Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| gentoo:containers [2024/04/02 13:15] – [Podman] willy | gentoo:containers [2025/05/06 05:55] (current) – willy | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Using Containers on Gentoo ====== | + | ====== |
| - | Containers are a great tool that caters to some specific, and important, needs. But be aware that // | + | Containers are a great tool that caters to some specific, and important, needs. But be aware that // |
| - | Bear in mind, always, that **containers** while being an astounding piece of technology, are **NOT** meant and have **NOT** been created with self-hosting in mind. Since it's easy and simple to use them for self-hosting, | + | but since it's easy and simple to use containers |
| Containerization technology can roughly be divided into two big categories: | Containerization technology can roughly be divided into two big categories: | ||
| Line 9: | Line 9: | ||
| * Clusters for deployment (Kubernetes and the like) | * Clusters for deployment (Kubernetes and the like) | ||
| - | Over the course of time the use of Docker in the self-hosted world has increased so much that it's getting | + | Over the course of time the use of Docker in the self-hosted world has increased so much that today it's getting |
| + | |||
| + | Containers | ||
| * Ease of deployment (docker compose up, and there you go) | * Ease of deployment (docker compose up, and there you go) | ||
| * Ease of upgrade (docker pull, and there you go) | * Ease of upgrade (docker pull, and there you go) | ||
| Line 15: | Line 17: | ||
| * For developers, it's easier to provide a // | * For developers, it's easier to provide a // | ||
| - | I am realizing more and more the added value of using containers, so i have changed my mind over time. I still think there are negative points in relying on Docker for self-hosting: | + | At the beginning i was against using containers for deployment, but i am realizing more and more the added value of using containers, so i have changed my mind over time. |
| + | |||
| + | I still think there are negative points in relying on Docker for self-hosting: | ||
| * All services running as //root// (against Linux policies) | * All services running as //root// (against Linux policies) | ||
| * Lots of duplicated services (how many postgress databases have you running around?) | * Lots of duplicated services (how many postgress databases have you running around?) | ||
| Line 50: | Line 54: | ||
| [[https:// | [[https:// | ||
| - | * Doesn' | + | * Doesn' |
| - | * Doesn' | + | * Doesn' |
| * Integrates with OpenRC/ | * Integrates with OpenRC/ | ||
| * It's fully Open Source | * It's fully Open Source | ||
| Line 57: | Line 61: | ||
| * It's not monolithic but it's actually a set of tools | * It's not monolithic but it's actually a set of tools | ||
| * And it's also fully Docker-compatible (set alias docker=podman and you are dood to go, almost) | * And it's also fully Docker-compatible (set alias docker=podman and you are dood to go, almost) | ||
| + | * Doesn' | ||
| Overall **Podman** is much more adherent to the Linux/Unix way of doing things. | Overall **Podman** is much more adherent to the Linux/Unix way of doing things. | ||
| Line 63: | Line 68: | ||
| <code bash> | <code bash> | ||
| echo " | echo " | ||
| - | emerge podman | + | emerge |
| </ | </ | ||
| Line 79: | Line 84: | ||
| which i suggest to run as un-priviledged user to verify everything is working as non-root too. | which i suggest to run as un-priviledged user to verify everything is working as non-root too. | ||
| - | Now, install | + | Podman is fully compatible with **Docker Compose**, so you should just emerge it and start using compose: |
| + | <code bash> | ||
| + | emerge -vp docker-compose | ||
| + | </ | ||
| - | Follow my [[gentoo: | + | Or you can choose |
| - | <file - podman-compose-1.0.6.ebuild> | + | <code bash> |
| - | # Copyright 2024 Gentoo Authors | + | emerge |
| - | # Distributed under the terms of the GNU General Public License v2 | + | </ |
| - | EAPI=8 | + | of course, you need to pick one or the other. I am using podman-compose at this time. |
| - | DISTUTILS_USE_SETUPTOOLS=rdepend | ||
| - | PYTHON_COMPAT=( python3_{10..11} ) | ||
| - | inherit distutils-r1 | + | === Podman rootless users === |
| - | DESCRIPTION=" | + | When running a container rootless, which is the main point behind Podman, you might end up having some issues |
| - | HOMEPAGE=" | + | |
