使用 Podman
使用 Podman
使用 Podman 非常的简单，Podman 的指令跟 Docker 大多数都是相同的。下面我们来看几个常用的例子：
运行一个容器
[root@localhost ~]# podman run -dit --name b1 centos
b4ab9b6e8fc5e00f82b3c1906dffed67b63341cab2316afec25584fc2695d832
列出容器
[root@localhost ~]# podman ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
b4ab9b6e8fc5 quay.io/centos/centos:latest /bin/bash 10 seconds ago Up 8 seconds ago b1
检查正在运行的容器
您可以“检查”正在运行的容器的元数据和有关其自身的详细信息。我们甚至可以使用 inspect 子命令查看分配给容器的 IP 地址。由于容器以无根模式运行，因此未分配 IP 地址，并且该值将在检查的输出中列为“无”
[root@localhost ~]# podman run -dit --name web1 httpd
475ec667f992d561bce340d0d41e2d98348fe5c868d46809006ae88355d3ee58
[root@localhost ~]# podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
475ec667f992 docker.io/library/httpd:latest httpd-foreground 5 seconds ago Up 5 seconds ago web1
[root@localhost ~]# podman inspect -l | grep IPAddress\":
"IPAddress": "10.88.0.3",
"IPAddress": "10.88.0.3",
[root@localhost ~]# curl 10.88.0.3
<html><body><h1>It works!</h1></body></html>
注意：-l 是最新容器的便利参数。您还可以使用容器的 ID 代替 -l。
查看一个运行中容器的日志
[root@localhost ~]# podman logs --latest
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.3. Set the 'ServerName' directive globally to suppress this message
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.3. Set the 'ServerName' directive globally to suppress this message
[Mon Aug 15 07:07:59.889454 2022] [mpm_event:notice] [pid 1:tid 140488323009856] AH00489: Apache/2.4.54 (Unix) configured -- resuming normal operations
[Mon Aug 15 07:07:59.892106 2022] [core:notice] [pid 1:tid 140488323009856] AH00094: Command line: 'httpd -D FOREGROUND'
10.88.0.1 - - [15/Aug/2022:07:09:42 +0000] "GET / HTTP/1.1" 200 45
[root@localhost ~]# podman logs -l
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.3. Set the 'ServerName' directive globally to suppress this message
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.3. Set the 'ServerName' directive globally to suppress this message
[Mon Aug 15 07:07:59.889454 2022] [mpm_event:notice] [pid 1:tid 140488323009856] AH00489: Apache/2.4.54 (Unix) configured -- resuming normal operations
[Mon Aug 15 07:07:59.892106 2022] [core:notice] [pid 1:tid 140488323009856] AH00094: Command line: 'httpd -D FOREGROUND'
10.88.0.1 - - [15/Aug/2022:07:09:42 +0000] "GET / HTTP/1.1" 200 45
停止一个运行中的容器
[root@localhost ~]# podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
475ec667f992 docker.io/library/httpd:latest httpd-foreground 4 minutes ago Up 4 minutes ago web1
[root@localhost ~]# podman stop -l
475ec667f992d561bce340d0d41e2d98348fe5c868d46809006ae88355d3ee58
[root@localhost ~]# podman ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
475ec667f992 docker.io/library/httpd:latest httpd-foreground 4 minutes ago Exited (0) 4 seconds ago web1
删除一个容器
[root@localhost ~]# podman rm -f -l
475ec667f992d561bce340d0d41e2d98348fe5c868d46809006ae88355d3ee58
[root@localhost ~]# podman ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
用户操作
在允许没有root特权的用户运行Podman之前，管理员必须安装或构建Podman并完成以下配置
cgroup V2Linux内核功能允许用户限制普通用户容器可以使用的资源，如果使用cgroupV2启用了运行Podman的Linux发行版，则可能需要更改默认的OCI运行时。某些较旧的版本runc不适用于cgroupV2，必须切换到备用OCI运行时crun。
[root@localhost ~]# yum install -y crun
过程省略。。
Installed:
crun-1.0-1.module_el8.5.0+911+f19012f9.x86_64 yajl-2.1.0-10.el8.x86_64
Complete!
[root@localhost ~]# vim /usr/share/containers/containers.conf
runtime = "crun" //取消注释
#runtime = "runc" //添加注释
安装slirp4netns和fuse-overlayfs
在普通用户环境中使用Podman时，建议使用fuse-overlayfs而不是VFS文件系统，至少需要版本0.7.6。现在新版本默认就是了。
[root@localhost ~]# yum -y install slirp4netns
Last metadata expiration check: 0:04:19 ago on Mon 15 Aug 2022 02:22:29 PM CST.
Package slirp4netns-1.1.8-1.module_el8.5.0+890+6b136101.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
[root@localhost ~]# yum -y install fuse-overlayfs
Last metadata expiration check: 0:04:33 ago on Mon 15 Aug 2022 02:22:29 PM CST.
