Podman : Use by common users2021/07/29 |
|
It's possible to use Podman containers by common users.
|
|
| [1] | By default, sub UID/GID that are used on user name spaces are asigned to run containers. |
|
# sub UID/GID mapping file # 100000 to 165535 (100000 + 65536 - 1) UID are used for running processes in containers on [rocky] user [root@dlp ~]# cat /etc/subuid rocky:100000:65536 [root@dlp ~]# cat /etc/subgid rocky:100000:65536 # when added new users, sub UID/GID are also added # n=0, n++ # [start UID/GID = 100000 + (65536 * n)] # [end UID/GID = (start UID/GID) + 65536 - 1] [root@dlp ~]# useradd centos [root@dlp ~]# useradd redhat [root@dlp ~]# cat /etc/subgid /etc/subgid rocky:100000:65536 centos:165536:65536 redhat:231072:65536 rocky:100000:65536 centos:165536:65536 redhat:231072:65536 |
| [2] | It's possible to run [podman] by common users. |
|
[rocky@dlp ~]$ podman pull docker.io/rockylinux/rockylinux [rocky@dlp ~]$ podman images REPOSITORY TAG IMAGE ID CREATED SIZE docker.io/rockylinux/rockylinux latest 333da17614b6 5 weeks ago 234 MB
[rockyos@dlp ~]$
podman run rockylinux echo "run rootless containers" run rootless containers # containers related files are located under the [$HOME/.local] directory [rockyos@dlp ~]$ ll ~/.local/share/containers/storage total 4 drwx------. 2 rocky rocky 39 Jul 29 16:36 cache drwx------. 2 rocky rocky 27 Jul 29 16:36 libpod drwx------. 2 rocky rocky 6 Jul 29 16:36 mounts drwx------. 5 rocky rocky 159 Jul 29 16:36 overlay drwx------. 3 rocky rocky 124 Jul 29 16:36 overlay-containers drwx------. 3 rocky rocky 116 Jul 29 16:36 overlay-images drwx------. 2 rocky rocky 129 Jul 29 16:36 overlay-layers -rw-r--r--. 1 rocky rocky 64 Jul 29 16:36 storage.lock drwx------. 2 rocky rocky 6 Jul 29 16:36 tmp -rw-r--r--. 1 rocky rocky 0 Jul 29 16:36 userns.lock # possible to create Pods [rocky@dlp ~]$ podman pod create -p 8081:80 -n test-pod [rocky@dlp ~]$ podman pod ls POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS a45fa9ec18bb test-pod Created 5 seconds ago 6738b8478bbd 1 # for port mapping, # it's impossible to use less than [1024] ports on Host machine by common users # possible to use over [1024] ports [rocky@dlp ~]$ podman run -d -p 1023:80 srv.world/rocky-nginx Error: rootlessport cannot expose privileged port 1023, you can add 'net.ipv4.ip_unprivileged_port_start=1023' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen tcp 0.0.0.0:1023: bind: permission denied podman run -d -p 1024:80 srv.world/rocky-nginx [rocky@dlp ~]$ podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES e35c94ecffcf srv.world/rocky-nginx /usr/sbin/nginx -... 5 seconds ago Up 5 seconds ago 0.0.0.0:1024->80/tcp wonderful_chebyshev |
| Sponsored Link |
|
|