8 ms·

Podman v4.6 Introduces Podmansh: A Revolutionary Login Shell

174 points by shallow-mind 3y ago

WirelessGigabit 3y ago
I do think it's sad that Podman doesn't offer official Ubuntu packages. I'm stuck at v3 from Ubuntu itself. It feels hacky: > CAUTION: The Kubic repo is NOT recommended for production use.
- jackweirdy 3y ago
  In the meantime I maintain an unofficial apt source that autogenerates packages via GitHub actions - https://github.com/notbobthebuilder/podman https://github.com/notbobthebuilder/podman
- aragilar 3y ago
  Podman is in universe, so it's not really supported by Ubuntu. It's always worth checking what you use that's in universe, as if you're mostly using universe, I'd start looking at a different distro.
- candiddevmike 3y ago
  It's part of Debian main...
wejick 3y ago
Several times I tried to use podman on mac to replace docker tooling, the idea of daemonless-rootless is enticing. However, there's always things that doesn't work or work differently on podman that make it not easy to work in team that predominantly using docker. Usually it's about networking setup or compose compatibility. Maybe someone encountered similar situation can share your experience.
- rgovostes 3y ago
  I had the same experience for a while, and was a little bitter about repeatedly taking them at their word that you could transparently `alias docker=podman`, even when Podman 4.0 didn't even support volume mounts from the host without jumping through hoops. I suggested that the team document or at least label compatibility issues so users are informed about them, but they rejected the idea[0], recommending instead that users keep abreast of changes to a 35 page troubleshooting file. That said, I've been living on it full time for a few months, and it's working well. I'm using the Docker CLI with Podman providing the backend implementation. Biggest caveats: Mounting volumes from the host is still a little limited. It doesn't play nice with giving docker.sock back to Docker Engine (wontfix[1]). The --platform flag was broken but should be fixed in 4.6. 0: https://github.com/containers/podman/discussions/14430 https://github.com/containers/podman/discussions/14430 1: https://github.com/containers/podman/issues/18784 https://github.com/containers/podman/issues/18784
  - laserlight 3y ago
    I was also a victim of “just alias docker to podman” advertising. I couldn't run even a single container with podman on my Mac. I'm happy to have given up early with their BS.
    - asdafa 3y ago
      `BS` is a bit unfair. It is true that podman-desktop is a bit rough around the edges still, but it is in no worse shape than docker-desktop used to be when it was a year and a half old project. With the release of podman 4.6.0 a lot of the issues have been sorted out, podman-desktop is still shipping engine 4.5.1 at the moment, but a new release should be coming out soon. I'd suggest you give it another shot.
      - kobalsky 3y ago
        it’s bs because they have elected to not maintain cli compatibility on many areas. not because they “haven’t gotten there yet” but because they don’t agree with docker. they converted into technological amish that think the one true cli is not the current one.
- viraptor 3y ago
  > podman on mac to replace docker tooling, the idea of daemonless-rootless is enticing I'm confused by this one. You're already running a VM in order to use containers on a Mac. What does the daemonless approach inside a container give you? That feature works great on Linux servers for me, but I'm not sure what's the point outside of that.
  - rr808 3y ago
    I work in a big corp where people aren't allowed root access under any circumstances. Podman works for us because infosec guys are happy.
    - viraptor 3y ago
      For the Mac context, you're running a VM as root before you even touch podman/docker. I'm confused how that's different.
      - LeBit 3y ago
        Are you sure the podman machine's VM is running as root?
        viraptor 3y ago
        Kinda, a bit, it's hard. So podman will need virtualisation and networking permissions to do its job. Also the directory mapping seems to work without extra confirmation. At that point, who needs root? You control the main user`s files, networking, and can effectively hide any process from easy inspection by using virtualisation.
      - rr808 3y ago
        I'm talking servers. We aren't allowed to run either on workstations.
        deleted 3y ago
        [deleted]
- usr1106 3y ago
