Added Setup-RootlessPodmanLXC HowTo-Linux-AllowHass-PowerCTL

2026-10-09 22:51:25 +02:00
1 parent c9fc1f2c57
commit b70b2c562e
@@ -0,0 +1,72 @@
+# Rootless Podman in unpriviliged LXC
+add to LXC config
+```
+lxc.idmap: u 0 100000 200000
+lxc.idmap: g 0 100000 200000
+lxc.cgroup2.devices.allow: c 10:200 rwm
+lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
+```
+Up the Sub User/Group ID's for root
+/etc/subuid
+```
+root:100000:200000
+```
+/etc/subgid
+```
+root:100000:200000
+```
+
+# in the LXC
+## Podman install
+```
+newuser=<UserName>
+adduser <USERAME>
+apt install podman podman-docker podman-compose ca-certificates passt libpam-systemd dbus-user-session catatonit nftables aardvark-dns uidmap
+cp /usr/lib/tmpfiles.d/podman.conf /etc/tmpfiles.d/podman.conf
+echo 'R! /tmp/storage-run-*/containers/' >> /etc/tmpfiles.d/podman.conf
+echo 'R! /tmp/storage-run-*/libpod/tmp/' >> /etc/tmpfiles.d/podman.conf
+loginctl enable-linger bram
+```
+Reboot the LXC
+## Admin interface
+### Use Cockpit
+```
+. /etc/os-release
+echo "deb http://deb.debian.org/debian ${VERSION_CODENAME}-backports main" > /etc/apt/sources.list.d/backports.list
+apt update
+apt install -t ${VERSION_CODENAME}-backports cockpit cockpit-podman
+```
+
+
+### Use Dockhand
+As the created user
+```
+systemctl --user --now enable podman.socket 
+poedman run -d \
+  --name dockhand \
+  --restart unless-stopped \
+  -p 3000:3000 \
+  -v /run/user/1000/podman/podman.sock:/var/run/docker.sock \
+  -v dockhand_data:/app/data \
+  docker.io/fnsys/dockhand:latest
+```
+
+### Use as remote for Dockhand (podman socket over IP)
+As the created user
+```
+systemctl --user --now enable podman.socket 
+```
+
+Edit `/usr/lib/systemd/user/podman.socket` as root
+Replace
+```
+[Socket]
+ListenStream=%t/podman/podman.sock
+SocketMode=0660
+```
+with
+```
+[Socket]
+ListenStream=0.0.0.0:2375
+```
+You can now add the enviroment as direct connection in dockhand