Podman
Info
Podman Installation | Rocky Linux 10 Podman | Use of Podman in a Rootless environment | machinectl manual | podman-docker | unpriviliged user vs --userns=auto
Usageඞ
From sudo user jump to the shell of rootless podman user: sudo machinectl shell inside@ /bin/bash
Inside rootless shell change to compose dir: cd compose/
Set stack var: export COMPOSE_NAME=<NAME>
Run a stack: podman compose -f $COMPOSE_NAME.yml up -d
Show containers of a stack: podman compose -f $COMPOSE_NAME.yml ps
Check stack logs:
podman compose -f $COMPOSE_NAME.yml logs -f- or specific container
podman compose -f $COMPOSE_NAME.yml logs -f <CONTAINER NAME>
Restart stack:
podman compose -f $COMPOSE_NAME.yml restart- or specific container
podman compose -f $COMPOSE_NAME.yml restart <CONTAINER NAME>
Recreate stack:
Enter shell of container: podman exec -it <CONTAINER> /bin/sh
SELinuxඞ
When attempting to mount a host volume into a Podman container on a system where SELinux is enabled, the container may fail to start, or access to the volume may be denied due to SELinux policy restrictions.
Use :z or :Z volume mount options (mount argument as /data/appdata:/appdata:Z), these flags relabel the host directory for container access:
:z – Use when the volume is shared between multiple containers. :Z – Use when the volume is private to a single container.
Inter container securityඞ
If you run two containers as a rootless user, they run in the same user namespace so they can attack each other from a User Namespace point of view.
If you run two containers as root with podman run --userns=auto, then they run in unigue user namespace and are isolated. Caveats include ensuring storage and network access to all containers that work together, ie from one compose.
This can also be set in the configuration file: