Podman : Use by common users2023/06/21 |
It's possible to use Podman containers by common users.
|
|
[1] | By default, sub UID/GID that are used on user name spaces are assigned to run containers. |
# sub UID/GID mapping file # 100000 to 165535 (100000 + 65536 - 1) UID are used for running processes in containers on [debian] user root@dlp:~# cat /etc/subuid debian:100000:65536 root@dlp:~# cat /etc/subgid debian:100000:65536 # when added new users, sub UID/GID are also added # n=0, n++ # [start UID/GID = 100000 + (65536 * n)] # [end UID/GID = (start UID/GID) + 65536 - 1] root@dlp:~# adduser bookworm root@dlp:~# adduser bullseye root@dlp:~# cat /etc/subgid /etc/subgid debian:100000:65536 bookworm:165536:65536 bullseye:231072:65536 debian:100000:65536 bookworm:165536:65536 bullseye:231072:65536 |
[2] | It's possible to run [podman] by common users. |
debian@dlp:~$ podman pull debian debian@dlp:~$ podman images REPOSITORY TAG IMAGE ID CREATED SIZE docker.io/library/debian latest 49081a1edb0b 8 days ago 121 MB
debian@dlp:~$
podman run debian echo "run rootless containers" run rootless containers # containers related files are located under the [$HOME/.local] directory debian@dlp:~$ ll ~/.local/share/containers/storage total 40 -rw-r--r-- 1 debian debian 8 Jun 20 19:43 defaultNetworkBackend drwx------ 2 debian debian 4096 Jun 20 19:43 libpod drwx------ 2 debian debian 4096 Jun 20 19:43 mounts drwx------ 2 debian debian 4096 Jun 20 19:43 networks -rw-r--r-- 1 debian debian 64 Jun 20 19:43 storage.lock drwx------ 2 debian debian 4096 Jun 20 19:43 tmp -rw-r--r-- 1 debian debian 0 Jun 20 19:43 userns.lock drwx------ 3 debian debian 4096 Jun 20 19:43 vfs drwx------ 3 debian debian 4096 Jun 20 19:43 vfs-containers drwx------ 3 debian debian 4096 Jun 20 19:43 vfs-images drwx------ 2 debian debian 4096 Jun 20 19:43 vfs-layers # possible to create Pods debian@dlp:~$ podman pod create -p 8081:80 -n test-pod debian@dlp:~$ podman pod ls POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS 320b3c32a425 test-pod Created 5 seconds ago 28376d9a53e7 1 # for port mapping, # it's impossible to use less than [1024] ports on Host machine by common users # possible to use over [1024] ports debian@dlp:~$ podman run -d -p 1023:80 srv.world/debian-nginx Error: rootlessport cannot expose privileged port 1023, you can add 'net.ipv4.ip_unprivileged_port_start=1023' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen tcp 0.0.0.0:1023: bind: permission denied podman run -d -p 1024:80 srv.world/debian-nginx debian@dlp:~$ podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES f56f30ae7a8b srv.world/debian-nginx:latest /usr/sbin/nginx -... 5 seconds ago Up 6 seconds ago 0.0.0.0:1024->80/tcp suspicious_golick |
Sponsored Link |
|