Podman

• Opensource.com - Podman and user namespaces: A marriage made in heaven (opens in a new tab)
• Red Hat - Enable Sysadmin - What happens behind the scenes of a rootless Podman container? (opens in a new tab)

Run a container as a systemd service

• Podman before 4.4

  1. Provision a running container

  podman run -d --name $container_name $image_name
  2. Generate a systemd service unit file for the container

  podman generate systemd --new --name $container_name > "$service_name.service"
  3. Verify and tweak the unit file if needed, and the deploy

  cp "$service_name.service" $HOME/.config/systemd/user
  4. Start and enable the service

    # Verify by running:
  > systemctl --user cat "$service_name.service"
  > systemctl --user start "$service_name.service"   # Verify it runs correctly
  > systemctl --user enable "$service_name.service"  # Auto start at login

  • Resources

    • Red Hat - Enable Sysadmin - How to run pods as systemd services with Podman (opens in a new tab)

• Podman 4.4+

  1. Create a container unit file

     1.1 Manually

     # $HOME/.config/containers/systemd/$service_name.container
     # The container unit file has an extension of `.container`
     # It also has a dedicated section `Container`
     [Unit]
     Description=$container_description
     After=local-fs.target
      
     # The dedicated container section
     [Container]
     Image=$image
     Exec=$image_start_command
      
     [Install]
     # Start by default on boot
     WantedBy=multi-user.target default.target

     1.2 Using Podlet

     # Install Podlet
     brew install podlet

     # Generate a systemd container unit file
     podlet $podman_command_to_run_a_container
     # e.g. podlet podman run -d --publish 8080:8080 --name $container_name $image_name

  2. Create a systemd service unit file based on the container unit file

     systemctl --user daemon-reload

  3. Check the generated service unit file

     /usr/libexec/podman/quadlet -dryrun -user

  4. Check the service status

     systemctl --user status "$service_name.service"

  5. Start and enable the service

     systemctl --user start "$service_name.service"

  • Resources

    • Red Hat - Enable Sysadmin - Make systemd better for Podman with Quadlet (opens in a new tab)

Use rootless Podman

• All rootless containers are run inside the same user namespace.

• When the container runs, any volumes which are shared with it, will appear inside the user namespace as owned by root/root.

• Resources

  • Tutorial Works - Using volumes with rootless podman, explained (opens in a new tab)

Generate Kubernetes YAML based on Podman containers, pods or volumes

Podman will always generate the specification as a Pod.

podman generate kube $container_name

Health Check

• Red Hat Developer - Monitoring container vitality and availability with Podman (opens in a new tab)