  podman is supposed to be more secure than docker. How do they reach improved security? By limiting access to the system that could be dangerous if misused. Obviously with additional limitations comes incompatibility. If your image tries to do something that is no longer allowed the same way, it won't work the same way as before. Compatibility exists only for images that don't do anything potentially dangerous. Ironically enough for those you would not need podman. But it's of course still a good idea to use it. Few people know in every detail what their images are trying to do.
  - hyperpape 3y ago
    I’m not averse to things that introduce complications for security, but it’s very poorly advertised. The overall impression a new user gets is that podman should just work as a Docker replacement, and this is frequently untrue. My own experience is that I started using podman when docker on Fedora wouldn’t work with cgroups v2. Iirc, I could (and should) have made configuration changes to make Docker work, but I wasted a lot of time tracking down issues because I thought podman would have better compatibility than it had. Upthread there’s a good suggestion that the authors should create an explicit compatibility document.
- TheDong 3y ago
  > podman on mac [..] the idea of daemonless-rootless is enticing Did you realize that there's a daemon on podman for mac (https://docs.podman.io/en/latest/markdown/podman-system-service.1.html https://docs.podman.io/en/latest/markdown/podman-system-serv...)? Are you aware it runs rootful podman, not rootless podman? And why do you care about those things if it's self-contained in a linux VM anyway, where there's already plenty of daemons, and plenty of root?
  - jdenyc 3y ago
    also check out podman desktop (podman-desktop.io) .. easy for desktop development and integration if you're on a mac or windows
  - LeBit 3y ago
    The doc you linked to specifically says there is no daemon on Windows and Mac. I am confused.
    - TheDong 3y ago
      The podman CLI tool compiled for mac doesn't allow you to run the daemon on macOS natively. The way podman desktop works includes running a podman daemon by default inside the podman linux VM. That's the daemon I'm talking about. The docker cli also runs on mac, but the docker daemon doesn't run on macOS directly, but instead as a daemon inside the linux VM. Hence, in podman desktop on macOS, just like docker desktop on macOS, you have a similar daemon running inside the linux VM that's launched. Do you understand now?
- Takennickname 3y ago
  Podman sucks for non-enterprise environments.
  - worthless-trash 3y ago
    TIL: I run enterprise environments.
  - xedrac 3y ago
    Huh? You're going to have to clarify that one. If anything, not needing a root daemon makes it much more appealing to just about every environment.
    - Takennickname 3y ago
      True. But the community around docker makes it better for local use. If you really need something more, a minimal kubernetes distro is a much better option for little additional work (if any).
  - op00to 3y ago
    I use podman orchestrated by systemd to run my home automation stuff. It took 30 seconds to set up and Just Works.
  - Takennickname 3y ago
    People are mad. I should have clarified: Podman sucks in non-Enterprise environments. Either use docker or some minimal kubernetes distro. Everything else is a waste of time.
- windexh8er 3y ago
  The old problem with Podman was always was that it was never exponentially better. And I don't believe, at this point, that Podman will ever replace the Docker ecosystem. And now the problem is that I view RedHat/IBM as hostile to open source, so there's no way I'm going to use or recommend it - just the same way I stopped considering using Windows platforms post Windows 2008 timeframe.
  - jdenyc 3y ago
    not sure I understand the hostility to Red Hat, or how they might be hostile to OSS .. didn't they create podman on OSS, continue to develop and support it and give it away?
  - lamontcg 3y ago
    Yeah podman is now crippled by the association with RedHat/IBM.
  - lttlrck 3y ago
    This is a good reminder. I had all but forgotten RedHat/IBM.
- kobalsky 3y ago
  just a reminder that docker has a rootless mode that works perfectly. it does require a daemon, but it runs as the user not as root.
DangitBobby 3y ago
Can any grey beard types explain to me why someone would throw users into containers instead of their own user accounts with permissions? Why is the desired level of isolation not possible or too difficult without them?
- usrnm 3y ago
  You can't limit resources like CPU and memory for users.
  - inferiorhuman 3y ago