| - | SRC_URI=" | + | |
| - | # | + | |
| - | LICENSE=" | + | [[https:// |
| - | SLOT=" | + | |
| - | KEYWORDS=" | + | |
| - | DEPEND="" | + | In short: when running rootless, the //user 0//, or root, of the container, will be mapped to your user ID, and any // |
| - | RDEPEND=" | + | |
| - | ${DEPEND} | + | |
| - | dev-python/pyyaml[${PYTHON_USEDEP}] | + | |
| - | dev-python/python-dotenv[${PYTHON_USEDEP}] | + | |
| - | " | + | |
| - | BDEPEND="" | + | |
| - | </file> | + | |
| - | as // | + | The easiest way to fix it, is to force your container to run... **as user 0**! In fact, since we are using rootless podman, that only means **as your own user** nad not actually root. |
| - | I hope that this ebuild will be merged to Gentoo official repo soon. | ||
| ==== Podman networks ==== | ==== Podman networks ==== | ||
| Line 121: | Line 114: | ||
| To create a Podman subnet you need to run the following command after each reboot, as root: | To create a Podman subnet you need to run the following command after each reboot, as root: | ||
| <code bash> | <code bash> | ||
| - | > | + | podman network create my-container-net |
| </ | </ | ||
| Line 141: | Line 134: | ||
| networks: | networks: | ||
| my-container-net: | my-container-net: | ||
| - | | + | </ |
| | | ||
| - | | + | I strongly suggest that you edit your docker compose files and ensure each service has it's own independent network. I will give more details for each service on it's respective page. |
| + | |||
| + | |||
| + | ==== Podman containers autostart ==== | ||
| + | |||
| + | Autostarting containers is pretty easy if you use SystemD, but even if you don't, and i don't, it's easy enough too. | ||
| + | |||
| + | <file - / | ||
| + | # | ||
| + | # Copyright 2024 Willy Garidol | ||
| + | # Distributed under the terms of the GNU General Public License v3 | ||
| + | |||
| + | depend() { | ||
| + | need localmount net | ||
| + | } | ||
| + | |||
| + | UC_LOG_PATH=/ | ||
| + | UC_SLOT=" | ||
| + | UC_USER=${USER: | ||
| + | UC_COMPOSER_FILE=${COMPOSER_FILE: | ||
| + | UC_CHOWN_DIR=${CHOWN_DIR} | ||
| + | if [ " | ||
| + | then | ||
| + | UC_HOME=${HOME: | ||
| + | fi | ||
| + | |||
| + | extra_commands=" | ||
| + | update() { | ||
| + | if [ " | ||
| + | then | ||
| + | COMMAND=" | ||
| + | stop | ||
| + | ebegin " | ||
| + | su - ${UC_USER} -c " | ||
| + | start | ||
| + | else | ||
| + | ebegin " | ||
| + | eend 255 | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | description=${DESCRIPTION: | ||
| + | pidfile="/ | ||
| + | |||
| + | start_pre() { | ||
| + | if [ " | ||
| + | then | ||
| + | test -e " | ||
| + | test -e " | ||
| + | mkdir " | ||
| + | } && chown -R ${UC_USER} " | ||
| + | if [ -n " | ||
| + | then | ||
| + | chown -R ${UC_USER} ${UC_CHOWN_DIR} | ||
| + | fi | ||
| + | else | ||
| + | ebegin " | ||
| + | eend 255 | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | |||
| + | start() { | ||
| + | ebegin " | ||
| + | COMMAND=" | ||
| + | ARGUMENTS=(compose -f ${UC_COMPOSER_FILE} up) | ||
| + | ebegin " ... ensuring nat table is loaded ..." | ||
| + | iptables -L -t nat &> /dev/null | ||
| + | ebegin " ... creating ' | ||
| + | podman network create ${UC_SLOT}-net &> /dev/null | ||
| + | su - " | ||
| + | start-stop-daemon -p ${pidfile} \ | ||
| + | -1 " | ||
| + | -2 " | ||
| + | -u ${UC_USER} \ | ||
| + | -d ${UC_HOME} \ | ||
| + | -b -m \ | ||
| + | --start | ||
| + | -- ${ARGUMENTS[@]} | ||
| + | eend $? | ||
| + | } | ||
| + | |||
| + | stop() { | ||
| + | ebegin " ... running ' | ||
| + | su - " | ||
| + | start-stop-daemon -p ${pidfile} \ | ||
| + | -u ${UC_USER} \ | ||
| + | -d ${UC_HOME} \ | ||
| + | --stop ${UC_SLOT} | ||
| + | eend $? | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | I assume you have a**service_name** that runs with a podman compose file as user **myuser**. | ||
| + | |||
| + | Just link the above script to your new service file: | ||
| + | <code bash> | ||
| + | ln -s / | ||
| + | </ | ||
| + | |||
| + | and create | ||
| + | <file - / | ||
| + | USER=myuser | ||
| + | DESCRIPTION=" | ||
| + | </ | ||
| + | |||
| + | and add the service to your desired runlevel: | ||
| + | <code bash> | ||
| + | rc-update add user-containers.service_name default | ||
| + | </ | ||
| + | |||
| + | That's it. | ||
| + | |||
| + | The above script also provide an " | ||
| ==== Using Podman for new containers ==== | ==== Using Podman for new containers ==== | ||
| Line 149: | Line 256: | ||
