HackMD - Collaborative Markdown Knowledge Base

Podman v.s. Docker  ## Docker vs. Posman ![](https://i.imgur.com/d0Rbniw.png) ## How rootless Work limitation: https://linuxhandbook.com/rootless-podman/ * Uses a user namespace to map between **the user IDs in the container** and **the user IDs on your host**. ``` sunny-liao@sg-redis-08:~$ cat /etc/subuid sunny-liao:100000:65537 ``` ``` sunny-liao@sg-redis-08:~$ cat /proc/857762/uid_map 0 10428 1 1 100000 65537 # 857762 是 container running 的 pid ``` Case A: container 內 bidderx (UID=1000) 這個 user 啟動 http.server Case B: container 內 root 啟動 http.server 在 host 會看到: Case A: http.server run by uid=100999 Case B: http.server run by uid=10428 因為 /etc/subuid 中有: sunny-liao:100000:65537，所以 Case A and Case B 兩個 http.server 的權限都一樣 Key Note: uid/gid_map and subuid/gid ## Registries /etc/containers/registries.conf: unqualified-search-registries 可以設定要從哪裡抓 image，但官方建議是在 pull 的時候就直接加上 registry server (e.g. docker.io/ubuntu) Note: 所以如果要改用 podman, 建議把 docker file 都改成 From docker.io/.... ## File system * overlay * fuse-overlayfs ## pod install: catatonit 一個 pod 中可以有多個 containers, 在同一個 pod 中的 container 彼此之間會共享相同的網路 ``` podman pod create podman run--pod ${pod_name} ``` stop pod 會將 pod 中全部的 container 一起 stop, 相對的 start 也會一起 start ## network rootful container: containernetworking-plugins rootless container: slirp4netns * when you use rootless container, install slirp4netns is need when you want to bind the port. sunny-liao@sg-redis-08:~/bidderx/docker/v1$ podman run --rm -it -p 1500:8000 bfabf17f71e4 Error: could not find slirp4netns, the network namespace can't be configured: exec: "slirp4netns": executable file not found in $PATH host ---curl---> **rootless** container forwarding port ``` Summary: Total: 3.4912 secs Slowest: 3.4532 secs Fastest: 0.0015 secs Average: 0.0942 secs Requests/sec: 286.4318 Total data: 942000 bytes Size/request: 942 bytes ``` host ---curl---> **rootful** container forwarding port ``` Summary: Total: 4.4144 secs Slowest: 4.3570 secs Fastest: 0.0011 secs Average: 0.0818 secs Requests/sec: 226.5292 Total data: 942000 bytes Size/request: 942 bytes ``` rootless container 關於網路的限制: * 不能 bind 1024 以下的 port 給 containers: * unable to ping any host: * 官方文件有提到workaround: https://github.com/containers/podman/blob/main/troubleshooting.md?ref=linux-handbook#solution-3 ，但我照著做沒有解決此問題 (做的過程中會遇到 permission error)