    https://man.freebsd.org/cgi/man.cgi?query=login.conf&apropos=0&sektion=5&manpath=FreeBSD+13.2-RELEASE&arch=default&format=html https://man.freebsd.org/cgi/man.cgi?query=login.conf&apropos... https://man.freebsd.org/cgi/man.cgi?query=rctl&apropos=0&sektion=0&manpath=FreeBSD+13.2-RELEASE&arch=default&format=html https://man.freebsd.org/cgi/man.cgi?query=rctl&apropos=0&sek... https://www.tecmint.com/set-limits-on-user-processes-using-ulimit-in-linux/ https://www.tecmint.com/set-limits-on-user-processes-using-u...
  - dijit 3y ago
    As much as I complain about systemd being overly complex and the lock-in that follows: sudo systemctl edit --force user-1234.slice [Slice] MemoryMax=1G CPUQuota=10% It's also something that's been available on the other UNIX-likes (FreeBSD/Solaris) since essentially forever.
    - usrnm 3y ago
      And systemd does the exact same thing under the hood as running in a container would.
  - _joel 3y ago
    cgroups?
- asah 3y ago
  The regular shell is a huge attack surface, including user-to-user attacks and overly permissive network access. Frankly, ssh-to-container is a "slaps forehead" obvious solution and I'm surprised none of us thought of it before - I'd love to see it as a standard option in the OS, e.g. chsh allows you to specify a container and optional port and volume mappings. In the old days, we'd (try to) use chroot, but that has all sorts of big problems with needing access to various directories, and those batches begat patches...
ximm 3y ago
I wouldn't call that revolutionary. As far as I understand, this is a simple alias to something like `podman exec -it somecontainer bash`. We were able to do this for a long time. I mean, it is nice that they provide a simple alias for that. But the marketing talk is a bit much for my taste.
- choppaface 3y ago
  The feature is more similar to e.g. dockersh than just exec https://github.com/Yelp/dockersh https://github.com/Yelp/dockersh Or e.g. change ssh config to use ForceCommand. That said, the main benefit is not just that a shell gets a container but that you can easily compose this feature with the container / image ecosystem to deploy specialized shells. Perhaps even you don’t need a VM to service the request but rather a container orchestrator ..
- nvarsj 3y ago
  I don’t think that’s what podmansh does. Instead it’s a system replacement shell. Nothing to do with your running containers. Instead it seems to let you sandbox users on your VM/baremetal to a container.
kristaps 3y ago
Probably an 80s sysadmins dream, but are multi-user Unix machines really that much of a thing currently?
- deleted 3y ago
  [deleted]
- gnufx 3y ago
  Yes in the research computing world (HPC and similar systems, and some other sorts of shared resource) at least. On Linux-based machines you can limit resources otherwise, via PAM, or startup of interactive sessions in a distributed resource manager ("batch system").
- Arkanosis 3y ago
  I've been using UNIX-like machines (mostly Linux) since the mid-2000s and single-user machines have always been the exception rather than the norm everywhere I've been. Even at home, I've set up multiple accounts for myself (main one, one for closed-source programs, one for gaming I can share with other people…) and for my family (to each their preferences, wallpaper and so on). Having two or three user sessions running at the same time is not uncommon. I'm probably the exception here, but I don't think Podman targets the regular home user anyway. It's not obvious to me how Podmansh would revolutionize that, but I guess it's nice, I'll try it for sure.
pxc 3y ago
See also GNU Rush: > GNU Rush is a Restricted User Shell, designed for sites providing limited remote access to their resources, such as, for example, savannah.gnu.org. Its main program, rush, is configured as a user login shell for users that are allowed only remote access to the machine. Using a flexible configuration file, GNU Rush gives administrator complete control over the command lines that users execute, and allows to tune the usage of system resources, such as virtual memory, CPU time, etc. on a per-user basis. > In particular, GNU Rush allows to run remote programs in a chrooted environment, which helps tighten security when offering access over such programs as sftp-server or scp, that access the entire file system by default. https://www.gnu.org.ua/software/rush https://www.gnu.org.ua/software/rush
- fjfuvucucuc 3y ago
  [dead]
codethief 3y ago
