# podman

* [configure files](#configure-files)
* [rootless mode](#rootless-mode)
  * [enable `rootless_storage_path`](#enable-rootless_storage_path)
  * [enable `kernel.unprivileged_userns_clone`](#enable-kernelunprivileged_userns_clone)
  * [setup `subuid` and `subgid`](#setup-subuid-and-subgid)
  * [propagate changes to subuid and subgid](#propagate-changes-to-subuid-and-subgid)
* [Q\&A](#qa)
  * [`error creating tmpdir: mkdir /run/user/1001: permission denied`](#error-creating-tmpdir-mkdir-runuser1001-permission-denied)
  * [add pause to process](#add-pause-to-process)

{% hint style="info" %}
> references:
>
> * [podman](https://docs.podman.io/en/latest/markdown/podman.1.html)
> * [Podman](https://wiki.archlinux.org/title/Podman)
> * [Kubernetes 切换到 Containerd](https://mritd.com/2021/05/29/use-containerd-with-kubernetes/)
{% endhint %}

### configure files

| ENVIRONMENT VARIABLES        | FILE NAME         | ROOTFUL                                 | ROOTLESS                                   |
| ---------------------------- | ----------------- | --------------------------------------- | ------------------------------------------ |
| `CONTAINERS_CONF`            | `mounts.conf`     | `/etc/containers/mounts.conf`           | `$HOME/.config/containers/mounts.conf`     |
| -                            | `policy.json`     | `/etc/containers/policy.json`           | -                                          |
| `CONTAINERS_REGISTRIES_CONF` | `registries.conf` | `/etc/containers/registries.conf`       | `$HOME/.config/containers/registries.conf` |
| `CONTAINERS_STORAGE_CONF`    | `storage.conf`    | `/etc/containers/storage.conf`          | `$HOME/.config/containers/storage.conf`    |
| -                            | `containers.conf` | `/usr/share/containers/containers.conf` | `$HOME/.config/containers/containers.conf` |

*   `short-name-aliases.conf`

    ```bash
    $ cat $HOME/.cache/containers/short-name-aliases.conf
    [aliases]
      "jenkins/jenkins" = "docker.io/jenkins/jenkins"
    ```
*   `storage.conf`

    ```bash
    # original version
    $ cat /etc/containers/storage.conf |  sed -e '/^#/ d' -e '/^$/ d'
    [storage]
    driver = "overlay"
    runroot = "/run/containers/storage"
    graphroot = "/var/lib/containers/storage"
    [storage.options]
    additionalimagestores = [
    ]
    [storage.options.overlay]
    mountopt = "nodev,metacopy=on"
    [storage.options.thinpool]
    ```
*   `registries.conf`

    ```bash
    $ cat /etc/containers/registries.conf |  sed -e '/^#/ d' -e '/^$/ d'
    unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "registry.centos.org", "docker.io"]
    short-name-mode = "permissive"
    ```
*   `policy.json`

    ```bash
    $ cat /etc/containers/policy.json
    {
        "default": [
            {
                "type": "insecureAcceptAnything"
            }
        ],
        "transports": {
            "docker": {
                "registry.access.redhat.com": [
                    {
                        "type": "signedBy",
                        "keyType": "GPGKeys",
                        "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
                    }
                ],
                "registry.redhat.io": [
                    {
                        "type": "signedBy",
                        "keyType": "GPGKeys",
                        "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
                    }
                ]
            },
            "docker-daemon": {
                "": [
                    {
                        "type": "insecureAcceptAnything"
                    }
                ]
            }
        }
    }
    ```

### rootless mode

#### enable `rootless_storage_path`

```bash
$ grep rootless_storage_path /etc/containers/storage.conf
rootless_storage_path = "$HOME/.local/share/containers/storage"

$ /usr/bin/podman system migrate
```

*   or

    ```bash
    $ cat -n /etc/subgid
         1  marslo:336370:65536
    $ cat -n /etc/subuid
         1  marslo:336370:65536

    $ /usr/bin/podman system migrate
    ```

#### enable [`kernel.unprivileged_userns_clone`](https://wiki.archlinux.org/title/Podman#Enable_kernel.unprivileged_userns_clone)

```bash
$ sysctl kernel.unprivileged_userns_clone
```

#### setup `subuid` and `subgid`

> \[!NOTE] Rootless mode Podman can also be used as non-root user. When podman runs in rootless mode, a user namespace is automatically created for the user, defined in `/etc/subuid` and `/etc/subgid`
>
> references:
>
> * [set subuid and subgid](https://wiki.archlinux.org/title/Podman#Set_subuid_and_subgid)

```bash
$ sudo usermod --add-subuids 10000-75535 USERNAME
$ sudo usermod --add-subgids 10000-75535 USERNAME

# or
$ sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 username

# or
$ echo USERNAME:10000:65536 >> /etc/subuid
$ echo USERNAME:10000:65536 >> /etc/subgid
```

#### [propagate changes to subuid and subgid](https://wiki.archlinux.org/title/Podman#Propagate_changes_to_subuid_and_subgid)

```bash
$ podman system migrate
```

### Q\&A

> \[!TIP] reference:
>
> * [podman : troubleshooting](https://wiki.archlinux.org/title/Podman#Troubleshooting)

#### `error creating tmpdir: mkdir /run/user/1001: permission denied`

*   issue

    ```bash
    $ podman info
    WARN[0000] Conmon at /usr/libexec/podman/conmon invalid: outdated conmon version
    Error: error creating tmpdir: mkdir /run/user/1001: permission denied
    ```
*   [solution](https://discussion.fedoraproject.org/t/run-podman-as-non-root-gives-file-permission-errors/8506/19)

    > \[!INFO|label:references:]
    >
    > * [podman info, error creating tmpdir: mkdir /run/user/1007: permission denied](https://www.goglides.dev/bkpandey/error-creating-tmpdir-mkdir-runuser1007-permission-denied-443k)
    > * [`loginctl enable-linger my_ci_user`](https://github.com/containers/podman/issues/9002#issuecomment-762399572)
    > * [containers terminate on shell logout](https://wiki.archlinux.org/title/Podman#Containers_terminate_on_shell_logout)

    ```bash
    $ sudo loginctl enable-linger $(whoami)
    ```

    *   infomation check

        ```bash
        $ loginctl
        SESSION   UID USER   SEAT  TTY
              2 33637 marslo
             c1    42 gdm    seat0 tty1

        $ podman unshare cat /proc/self/uid_map
        WARN[0000] Conmon at /usr/libexec/podman/conmon invalid: outdated conmon version
        Error: error creating tmpdir: mkdir /run/user/1001: permission denie
        ```

#### [add pause to process](https://wiki.archlinux.org/title/Podman#Add_pause_to_process)

```bash
$ sudo echo +cpu +cpuset +io +memory +pids > /sys/fs/cgroup/cgroup.subtree_control
```