Package fuse-overlayfs-1.7.1-1.module_el8.5.0+890+6b136101.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
[root@localhost ~]# vim /etc/containers/storage.conf
# directly.
mount_program = "/usr/bin/fuse-overlayfs" //取消注释
/ etc / subuid和/ etc / subgid配置
Podman要求运行它的用户在/ etc / subuid和/ etc / subgid文件中列出一系列UID,shadow-utils或newuid包提供这些文件
[root@localhost ~]# yum -y install shadow-utils
可以在/ etc / subuid和/ etc / subgid查看，每个用户的值必须唯一且没有任何重叠。
查看
[root@localhost ~]# useradd aa
[root@localhost ~]# cat /etc/subuid
aa:100000:65536
[root@localhost ~]# cat /etc/subgid
aa:100000:65536
[root@localhost ~]# vim /etc/sysctl.conf
net.ipv4.ping_group_range=0 200000 //添加一行 //大于100000这个就表示tom可以操作podman
[root@localhost ~]# sysctl -p
net.ipv4.ping_group_range = 0 200000
这个文件的格式是 USERNAME:UID:RANGE中/etc/passwd或输出中列出的用户名getpwent。
- 为用户分配的初始 UID。
- 为用户分配的 UID 范围的大小。
该usermod程序可用于为用户分配 UID 和 GID，而不是直接更新文件。
[root@localhost ~]# usermod --add-subuids 200000-201000 --add-subgids 200000-201000 aa
[root@localhost ~]# cat /etc/subuid
aa:100000:65536
aa:200000:1001
用户配置文件
三个主要的配置文件是container.conf、storage.conf和registries.conf。用户可以根据需要修改这些文件。
container.conf
// 用户配置文件
[root@localhost ~]# cat /usr/share/containers/containers.conf //默认只有这一个
[root@localhost ~]# cat /etc/containers/containers.conf
[root@localhost ~]# cat ~/.config/containers/containers.conf //优先级最高
如果它们以该顺序存在。每个文件都可以覆盖特定字段的前一个文件。
配置storage.conf文件
1./etc/containers/storage.conf //高优先级
2.$HOME/.config/containers/storage.conf
在普通用户中/etc/containers/storage.conf的一些字段将被忽略
[root@localhost ~]# vim /etc/containers/storage.conf
[storage]
# Default Storage Driver, Must be set for proper operation.
driver = "overlay" //改为overlay
mount_program = "/usr/bin/fuse-overlayfs" //取消注释
在普通用户中这些字段默认(不需要修改)
graphroot="$HOME/.local/share/containers/storage"
runroot="$XDG_RUNTIME_DIR/containers"
registries.conf(镜像仓库配置文件)
配置按此顺序读入,这些文件不是默认创建的,可以从/usr/share/containers或复制文件/etc/containers并进行修改。
1./etc/containers/registries.conf
2./etc/containers/registries.d/*
3.HOME/.config/containers/registries.conf
[root@localhost ~]# find / -name registries.conf
/etc/containers/registries.conf
授权文件
此文件里面写了docker账号的密码，以加密方式显示
[root@localhost ~]# podman login docker.io
Username: luojialong123
Password:
Login Succeeded!
[root@localhost ~]# cat /run/user/0/containers/auth.json
{
"auths": {
"docker.io": {
"auth": "bHVvamlhbG9uZzEyMzpsdW9qaWFsb25nMTIz"
}
}
}[root@localhost ~]#
普通用户是无法看见root用户的镜像的
//root用户
}[root@localhost ~]# podman images
REPOSITORY TAG IMAGE ID CREATED SIZE
docker.io/luojialong123/v2 v1 454d18d47b5d 10 days ago 1.47 MB
docker.io/library/busybox v1 454d18d47b5d 10 days ago 1.47 MB
docker.io/library/httpd latest f2a976f932ec 13 days ago 149 MB
quay.io/centos/centos latest 300e315adb2f 20 months ago 217 MB
//普通用户
[root@localhost ~]# su - aa
[aa@localhost ~]$ podman images
REPOSITORY TAG IMAGE ID CREATED SIZE
卷
- 容器与root用户一起运行，则root容器中的用户实际上就是主机上的用户。
- UID GID是在/etc/subuid和/etc/subgid等中用户映射中指定的第一个UID GID。
- 如果普通用户的身份从主机目录挂载到容器中，并在该目录中以根用户身份创建文件，则会看到它实际上是你的用户在主机上拥有的。
使用卷
[aa@localhost ~]$ pwd
/home/aa
[aa@localhost ~]$ podman run -it -v "$(pwd)"/data:/data docker.io/library/busybox /bin/sh
Trying to pull docker.io/library/busybox:latest...