When I read the title, I expected that I'd finally be able to use Podman containers for my development environments & shells (i.e. inside my existing user account), for reproducibility purposes and to protect against the most trivial of supply chain attacks etc. Unfortunately, this is not entirely trivial (think IDE integration; also, one likely wants to use both personal shell commands and project-specific commands on the same command line). So I was hoping the Podman devs had found a good solution here. Not really sure what one would use a login shell for, though. I mean, if I, as the user, am merely logging into a containerized shell, why don't I execute the container locally? Why use SSH? Sure, the volumes mounted into the login shell container might contain data I need, but one could also simply mount them as network storage locally.
- 5e92cb50239222b 3y ago
  Have you looked at toolbox? it might already be doing what you want — it's a thin wrapper around podman that integrates containers with the rest of the system — you don't really even feel that you're running a container. https://github.com/containers/toolbox https://github.com/containers/toolbox
- maffydub 3y ago
  Have you tried floki (https://github.com/Metaswitch/floki https://github.com/Metaswitch/floki) - this is what we use to solve this problem.
- Chris660 3y ago
  In addition to the other suggestions, you might want to check-out distrobox: https://github.com/89luca89/distrobox https://github.com/89luca89/distrobox It provides support for starting host commands within a container, and also exporting commands from containers to the host.
  - yencabulator 3y ago
    Last I looked, distrobox made $HOME fully accessible to all its containers. That's the very opposite of parent comment's "protect against the most trivial of supply chain attacks".
deleted 3y ago
[deleted]
lnxg33k1 3y ago
I feel that at times projects should start focusing on improvements on stability and ability to maintain code, instead of adding complexity to complexity over an already complex set of resources, the devops industry is out of ideas and keeps creating issues and then trying to sell products in order to manage that complexity, In my projects I manage CI/CD with very small overhead, why I am writing this complaining message of hate of devops industry is because when you go to work for companies of people who just adopt anything thrown at them then everything seem so senseless If you are out of ideas to improve products, pause, think and improve code and other stuff, it’s not written in store that there should be new functionalities every day
- its-summertime 3y ago
  Its just a wrapper that, when its args[0], will expand to: podman exec -i --wait 10 [-t] {registry.PodmanSh} /bin/sh Which has been something people have been doing for years now. It isn't any notable added complexity that isn't usable in other contexts (they added a timeout feature for handling errors better), and it isn't new functionality.
  - lnxg33k1 3y ago
    Are you saying that the whole revolution is just a shorter command?
    - its-summertime 3y ago
      Yes. https://github.com/containers/podman/blob/3e8f19be9d845480391523b1492cbe6cd0479b23/cmd/podman/main.go#L42 https://github.com/containers/podman/blob/3e8f19be9d84548039... https://github.com/containers/podman/blob/3e8f19be9d845480391523b1492cbe6cd0479b23/Makefile#L422 https://github.com/containers/podman/blob/3e8f19be9d84548039...
op00to 3y ago
I wonder who this feature is for…
- rhatdan 3y ago
  Administrators who want to share access to a system and part of its data but control what users are able to see on the system. Think sharing special devices. Think sharing certain directory content that containers secret data, for the users eyes only.
rhatdan 3y ago
I see some misunderstanding of the goal of Podmansh. The basic idea is certain users have secure systems where they want to allow limited access to the host system. For example you might have some secret data on a system, where a user can only see certain data depending on who they are, you also want to prevent said user from seeing other users or processes are running on the system. Podmansh makes setting up these types of shared systems easier. People are correct in thinking podmansh is just a single command that `podman exec -ti podmansh` container, and they would be correct. But the interesting thing is through the user of quadlet and systemd, administrators can easily configure the podmansh container for all users or for specific users. The ease of customization and systemd managing the life cycle of the container based on users sessions is a really nice feature. Many users will never use this, but certain users like Governement, Banking or other entities who are very concerned about security, this is a really nice feature.

