Podman

By default only is allowed to run containers (or namespaces in kernelspeak). Running rootless Podman improves security as an attacker will not have root privileges over your system, and also allows multiple unprivileged users to run containers on the same machine. See also podman(1) § Rootless mode.

First, check the value of by running:

$ sysctl kernel.unprivileged_userns_clone

If it is currently set to , enable it by setting via sysctl or kernel parameter.

In order for users to run rootless Podman, a and must be set for each user that wants to use it. These information must, ultimately, be stored in and which lists the UIDs for their user namespace.

and  do not exist by default. If they do not exist yet in your system, create them by running:

# touch /etc/subuid /etc/subgid

The following command enables the user and group to run Podman containers (or other types of containers in that case). It allocates a given range of UIDs and GIDs to the given user and group.

# usermod --add-subuids 100000-165535 --add-subgids 100000-165535 username

Now, you should have the following content (replacing with the given username):

Rootless Podman uses a pause process to keep the unprivileged namespaces alive. This prevents any change to the and files from being propagated to the rootless containers while the pause process is running. For these changes to be propagated it is necessary to run:

$ podman system migrate

After this, the user/group specified in the above files is able to start and run Podman containers.

The configuration for how and where container images and instances are stored takes place in .

Set the driver according to the filesystem in use for the storage location (see ).

Podman is able to run images built for different CPU architecture than host using Wikipedia:binfmt_misc system.

To enable it install and packages.

systemd comes with service which should enable new rules.

Verify that binfmt rules have been added:

Podman should now be able to run foreign architecture images. Most commands use the foreign architecture when --arch option is passed.

Example:

Podman 3.0.0 introduces docker-compose support. This requires enabling a Podman socket which pretends to be docker; start the unit. For rootless containers, this requires you to start the user unit instead and set the variable:

$ export DOCKER_HOST="unix://$XDG_RUNTIME_DIR/podman/podman.sock"

To get hostname resolution between containers running install .

The following command pulls the Arch Linux x86_64 image from Docker Hub. This is a stripped down version of Arch core without network, etc.

# podman pull docker.io/archlinux

See also README.md.

For a full Arch base, clone the repository from above and build your own image.

$ git clone https://gitlab.archlinux.org/archlinux/archlinux-docker.git

Make sure that the package is installed.

Edit the packages file so it only contains 'base'. Then run:

# make rootfs
# podman build -t archlinux .

Alpine Linux is a popular choice for small container images, especially for software compiled as static binaries. The following command pulls the latest Alpine Linux image from Docker Hub:

# podman pull docker.io/alpine

Alpine Linux uses the musl libc implementation instead of the glibc libc implementation used by most Linux distributions. Because Arch Linux uses glibc, there are a number of functional differences between an Arch Linux host and an Alpine Linux container that can impact the performance and correctness of software. A list of these differences is documented in https://wiki.musl-libc.org/functional-differences-from-glibc.html.

Note that dynamically linked software built on Arch Linux (or any other system using glibc) may have bugs and performance problems when run on Alpine Linux (or any other system using a different libc). See , and for examples.

The following command pulls the latest CentOS image from Docker Hub:

# podman pull docker.io/centos

See the Docker Hub page for a full list of available tags for each CentOS release.

The following command pulls the latest Debian image from Docker Hub:

# podman pull docker.io/debian

See the Docker Hub page for a full list of available tags, including both standard and slim versions for each Debian release.

By default the registry list is not populated as the files in the package come from upstream. This means that by default, trying to pull any image without specifying the registry will result in an error similar to the following:

Error: short-name "archlinux" did not resolve to an alias and no unqualified-search registries are defined in "/etc/containers/registries.conf"

A starting configuration could be the following:

This is equivalent to the default docker configuration.

It may happen that after logging out from machine, Podman containers are stopped. To prevent that, user lingering should be enabled for user running containers:

$ loginctl enable-linger

You can also create user systemd unit as described: https://docs.podman.io/en/latest/markdown/podman-auto-update.1.html#examples

If you are using AppArmor you might end up with problems when creating container using a bridge network with the plugin enabled:

$ podman network create foo

/home/''user''/.config/cni/net.d/foo.conflist

This can be solved by adding the following lines to :

owner /run/user/[0-9]*/containers/cni/dnsname/*/dnsmasq.conf r,
owner /run/user/[0-9]*/containers/cni/dnsname/*/addnhosts r,
owner /run/user/[0-9]*/containers/cni/dnsname/*/pidfile rw,

And then reloading the AppArmor profile:

# apparmor_parser -R /etc/apparmor.d/usr.sbin.dnsmasq
# apparmor_parser /etc/apparmor.d/usr.sbin.dnsmasq

Error committing the finished image: error adding layer with blob "sha256:02823fca9b5444c196f1f406aa235213254af9909fca270f462e32793e2260d8": Error processing tar file(exit status 1) permitted operation

Check that the storage driver is overlay in the #Storage configuration.

Error: building local pause image: finding pause binary: exec: "catatonit": executable file not found in $PATH

Install the package to fix the error.

For details on upgrading from 3.x to 4.0, see the official blog article

WARN[0000]  binary not found, container dns will not be enabled

If you installed as podman network backend you need to install

Can be solved by starting/enabling .

$ podman exec openvas_openvas_1 bash

Error: crun: writing file `/sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/user.slice/libpod-b3e8048a9b91e43c214b4d850ac7132155a684d6502e12e22ceb6f73848d117a.scope/container/cgroup.procs`: Permission denied: OCI permission denied

Can be solved: https://bbs.archlinux.org/viewtopic.php?id=253966

$ env DBUS_SESSION_BUS_ADDRESS= podman ...
$ env DBUS_SESSION_BUS_ADDRESS= podman-compose ...

WARN[0000] Failed to add pause process to systemd sandbox cgroup: Process org.freedesktop.systemd1 exited with status 1 

Can be solved using: https://github.com/containers/crun/issues/704

# echo +cpu +cpuset +io +memory +pids > /sys/fs/cgroup/cgroup.subtree_control