Rootless Podman in unpriviliged LXC

add to LXC config

lxc.idmap: u 0 100000 200000
lxc.idmap: g 0 100000 200000
lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

Up the Sub User/Group ID's for root /etc/subuid

root:100000:200000

/etc/subgid

root:100000:200000

in the LXC

Podman install

newuser=<UserName>
adduser <USERAME>
apt install podman podman-docker podman-compose ca-certificates passt libpam-systemd dbus-user-session catatonit nftables aardvark-dns uidmap
cp /usr/lib/tmpfiles.d/podman.conf /etc/tmpfiles.d/podman.conf
echo 'R! /tmp/storage-run-*/containers/' >> /etc/tmpfiles.d/podman.conf
echo 'R! /tmp/storage-run-*/libpod/tmp/' >> /etc/tmpfiles.d/podman.conf
loginctl enable-linger bram

Reboot the LXC

Admin interface

Use Cockpit

. /etc/os-release
echo "deb http://deb.debian.org/debian ${VERSION_CODENAME}-backports main" > /etc/apt/sources.list.d/backports.list
apt update
apt install -t ${VERSION_CODENAME}-backports cockpit cockpit-podman

Use Dockhand

As the created user

systemctl --user --now enable podman.socket 
poedman run -d \
  --name dockhand \
  --restart unless-stopped \
  -p 3000:3000 \
  -v /run/user/1000/podman/podman.sock:/var/run/docker.sock \
  -v dockhand_data:/app/data \
  docker.io/fnsys/dockhand:latest

Use as remote for Dockhand (podman socket over IP)

As the created user

systemctl --user --now enable podman.socket

Edit /usr/lib/systemd/user/podman.socket as root Replace

[Socket]
ListenStream=%t/podman/podman.sock
SocketMode=0660

with

[Socket]
ListenStream=0.0.0.0:2375

You can now add the enviroment as direct connection in dockhand

1.7 KiB Raw Blame History