174 points by shallow-mind 3y ago

I do think it's sad that Podman doesn't offer official Ubuntu packages. I'm stuck at v3 from Ubuntu itself. It feels hacky: > CAUTION: The Kubic repo is NOT recommended for production use.

jackweirdy 3y ago
In the meantime I maintain an unofficial apt source that autogenerates packages via GitHub actions - https://github.com/notbobthebuilder/podman https://github.com/notbobthebuilder/podman
aragilar 3y ago
Podman is in universe, so it's not really supported by Ubuntu. It's always worth checking what you use that's in universe, as if you're mostly using universe, I'd start looking at a different distro.
candiddevmike 3y ago
It's part of Debian main...

wejick 3y ago

Several times I tried to use podman on mac to replace docker tooling, the idea of daemonless-rootless is enticing. However, there's always things that doesn't work or work differently on podman that make it not easy to work in team that predominantly using docker. Usually it's about networking setup or compose compatibility. Maybe someone encountered similar situation can share your experience.

rgovostes 3y ago
I had the same experience for a while, and was a little bitter about repeatedly taking them at their word that you could transparently `alias docker=podman`, even when Podman 4.0 didn't even support volume mounts from the host without jumping through hoops. I suggested that the team document or at least label compatibility issues so users are informed about them, but they rejected the idea[0], recommending instead that users keep abreast of changes to a 35 page troubleshooting file. That said, I've been living on it full time for a few months, and it's working well. I'm using the Docker CLI with Podman providing the backend implementation. Biggest caveats: Mounting volumes from the host is still a little limited. It doesn't play nice with giving docker.sock back to Docker Engine (wontfix[1]). The --platform flag was broken but should be fixed in 4.6. 0: https://github.com/containers/podman/discussions/14430 https://github.com/containers/podman/discussions/14430 1: https://github.com/containers/podman/issues/18784 https://github.com/containers/podman/issues/18784
- laserlight 3y ago
  I was also a victim of “just alias docker to podman” advertising. I couldn't run even a single container with podman on my Mac. I'm happy to have given up early with their BS.
  - asdafa 3y ago
    `BS` is a bit unfair. It is true that podman-desktop is a bit rough around the edges still, but it is in no worse shape than docker-desktop used to be when it was a year and a half old project. With the release of podman 4.6.0 a lot of the issues have been sorted out, podman-desktop is still shipping engine 4.5.1 at the moment, but a new release should be coming out soon. I'd suggest you give it another shot.
    - kobalsky 3y ago
      it’s bs because they have elected to not maintain cli compatibility on many areas. not because they “haven’t gotten there yet” but because they don’t agree with docker. they converted into technological amish that think the one true cli is not the current one.
viraptor 3y ago
> podman on mac to replace docker tooling, the idea of daemonless-rootless is enticing I'm confused by this one. You're already running a VM in order to use containers on a Mac. What does the daemonless approach inside a container give you? That feature works great on Linux servers for me, but I'm not sure what's the point outside of that.
- rr808 3y ago
  I work in a big corp where people aren't allowed root access under any circumstances. Podman works for us because infosec guys are happy.
  - viraptor 3y ago
    For the Mac context, you're running a VM as root before you even touch podman/docker. I'm confused how that's different.
    - LeBit 3y ago
      Are you sure the podman machine's VM is running as root?
      - viraptor 3y ago
        Kinda, a bit, it's hard. So podman will need virtualisation and networking permissions to do its job. Also the directory mapping seems to work without extra confirmation. At that point, who needs root? You control the main user`s files, networking, and can effectively hide any process from easy inspection by using virtualisation.
    - rr808 3y ago
      I'm talking servers. We aren't allowed to run either on workstations.
