'net.ipv4.ip_unprivileged_port_start=1023' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen tcp 0.0.0.0:1023: bind: permission denied podman run -d -p 1024:80 srv.world/debian-nginx debian@dlp:~$ podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 78b807f96e29 srv.world/debian-nginx /usr/sbin/nginx -... 7 seconds ago Up 7 seconds ago 0.0.0.0:1024->80/tcp admiring_poincare |
Sponsored Link |