Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| gentoo:containers [2025/02/06 10:53] – [Podman networks] willy | gentoo:containers [2025/05/06 05:55] (current) – willy | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Using Containers on Gentoo ====== | + | ====== |
| - | Containers are a great tool that caters to some specific, and important, needs. But be aware that // | + | Containers are a great tool that caters to some specific, and important, needs. But be aware that // |
| - | Bear in mind, always, that **containers** while being an astounding piece of technology, are **NOT** meant and have **NOT** been created with self-hosting in mind. Since it's easy and simple to use them for self-hosting, | + | but since it's easy and simple to use containers |
| Containerization technology can roughly be divided into two big categories: | Containerization technology can roughly be divided into two big categories: | ||
| Line 9: | Line 9: | ||
| * Clusters for deployment (Kubernetes and the like) | * Clusters for deployment (Kubernetes and the like) | ||
| - | Over the course of time the use of Docker in the self-hosted world has increased so much that it's getting | + | Over the course of time the use of Docker in the self-hosted world has increased so much that today it's getting |
| + | |||
| + | Containers | ||
| * Ease of deployment (docker compose up, and there you go) | * Ease of deployment (docker compose up, and there you go) | ||
| * Ease of upgrade (docker pull, and there you go) | * Ease of upgrade (docker pull, and there you go) | ||
| Line 15: | Line 17: | ||
| * For developers, it's easier to provide a // | * For developers, it's easier to provide a // | ||
| - | I am realizing more and more the added value of using containers, so i have changed my mind over time. I still think there are negative points in relying on Docker for self-hosting: | + | At the beginning i was against using containers for deployment, but i am realizing more and more the added value of using containers, so i have changed my mind over time. |
| + | |||
| + | I still think there are negative points in relying on Docker for self-hosting: | ||
| * All services running as //root// (against Linux policies) | * All services running as //root// (against Linux policies) | ||
| * Lots of duplicated services (how many postgress databases have you running around?) | * Lots of duplicated services (how many postgress databases have you running around?) | ||
| Line 50: | Line 54: | ||
| [[https:// | [[https:// | ||
| - | * Doesn' | + | * Doesn' |
| - | * Doesn' | + | * Doesn' |
| * Integrates with OpenRC/ | * Integrates with OpenRC/ | ||
| * It's fully Open Source | * It's fully Open Source | ||
| Line 57: | Line 61: | ||
| * It's not monolithic but it's actually a set of tools | * It's not monolithic but it's actually a set of tools | ||
| * And it's also fully Docker-compatible (set alias docker=podman and you are dood to go, almost) | * And it's also fully Docker-compatible (set alias docker=podman and you are dood to go, almost) | ||
| + | * Doesn' | ||
| Overall **Podman** is much more adherent to the Linux/Unix way of doing things. | Overall **Podman** is much more adherent to the Linux/Unix way of doing things. | ||
| Line 79: | Line 84: | ||
| which i suggest to run as un-priviledged user to verify everything is working as non-root too. | which i suggest to run as un-priviledged user to verify everything is working as non-root too. | ||
| - | Now, install | + | Podman is fully compatible with **Docker Compose**, so you should just emerge it and start using compose: |
| + | <code bash> | ||
| + | emerge -vp docker-compose | ||
| + | </code> | ||
| + | |||
| + | Or you can choose to use **Podman Compose**, which is a compatible alternative, beware that it might be masked for your arch, in this case, just unmask it with your keyword, ex ~amd64: | ||
| <code bash> | <code bash> | ||
| emerge -vp podman-compose | emerge -vp podman-compose | ||
| </ | </ | ||
| - | beware that it might be masked for your arch, in this case, just unmask it with your keyword, ex ~amd64. | + | of course, you need to pick one or the other. I am using podman-compose at this time. |
| === Podman rootless users === | === Podman rootless users === | ||
| Line 245: | Line 256: | ||
| Well, just replace any **docker** command with **podman** and you are good to go. Including the usual: | Well, just replace any **docker** command with **podman** and you are good to go. Including the usual: | ||
| <code bash> | <code bash> | ||
| - | > | + | podman compose up |
| </ | </ | ||
| Line 263: | Line 274: | ||
| Start by creating a non-privileged user (let's call it //service// to match the service name), let it point to where you stored the docker-compose.yml for the service (which should be **/ | Start by creating a non-privileged user (let's call it //service// to match the service name), let it point to where you stored the docker-compose.yml for the service (which should be **/ | ||
| <code bash> | <code bash> | ||
| - | > | + | useradd -d / |
| - | > chown service: | + | chown service: |
| </ | </ | ||
| Line 271: | Line 282: | ||
| Now, most probably all you need to do is the classic (but rewritten): | Now, most probably all you need to do is the classic (but rewritten): | ||
| <code bash> | <code bash> | ||
| - | > | + | su - service |
| - | > podman compose -f docker-compose.yml up | + | podman compose -f docker-compose.yml up |
| </ | </ | ||
| Line 283: | Line 294: | ||
| If you need to export your images from Docker to Podman (you don't if they are public images), as root, export all docker images relevant to your service (you can see them in the composer file), use //docker image ls// to list images and //docker save -o ...// to save each one of them as a tar file: | If you need to export your images from Docker to Podman (you don't if they are public images), as root, export all docker images relevant to your service (you can see them in the composer file), use //docker image ls// to list images and //docker save -o ...// to save each one of them as a tar file: | ||
| <code bash> | <code bash> | ||
| - | > | + | mkdir / |
| - | > docker image ls | + | docker image ls |
| - | > docker image save -o / | + | docker image save -o / |
| - | > chown service: | + | chown service: |
| </ | </ | ||
| (repeat for each image for the service!) | (repeat for each image for the service!) | ||
| Line 292: | Line 303: | ||
| If your container uses also volumes, copy them to your //service// user, as root: | If your container uses also volumes, copy them to your //service// user, as root: | ||
| <code bash> | <code bash> | ||
| - | > | + | mkdir / |
| - | > cp -a / | + | cp -a / |
| - | > chown service: | + | chown service: |
| </ | </ | ||
| (repeat for each volume for the service!) | (repeat for each volume for the service!) | ||
| Line 300: | Line 311: | ||
| Now, as user //server//, import the images and create the volumes: | Now, as user //server//, import the images and create the volumes: | ||
| <code bash> | <code bash> | ||
| - | > | + | su - service |
| - | > podman load -i docker-export/ | + | podman load -i docker-export/ |
| </ | </ | ||
| Line 317: | Line 328: | ||
| <code bash> | <code bash> | ||
| - | > | + | cp -a / |
| </ | </ | ||
| Line 327: | Line 338: | ||
| - ping is restricted and cannot b performed from containers. If you need to enable it, type as root: | - ping is restricted and cannot b performed from containers. If you need to enable it, type as root: | ||
| <code bash> | <code bash> | ||
| - | > | + | sysctl -w " |
| </ | </ | ||
| This can be made permanent in **/ | This can be made permanent in **/ | ||
| Line 335: | Line 346: | ||
| - Running as simple user a container will not be allowed to bind to ports under 1024. Some ill-designed containers will insist on this. The only recurse (except don't use such broken images) is to allow ports for normal users with: | - Running as simple user a container will not be allowed to bind to ports under 1024. Some ill-designed containers will insist on this. The only recurse (except don't use such broken images) is to allow ports for normal users with: | ||
| <code bash> | <code bash> | ||
| - | > | + | sysctl -w " |
| </ | </ | ||
| This can be made permanent in **/ | This can be made permanent in **/ | ||