      - deleted 3y ago
        [deleted]
usr1106 3y ago
podman is supposed to be more secure than docker. How do they reach improved security? By limiting access to the system that could be dangerous if misused. Obviously with additional limitations comes incompatibility. If your image tries to do something that is no longer allowed the same way, it won't work the same way as before. Compatibility exists only for images that don't do anything potentially dangerous. Ironically enough for those you would not need podman. But it's of course still a good idea to use it. Few people know in every detail what their images are trying to do.
- hyperpape 3y ago
  I’m not averse to things that introduce complications for security, but it’s very poorly advertised. The overall impression a new user gets is that podman should just work as a Docker replacement, and this is frequently untrue. My own experience is that I started using podman when docker on Fedora wouldn’t work with cgroups v2. Iirc, I could (and should) have made configuration changes to make Docker work, but I wasted a lot of time tracking down issues because I thought podman would have better compatibility than it had. Upthread there’s a good suggestion that the authors should create an explicit compatibility document.
TheDong 3y ago
> podman on mac [..] the idea of daemonless-rootless is enticing Did you realize that there's a daemon on podman for mac (https://docs.podman.io/en/latest/markdown/podman-system-service.1.html https://docs.podman.io/en/latest/markdown/podman-system-serv...)? Are you aware it runs rootful podman, not rootless podman? And why do you care about those things if it's self-contained in a linux VM anyway, where there's already plenty of daemons, and plenty of root?
- jdenyc 3y ago
  also check out podman desktop (podman-desktop.io) .. easy for desktop development and integration if you're on a mac or windows
- LeBit 3y ago
  The doc you linked to specifically says there is no daemon on Windows and Mac. I am confused.
  - TheDong 3y ago
    The podman CLI tool compiled for mac doesn't allow you to run the daemon on macOS natively. The way podman desktop works includes running a podman daemon by default inside the podman linux VM. That's the daemon I'm talking about. The docker cli also runs on mac, but the docker daemon doesn't run on macOS directly, but instead as a daemon inside the linux VM. Hence, in podman desktop on macOS, just like docker desktop on macOS, you have a similar daemon running inside the linux VM that's launched. Do you understand now?
Takennickname 3y ago
Podman sucks for non-enterprise environments.
- worthless-trash 3y ago
  TIL: I run enterprise environments.
- xedrac 3y ago
  Huh? You're going to have to clarify that one. If anything, not needing a root daemon makes it much more appealing to just about every environment.
  - Takennickname 3y ago
    True. But the community around docker makes it better for local use. If you really need something more, a minimal kubernetes distro is a much better option for little additional work (if any).
- op00to 3y ago
  I use podman orchestrated by systemd to run my home automation stuff. It took 30 seconds to set up and Just Works.
- Takennickname 3y ago
  People are mad. I should have clarified: Podman sucks in non-Enterprise environments. Either use docker or some minimal kubernetes distro. Everything else is a waste of time.
windexh8er 3y ago
The old problem with Podman was always was that it was never exponentially better. And I don't believe, at this point, that Podman will ever replace the Docker ecosystem. And now the problem is that I view RedHat/IBM as hostile to open source, so there's no way I'm going to use or recommend it - just the same way I stopped considering using Windows platforms post Windows 2008 timeframe.
- jdenyc 3y ago
  not sure I understand the hostility to Red Hat, or how they might be hostile to OSS .. didn't they create podman on OSS, continue to develop and support it and give it away?
- lamontcg 3y ago
  Yeah podman is now crippled by the association with RedHat/IBM.
- lttlrck 3y ago
  This is a good reminder. I had all but forgotten RedHat/IBM.
kobalsky 3y ago
just a reminder that docker has a rootless mode that works perfectly. it does require a daemon, but it runs as the user not as root.

