Podman: Difference between revisions

Latest revision as of 20:41, 26 September 2024

Podman can run rootless containers and be a drop-in replacement for Docker.

Setup

To enable Podman support, add following lines to your system configuration

# Enable common container config files in /etc/containers
virtualisation.containers.enable = true;
virtualisation = {
  podman = {
    enable = true;
    # Create a `docker` alias for podman, to use it as a drop-in replacement
    dockerCompat = true;
    # Required for containers under podman-compose to be able to talk to each other.
    defaultNetwork.settings.dns_enabled = true;
  };
};

users.users.myuser = {
  isNormalUser = true;
  extraGroups = [ "podman" ];
};

Replace myuser with your current user. A reboot or re-login might be required for the permissions to take effect after applying changes.

Tips and tricks

podman-compose

podman-compose is a drop-in replacement for docker-compose

Using podman with ZFS

Rootless can't use ZFS directly but the overlay needs POSIX ACL enabled for the underlying ZFS filesystem, ie., acltype=posixacl

Best to mount a dataset under /var/lib/containers/storage with property acltype=posixacl.

Use Podman within nix-shell

https://gist.github.com/adisbladis/187204cb772800489ee3dac4acdd9947

Note that rootless podman requires newuidmap (from shadow). If you're not on NixOS, this cannot be supplied by the Nix package 'shadow' since setuid/setgid programs are not currently supported by Nix.

Run Podman containers as systemd services

{
  virtualisation.oci-containers.backend = "podman";
  virtualisation.oci-containers.containers = {
    container-name = {
      image = "container-image";
      autoStart = true;
      ports = [ "127.0.0.1:1234:1234" ];
    };
  };
}

@@ Line 1: / Line 1: @@
-Podman can run rootless containers and be a drop-in replacement for Docker.
+[https://podman.io/ Podman] can run rootless containers and be a drop-in replacement for [[Docker]].
-== Install and configure podman with NixOS service configuration (NixOS unstable) ==
+== Setup ==
+To enable Podman support, add following lines to your system configuration<syntaxhighlight lang="nix">
+# Enable common container config files in /etc/containers
+virtualisation.containers.enable = true;
+virtualisation = {
+  podman = {
+    enable = true;
+    # Create a `docker` alias for podman, to use it as a drop-in replacement
+    dockerCompat = true;
+    # Required for containers under podman-compose to be able to talk to each other.
+    defaultNetwork.settings.dns_enabled = true;
+  };
+};
-<syntaxHighlight lang="nix">
+users.users.myuser = {
-{ pkgs, ... }:
+   isNormalUser = true;
-{
+  extraGroups = [ "podman" ];
-   virtualisation = {
+};
-    # To map subuid and subguid for your user and allow rootless containers
+</syntaxhighlight>Replace <code>myuser</code> with your current user. A reboot or re-login might be required for the permissions to take effect after applying changes.
-    containers.users = [ "yourusername" ];
-    podman = {
+== Tips and tricks ==
-      enable = true;
-      # Create a `docker` alias for podman, to use it as a drop-in replacement
+=== podman-compose ===
-      dockerCompat = true;
+<code>podman-compose</code> is a drop-in replacement for <code>docker-compose</code>
-    };
-  };
-}
-</syntaxHighlight>
+=== Using podman with ZFS ===
-== Old manual configuration (NixOS <=20.03) ==
+Rootless can't use [[ZFS]] directly but the overlay needs POSIX ACL enabled for the underlying ZFS filesystem, ie., <code>acltype=posixacl</code>
-<syntaxHighlight lang="nix">
+Best to mount a dataset under <code>/var/lib/containers/storage</code> with property <code>acltype=posixacl</code>.
-{ pkgs, ... }:
-{
-  environment.systemPackages = with pkgs; [ podman runc conmon slirp4netns fuse-overlayfs ];
-}
-</syntaxHighlight>
-=== Configure subuid/subgid for your user ===
+=== Use Podman within nix-shell ===
+https://gist.github.com/adisbladis/187204cb772800489ee3dac4acdd9947
-<syntaxHighlight lang="nix">
+Note that rootless podman requires newuidmap (from shadow). If you're not on NixOS, this cannot be supplied by the Nix package 'shadow' since [https://nixos.org/manual/nix/unstable/expressions/derivations.html setuid/setgid programs are not currently supported by Nix].
-{
-  users.users.username.subUidRanges = [{ startUid = 100000; count = 65536; }];
-  users.users.username.subGidRanges = [{ startGid = 100000; count = 65536; }];
-}
-</syntaxHighlight>
-=== Create configuration files ===
+=== Run Podman containers as systemd services ===
 <syntaxHighlight lang="nix">
 {
-   environment.etc."containers/policy.json" = {
+   virtualisation.oci-containers.backend = "podman";
-    mode="0644";
+   virtualisation.oci-containers.containers = {
-    text=''
+     container-name = {
-      {
+      image = "container-image";
-        "default": [
+      autoStart = true;
-          {
+       ports = [ "127.0.0.1:1234:1234" ];
-            "type": "insecureAcceptAnything"
+     };
-          }
-        ],
-        "transports":
-          {
-            "docker-daemon":
-              {
-                "": [{"type":"insecureAcceptAnything"}]
-              }
-          }
-      }
-    '';
-  };
-   environment.etc."containers/registries.conf" = {
-     mode="0644";
-    text=''
-       [registries.search]
-      registries = ['docker.io', 'quay.io']
-     '';
    };
 }
 </syntaxHighlight>
+[[Category:Software]]
+[[Category:Server]]
+[[Category:Container]]