5 ms·

I'll answer this for you. You want rootless podman because docker is the defacto standard way of packaging non-legacy software now including autoupdates. I know

I'll answer this for you. You want rootless podman because docker is the defacto standard way of packaging non-legacy software now including autoupdates. I know, sad... Podman still does not offer convenient and mature way for systemd to run it with an unprivileged user. It is the only gripe I've had with this approach...

ggpsv 1y ago
This is no longer true as of Podman 5 and Quadlet? You can define rootless containers to run under systemd services as unprivileged users. You can use machinectl to login as said user and interact with systemctl.
- jcgl 1y ago
  Quadlet debuted with Podman 4.4 iirc.
  - ggpsv 1y ago
    Oh yes, correct!
- phoronixrly 1y ago
  Can you please link the docs for this?
  - ggpsv 1y ago
    This is a good intro [0], courtesy of Redhat. This is a good example [1], cited elsewhere in this post. Documentation for quadlet systemd units [2]. [0]: https://www.redhat.com/en/blog/quadlet-podman https://www.redhat.com/en/blog/quadlet-podman [1]: https://mo8it.com/blog/quadlet/ https://mo8it.com/blog/quadlet/ [2]: https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html https://docs.podman.io/en/latest/markdown/podman-systemd.uni...
    - phoronixrly 1y ago
      You see, my issue with this is that it suggests using the quadlets with lingering users... Which is the same annoying case as with the article. It is not as with other systemd services that you just instruct systemd to take a temporary uid/gid and run the service with it.
chaz6 1y ago
I really like rootless podman, but there is one quirk in that if you want to preserve the original source IP address (e.g. for web server logs), you have to use a workaround which has a performance penalty. https://github.com/containers/podman/issues/10884 https://github.com/containers/podman/issues/10884 https://github.com/containers/podman/pull/9052 https://github.com/containers/podman/pull/9052 https://github.com/containers/podman/pull/11177 https://github.com/containers/podman/pull/11177
- phoronixrly 1y ago
  Correct me if I'm wrong but doesn't pasta solve this?
- eriksjolund 1y ago
  That workaround is not needed if the web server container supports socket activation. Due to the fork-exec architecture of Podman, the socket-activated socket is inherited by the container process. Network traffic sent over this socket-activated socket has native performance. https://github.com/containers/podman/blob/main/docs/tutorials/socket_activation.md#native-network-performance-over-the-socket-activated-socket https://github.com/containers/podman/blob/main/docs/tutorial...

ggpsv 1y ago

This is no longer true as of Podman 5 and Quadlet? You can define rootless containers to run under systemd services as unprivileged users. You can use machinectl to login as said user and interact with systemctl.

jcgl 1y ago
Quadlet debuted with Podman 4.4 iirc.
- ggpsv 1y ago
  Oh yes, correct!
phoronixrly 1y ago
Can you please link the docs for this?
- ggpsv 1y ago
  This is a good intro [0], courtesy of Redhat. This is a good example [1], cited elsewhere in this post. Documentation for quadlet systemd units [2]. [0]: https://www.redhat.com/en/blog/quadlet-podman https://www.redhat.com/en/blog/quadlet-podman [1]: https://mo8it.com/blog/quadlet/ https://mo8it.com/blog/quadlet/ [2]: https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html https://docs.podman.io/en/latest/markdown/podman-systemd.uni...
  - phoronixrly 1y ago
    You see, my issue with this is that it suggests using the quadlets with lingering users... Which is the same annoying case as with the article. It is not as with other systemd services that you just instruct systemd to take a temporary uid/gid and run the service with it.

chaz6 1y ago

I really like rootless podman, but there is one quirk in that if you want to preserve the original source IP address (e.g. for web server logs), you have to use a workaround which has a performance penalty. https://github.com/containers/podman/issues/10884 https://github.com/containers/podman/issues/10884 https://github.com/containers/podman/pull/9052 https://github.com/containers/podman/pull/9052 https://github.com/containers/podman/pull/11177 https://github.com/containers/podman/pull/11177

phoronixrly 1y ago
Correct me if I'm wrong but doesn't pasta solve this?
eriksjolund 1y ago
That workaround is not needed if the web server container supports socket activation. Due to the fork-exec architecture of Podman, the socket-activated socket is inherited by the container process. Network traffic sent over this socket-activated socket has native performance. https://github.com/containers/podman/blob/main/docs/tutorials/socket_activation.md#native-network-performance-over-the-socket-activated-socket https://github.com/containers/podman/blob/main/docs/tutorial...