72 lines
1.7 KiB
Markdown
72 lines
1.7 KiB
Markdown
# Rootless Podman in unpriviliged LXC
|
|
add to LXC config
|
|
```
|
|
lxc.idmap: u 0 100000 200000
|
|
lxc.idmap: g 0 100000 200000
|
|
lxc.cgroup2.devices.allow: c 10:200 rwm
|
|
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
|
|
```
|
|
Up the Sub User/Group ID's for root
|
|
/etc/subuid
|
|
```
|
|
root:100000:200000
|
|
```
|
|
/etc/subgid
|
|
```
|
|
root:100000:200000
|
|
```
|
|
|
|
# in the LXC
|
|
## Podman install
|
|
```
|
|
newuser=<UserName>
|
|
adduser <USERAME>
|
|
apt install podman podman-docker podman-compose ca-certificates passt libpam-systemd dbus-user-session catatonit nftables aardvark-dns uidmap
|
|
cp /usr/lib/tmpfiles.d/podman.conf /etc/tmpfiles.d/podman.conf
|
|
echo 'R! /tmp/storage-run-*/containers/' >> /etc/tmpfiles.d/podman.conf
|
|
echo 'R! /tmp/storage-run-*/libpod/tmp/' >> /etc/tmpfiles.d/podman.conf
|
|
loginctl enable-linger bram
|
|
```
|
|
Reboot the LXC
|
|
## Admin interface
|
|
### Use Cockpit
|
|
```
|
|
. /etc/os-release
|
|
echo "deb http://deb.debian.org/debian ${VERSION_CODENAME}-backports main" > /etc/apt/sources.list.d/backports.list
|
|
apt update
|
|
apt install -t ${VERSION_CODENAME}-backports cockpit cockpit-podman
|
|
```
|
|
|
|
|
|
### Use Dockhand
|
|
As the created user
|
|
```
|
|
systemctl --user --now enable podman.socket
|
|
poedman run -d \
|
|
--name dockhand \
|
|
--restart unless-stopped \
|
|
-p 3000:3000 \
|
|
-v /run/user/1000/podman/podman.sock:/var/run/docker.sock \
|
|
-v dockhand_data:/app/data \
|
|
docker.io/fnsys/dockhand:latest
|
|
```
|
|
|
|
### Use as remote for Dockhand (podman socket over IP)
|
|
As the created user
|
|
```
|
|
systemctl --user --now enable podman.socket
|
|
```
|
|
|
|
Edit `/usr/lib/systemd/user/podman.socket` as root
|
|
Replace
|
|
```
|
|
[Socket]
|
|
ListenStream=%t/podman/podman.sock
|
|
SocketMode=0660
|
|
```
|
|
with
|
|
```
|
|
[Socket]
|
|
ListenStream=0.0.0.0:2375
|
|
```
|
|
You can now add the enviroment as direct connection in dockhand |