| Well, just replace any **docker** command with **podman** and you are good to go. Including the usual: | Well, just replace any **docker** command with **podman** and you are good to go. Including the usual: | ||
| <code bash> | <code bash> | ||
| - | > | + | podman compose up |
| </ | </ | ||
| Line 158: | Line 265: | ||
| * Podman containers are not restarted at boot: i will give you instructions for those services as needed. | * Podman containers are not restarted at boot: i will give you instructions for those services as needed. | ||
| * Networks needs to be explicitly declared and created as root. | * Networks needs to be explicitly declared and created as root. | ||
| + | |||
| + | |||
| ==== Migration from Docker to Podman ==== | ==== Migration from Docker to Podman ==== | ||
| Line 165: | Line 274: | ||
| Start by creating a non-privileged user (let's call it //service// to match the service name), let it point to where you stored the docker-compose.yml for the service (which should be **/ | Start by creating a non-privileged user (let's call it //service// to match the service name), let it point to where you stored the docker-compose.yml for the service (which should be **/ | ||
| <code bash> | <code bash> | ||
| - | > | + | useradd -d / |
| - | > chown service: | + | chown service: |
| </ | </ | ||
| Line 173: | Line 282: | ||
| Now, most probably all you need to do is the classic (but rewritten): | Now, most probably all you need to do is the classic (but rewritten): | ||
| <code bash> | <code bash> | ||
| - | > | + | su - service |
| - | > podman compose -f docker-compose.yml up | + | podman compose -f docker-compose.yml up |
| </ | </ | ||
| Line 185: | Line 294: | ||
| If you need to export your images from Docker to Podman (you don't if they are public images), as root, export all docker images relevant to your service (you can see them in the composer file), use //docker image ls// to list images and //docker save -o ...// to save each one of them as a tar file: | If you need to export your images from Docker to Podman (you don't if they are public images), as root, export all docker images relevant to your service (you can see them in the composer file), use //docker image ls// to list images and //docker save -o ...// to save each one of them as a tar file: | ||
| <code bash> | <code bash> | ||
| - | > | + | mkdir / |
| - | > docker image ls | + | docker image ls |
| - | > docker image save -o / | + | docker image save -o / |
| - | > chown service: | + | chown service: |
| </ | </ | ||
| (repeat for each image for the service!) | (repeat for each image for the service!) | ||
| Line 194: | Line 303: | ||
| If your container uses also volumes, copy them to your //service// user, as root: | If your container uses also volumes, copy them to your //service// user, as root: | ||
| <code bash> | <code bash> | ||
| - | > | + | mkdir / |
| - | > cp -a / | + | cp -a / |
| - | > chown service: | + | chown service: |
| </ | </ | ||
| (repeat for each volume for the service!) | (repeat for each volume for the service!) | ||
| Line 202: | Line 311: | ||
| Now, as user //server//, import the images and create the volumes: | Now, as user //server//, import the images and create the volumes: | ||
| <code bash> | <code bash> | ||
| - | > | + | su - service |
| - | > podman load -i docker-export/ | + | podman load -i docker-export/ |
| </ | </ | ||
| Line 219: | Line 328: | ||
| <code bash> | <code bash> | ||
| - | > | + | cp -a / |
| </ | </ | ||
| Line 229: | Line 338: | ||
| - ping is restricted and cannot b performed from containers. If you need to enable it, type as root: | - ping is restricted and cannot b performed from containers. If you need to enable it, type as root: | ||
| <code bash> | <code bash> | ||
| - | > | + | sysctl -w " |
| </ | </ | ||
| This can be made permanent in **/ | This can be made permanent in **/ | ||
| Line 237: | Line 346: | ||
| - Running as simple user a container will not be allowed to bind to ports under 1024. Some ill-designed containers will insist on this. The only recurse (except don't use such broken images) is to allow ports for normal users with: | - Running as simple user a container will not be allowed to bind to ports under 1024. Some ill-designed containers will insist on this. The only recurse (except don't use such broken images) is to allow ports for normal users with: | ||
| <code bash> | <code bash> | ||
| - | > | + | sysctl -w " |
| </ | </ | ||
| This can be made permanent in **/ | This can be made permanent in **/ | ||