DangitBobby 3y ago

Can any grey beard types explain to me why someone would throw users into containers instead of their own user accounts with permissions? Why is the desired level of isolation not possible or too difficult without them?

usrnm 3y ago
You can't limit resources like CPU and memory for users.
- inferiorhuman 3y ago
  https://man.freebsd.org/cgi/man.cgi?query=login.conf&apropos=0&sektion=5&manpath=FreeBSD+13.2-RELEASE&arch=default&format=html https://man.freebsd.org/cgi/man.cgi?query=login.conf&apropos... https://man.freebsd.org/cgi/man.cgi?query=rctl&apropos=0&sektion=0&manpath=FreeBSD+13.2-RELEASE&arch=default&format=html https://man.freebsd.org/cgi/man.cgi?query=rctl&apropos=0&sek... https://www.tecmint.com/set-limits-on-user-processes-using-ulimit-in-linux/ https://www.tecmint.com/set-limits-on-user-processes-using-u...
- dijit 3y ago
  As much as I complain about systemd being overly complex and the lock-in that follows: sudo systemctl edit --force user-1234.slice [Slice] MemoryMax=1G CPUQuota=10% It's also something that's been available on the other UNIX-likes (FreeBSD/Solaris) since essentially forever.
  - usrnm 3y ago
    And systemd does the exact same thing under the hood as running in a container would.
- _joel 3y ago
  cgroups?
asah 3y ago
The regular shell is a huge attack surface, including user-to-user attacks and overly permissive network access. Frankly, ssh-to-container is a "slaps forehead" obvious solution and I'm surprised none of us thought of it before - I'd love to see it as a standard option in the OS, e.g. chsh allows you to specify a container and optional port and volume mappings. In the old days, we'd (try to) use chroot, but that has all sorts of big problems with needing access to various directories, and those batches begat patches...

ximm 3y ago

I wouldn't call that revolutionary. As far as I understand, this is a simple alias to something like `podman exec -it somecontainer bash`. We were able to do this for a long time. I mean, it is nice that they provide a simple alias for that. But the marketing talk is a bit much for my taste.

choppaface 3y ago
The feature is more similar to e.g. dockersh than just exec https://github.com/Yelp/dockersh https://github.com/Yelp/dockersh Or e.g. change ssh config to use ForceCommand. That said, the main benefit is not just that a shell gets a container but that you can easily compose this feature with the container / image ecosystem to deploy specialized shells. Perhaps even you don’t need a VM to service the request but rather a container orchestrator ..
nvarsj 3y ago
I don’t think that’s what podmansh does. Instead it’s a system replacement shell. Nothing to do with your running containers. Instead it seems to let you sandbox users on your VM/baremetal to a container.

kristaps 3y ago

Probably an 80s sysadmins dream, but are multi-user Unix machines really that much of a thing currently?

deleted 3y ago
[deleted]
gnufx 3y ago
Yes in the research computing world (HPC and similar systems, and some other sorts of shared resource) at least. On Linux-based machines you can limit resources otherwise, via PAM, or startup of interactive sessions in a distributed resource manager ("batch system").
Arkanosis 3y ago
I've been using UNIX-like machines (mostly Linux) since the mid-2000s and single-user machines have always been the exception rather than the norm everywhere I've been. Even at home, I've set up multiple accounts for myself (main one, one for closed-source programs, one for gaming I can share with other people…) and for my family (to each their preferences, wallpaper and so on). Having two or three user sessions running at the same time is not uncommon. I'm probably the exception here, but I don't think Podman targets the regular home user anyway. It's not obvious to me how Podmansh would revolutionize that, but I guess it's nice, I'll try it for sure.

pxc 3y ago

See also GNU Rush: > GNU Rush is a Restricted User Shell, designed for sites providing limited remote access to their resources, such as, for example, savannah.gnu.org. Its main program, rush, is configured as a user login shell for users that are allowed only remote access to the machine. Using a flexible configuration file, GNU Rush gives administrator complete control over the command lines that users execute, and allows to tune the usage of system resources, such as virtual memory, CPU time, etc. on a per-user basis. > In particular, GNU Rush allows to run remote programs in a chrooted environment, which helps tighten security when offering access over such programs as sftp-server or scp, that access the entire file system by default. https://www.gnu.org.ua/software/rush https://www.gnu.org.ua/software/rush

