Podman : Use by common users2024/05/05 |
|
It's possible to use Podman containers by common users.
|
|
| [1] | By default, sub UID/GID that are used on user name spaces are assigned to run containers. |
|
# sub UID/GID mapping file # 100000 to 165535 (100000 + 65536 - 1) UID are used for running processes in containers on [ubuntu] user root@dlp:~# cat /etc/subuid ubuntu:100000:65536 root@dlp:~# cat /etc/subgid ubuntu:100000:65536 # when added new users, sub UID/GID are also added # n=0, n++ # [start UID/GID = 100000 + (65536 * n)] # [end UID/GID = (start UID/GID) + 65536 - 1] root@dlp:~# useradd noble root@dlp:~# useradd numbat root@dlp:~# cat /etc/subgid /etc/subgid ubuntu:100000:65536 noble:165536:65536 numbat:231072:65536 ubuntu:100000:65536 noble:165536:65536 numbat:231072:65536 |
| [2] | It's possible to run [podman] by common users. |
|
ubuntu@dlp:~$ podman pull ubuntu ubuntu@dlp:~$ podman images REPOSITORY TAG IMAGE ID CREATED SIZE docker.io/library/ubuntu latest bf3dc08bfed0 5 days ago 78.7 MB
ubuntu@dlp:~$
podman run ubuntu echo "run rootless containers" run rootless containers # containers related files are located under the [$HOME/.local] directory ubuntu@dlp:~$ ll ~/.local/share/containers/storage total 160 drwx------ 8 ubuntu ubuntu 4096 May 5 06:14 ./ drwx------ 4 ubuntu ubuntu 4096 May 5 06:12 ../ -rw-r--r-- 1 ubuntu ubuntu 122880 May 5 06:14 db.sql -rw-r--r-- 1 ubuntu ubuntu 8 May 5 06:12 defaultNetworkBackend drwx------ 2 ubuntu ubuntu 4096 May 5 06:12 libpod/ drwx------ 2 ubuntu ubuntu 4096 May 5 06:12 networks/ drwx------ 5 ubuntu ubuntu 4096 May 5 06:14 overlay/ drwx------ 3 ubuntu ubuntu 4096 May 5 06:14 overlay-containers/ drwx------ 3 ubuntu ubuntu 4096 May 5 06:12 overlay-images/ drwx------ 2 ubuntu ubuntu 4096 May 5 06:14 overlay-layers/ -rw-r--r-- 1 ubuntu ubuntu 64 May 5 06:14 storage.lock -rw-r--r-- 1 ubuntu ubuntu 0 May 5 06:12 userns.lock # possible to create Pods ubuntu@dlp:~$ podman pod create -p 8081:80 -n test-pod ubuntu@dlp:~$ podman pod ls POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS 4a02b0965cab test-pod Created 4 seconds ago 871d3cd55578 1 # for port mapping, # it's impossible to use less than [1024] ports on Host machine by common users # possible to use over [1024] ports ubuntu@dlp:~$ podman run -itd -p 1023:80 ubuntu /bin/bash Error: rootlessport cannot expose privileged port 1023, you can add 'net.ipv4.ip_unprivileged_port_start=1023' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen tcp 0.0.0.0:1023: bind: permission denied podman run -itd -p 1024:80 ubuntu /bin/bash ubuntu@dlp:~$ podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 8e83a302f0f5 docker.io/library/ubuntu:latest /bin/bash 1 second ago Up 2 seconds 0.0.0.0:1024->80/tcp mystifying_maxwell |
| Sponsored Link |