Podman : Use by common users2021/03/22 |
|
It's possible to use Podman containers by common users.
|
|
| [1] | By default, sub UID/GID that are used on user name spaces are assigned to run containers. |
|
# sub UID/GID mapping file # 100000 to 165535 (100000 + 65536 - 1) UID are used for running processes in containers on [cent] user [root@dlp ~]# cat /etc/subuid cent:100000:65536 [root@dlp ~]# cat /etc/subgid cent:100000:65536 # when added new users, sub UID/GID are also added # n=0, n++ # [start UID/GID = 100000 + (65536 * n)] # [end UID/GID = (start UID/GID) + 65536 - 1] [root@dlp ~]# useradd centos [root@dlp ~]# useradd redhat [root@dlp ~]# cat /etc/subgid /etc/subgid cent:100000:65536 centos:165536:65536 redhat:231072:65536 cent:100000:65536 centos:165536:65536 redhat:231072:65536 |
| [2] | It's possible to run [podman] by common users. |
|
[centos@dlp ~]$ podman pull centos:stream8 [centos@dlp ~]$ podman images REPOSITORY TAG IMAGE ID CREATED SIZE registry.centos.org/centos stream8 2f3766df23b6 3 months ago 217 MB
[centos@dlp ~]$
podman run centos:stream8 echo "run rootless containers" run rootless containers # containers related files are located under the [$HOME/.local] directory [centos@dlp ~]$ ll ~/.local/share/containers/storage total 4 drwx------. 2 centos centos 39 Mar 19 11:38 cache drwx------. 2 centos centos 27 Mar 19 11:38 libpod drwx------. 2 centos centos 6 Mar 19 11:38 mounts drwx------. 5 centos centos 159 Mar 19 11:40 overlay drwx------. 3 centos centos 124 Mar 19 11:40 overlay-containers drwx------. 3 centos centos 116 Mar 19 11:39 overlay-images drwx------. 2 centos centos 129 Mar 19 11:40 overlay-layers -rw-r--r--. 1 centos centos 64 Mar 19 11:40 storage.lock drwx------. 2 centos centos 6 Mar 19 11:38 tmp -rw-r--r--. 1 centos centos 0 Mar 19 11:38 userns.lock # possible to create Pods [centos@dlp ~]$ podman pod create -p 8081:80 -n test-pod [centos@dlp ~]$ podman pod ls POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS 9e99670113a1 test-pod Created 7 seconds ago 96a40c2b7c37 1 # for port mapping, # it's impossible to use less than [1024] ports on Host machine by common users # possible to use over [1024] ports [centos@dlp ~]$ podman run -d -p 1023:80 srv.world/centos-nginx Error: rootlessport cannot expose privileged port 1023, you can add 'net.ipv4.ip_unprivileged_port_start=1023' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen tcp 0.0.0.0:1023: bind: permission denied podman run -d -p 1024:80 srv.world/centos-nginx [centos@dlp ~]$ podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 377f620d7bf8 srv.world/centos-nginx /usr/sbin/nginx -... About a minute ago Up About a minute ago 0.0.0.0:1024->80/tcp vigilant_proskuriakova |
| Sponsored Link |
|
|