fjfuvucucuc 3y ago
[dead]

codethief 3y ago

When I read the title, I expected that I'd finally be able to use Podman containers for my development environments & shells (i.e. inside my existing user account), for reproducibility purposes and to protect against the most trivial of supply chain attacks etc. Unfortunately, this is not entirely trivial (think IDE integration; also, one likely wants to use both personal shell commands and project-specific commands on the same command line). So I was hoping the Podman devs had found a good solution here. Not really sure what one would use a login shell for, though. I mean, if I, as the user, am merely logging into a containerized shell, why don't I execute the container locally? Why use SSH? Sure, the volumes mounted into the login shell container might contain data I need, but one could also simply mount them as network storage locally.

5e92cb50239222b 3y ago
Have you looked at toolbox? it might already be doing what you want — it's a thin wrapper around podman that integrates containers with the rest of the system — you don't really even feel that you're running a container. https://github.com/containers/toolbox https://github.com/containers/toolbox
maffydub 3y ago
Have you tried floki (https://github.com/Metaswitch/floki https://github.com/Metaswitch/floki) - this is what we use to solve this problem.
Chris660 3y ago
In addition to the other suggestions, you might want to check-out distrobox: https://github.com/89luca89/distrobox https://github.com/89luca89/distrobox It provides support for starting host commands within a container, and also exporting commands from containers to the host.
- yencabulator 3y ago
  Last I looked, distrobox made $HOME fully accessible to all its containers. That's the very opposite of parent comment's "protect against the most trivial of supply chain attacks".

deleted 3y ago

[deleted]

lnxg33k1 3y ago

I feel that at times projects should start focusing on improvements on stability and ability to maintain code, instead of adding complexity to complexity over an already complex set of resources, the devops industry is out of ideas and keeps creating issues and then trying to sell products in order to manage that complexity, In my projects I manage CI/CD with very small overhead, why I am writing this complaining message of hate of devops industry is because when you go to work for companies of people who just adopt anything thrown at them then everything seem so senseless If you are out of ideas to improve products, pause, think and improve code and other stuff, it’s not written in store that there should be new functionalities every day

its-summertime 3y ago
Its just a wrapper that, when its args[0], will expand to: podman exec -i --wait 10 [-t] {registry.PodmanSh} /bin/sh Which has been something people have been doing for years now. It isn't any notable added complexity that isn't usable in other contexts (they added a timeout feature for handling errors better), and it isn't new functionality.
- lnxg33k1 3y ago
  Are you saying that the whole revolution is just a shorter command?
  - its-summertime 3y ago
    Yes. https://github.com/containers/podman/blob/3e8f19be9d845480391523b1492cbe6cd0479b23/cmd/podman/main.go#L42 https://github.com/containers/podman/blob/3e8f19be9d84548039... https://github.com/containers/podman/blob/3e8f19be9d845480391523b1492cbe6cd0479b23/Makefile#L422 https://github.com/containers/podman/blob/3e8f19be9d84548039...

op00to 3y ago

I wonder who this feature is for…

rhatdan 3y ago
Administrators who want to share access to a system and part of its data but control what users are able to see on the system. Think sharing special devices. Think sharing certain directory content that containers secret data, for the users eyes only.

rhatdan 3y ago

I see some misunderstanding of the goal of Podmansh. The basic idea is certain users have secure systems where they want to allow limited access to the host system. For example you might have some secret data on a system, where a user can only see certain data depending on who they are, you also want to prevent said user from seeing other users or processes are running on the system. Podmansh makes setting up these types of shared systems easier. People are correct in thinking podmansh is just a single command that `podman exec -ti podmansh` container, and they would be correct. But the interesting thing is through the user of quadlet and systemd, administrators can easily configure the podmansh container for all users or for specific users. The ease of customization and systemd managing the life cycle of the container based on users sessions is a really nice feature. Many users will never use this, but certain users like Governement, Banking or other entities who are very concerned about security, this is a really nice feature.