Getting image source signatures
Copying blob 50783e0dfb64 done
Copying config 7a80323521 done
Writing manifest to image destination
Storing signatures
使用
[aa@localhost ~]$ podman run -it -v "$(pwd)"/data:/data:Z docker.io/library/busybox /bin/sh
/ # cd /data/
/data # ls
1
/data # touch 2 3
/data # ls
1 2 3
/data # ls -l
total 0
-rw-rw-r-- 1 root root 0 Aug 15 07:20 1
-rw-r--r-- 1 root root 0 Aug 15 07:22 2
-rw-r--r-- 1 root root 0 Aug 15 07:22 3
在主机上查看
[aa@localhost ~]$ cd data/
[aa@localhost data]$ ll
total 0
-rw-rw-r--. 1 aa aa 0 Aug 15 15:20 1
-rw-r--r--. 1 aa aa 0 Aug 15 15:22 2
-rw-r--r--. 1 aa aa 0 Aug 15 15:22 3
[aa@localhost data]$ echo "123" >> 123
[aa@localhost data]$ cat 123
123
容器里查看
/data # ls
1 123 2 3
/data # cat 123
123
//我们可以发现在容器里面的文件的属主和属组都属于root，那么如何才能让其属于tom用户呢？下面告诉你答案
//只要在运行容器的时候加上一个--userns=keep-id即可。
/data # ls -l
total 4
-rw-rw-r-- 1 root root 0 Aug 15 07:20 1
-rw-rw-r-- 1 root root 4 Aug 15 07:25 123
-rw-r--r-- 1 root root 0 Aug 15 07:22 2
-rw-r--r-- 1 root root 0 Aug 15 07:22 3
[aa@localhost ~]$ podman run -it -v "$(pwd)"/data:/data:Z --userns=keep-id docker.io/library/busybox /bin/sh
~ $ cd data/
/data $ ls -l
total 4
-rw-rw-r-- 1 aa aa 0 Aug 15 07:20 1
-rw-rw-r-- 1 aa aa 4 Aug 15 07:25 123
-rw-r--r-- 1 aa aa 0 Aug 15 07:22 2
-rw-r--r-- 1 aa aa 0 Aug 15 07:22 3
使用普通用户映射容器端口时会报“ permission denied”的错误
[aa@localhost data]$ podman run -d -p 80:80 httpd
Resolving "httpd" using unqualified-search registries (/etc/containers/registries.conf)
Trying to pull docker.io/library/httpd:latest...
Getting image source signatures
Copying blob 80e368ef21fc done
Copying blob 1efc276f4ff9 done
Copying blob 4340e7be3d7f done
Copying blob 80cb79a80bbe done
Copying blob aed046121ed8 done
Copying config f2a976f932 done
Writing manifest to image destination
Storing signatures
Error: rootlessport cannot expose privileged port 80, you can add 'net.ipv4.ip_unprivileged_port_start=80' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen tcp 0.0.0.0:80: bind: permission denied
普通用户可以映射>= 1024的端口
[aa@localhost data]$ podman run -d -p 1024:80 httpd
2ffeaabc4cf9bac304d5a7cbe176b5853ad1a6ca55299aedd6542a314be78d3f
配置echo ‘net.ipv4.ip_unprivileged_port_start=80’ >> /etc/sysctl.conf后可以映射大于等于80的端口
[root@localhost ~]# vim /etc/sysctl.conf
net.ipv4.ip_unprivileged_port_start=80 //添加一行
[root@localhost ~]# sysctl -p
net.ipv4.ping_group_range = 0 200000
net.ipv4.ip_unprivileged_port_start = 80
[root@localhost ~]# podman run -d -p 80:80 httpd
d1837c3876de1492572dc186f5c37e13585ae5c5d0db14de5804e906609f7bb9
[root@localhost ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 *:1024 *:*
LISTEN 0 80 *:3306 *:*
LISTEN 0 128 [::]:22 [::]:*
例如，如果我们想在 http://docker.io 上分享我们新建的 Nginx 容器镜像，这很容易。首先登录码头：
[root@192 ~]# mkdir /nginx
[root@192 ~]# cd /nginx/
[root@192 nginx]# mkdir files
[root@192 nginx]# ls
files
[root@192 nginx]# cd files/
[root@192 files]# wget https://nginx.org/download/nginx-1.22.0.tar.gz
[root@192 files]# ls
nginx-1.22.0.tar.gz
[root@192 nginx]# vim Dockerfile
FROM docker.io/library/centos
ENV PATH /usr/local/nginx/sbin:$PATH
ADD files/nginx-1.22.0.tar.gz /usr/src
RUN useradd -r -M -s /sbin/nologin nginx && \
yum -y install pcre-devel openssl openssl-devel gd-devel gcc gcc-c++ make && \
mkdir -p /var/log/nginx && \
cd /usr/src/nginx-1.22.0 && \
./configure \
--prefix=/usr/local/nginx \
--user=nginx \
--group=nginx \
--with-debug \
--with-http_ssl_module \
--with-http_realip_module \
--with-http_image_filter_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_stub_status_module \
--http-log-path=/var/log/nginx/access.log \
--error-log-path=/var/log/nginx/error.log && \
make && make install
CMD ["nginx","-g","daemon off"]
[root@192 nginx]# tree
.
├── Dockerfile
└── files
└── nginx-1.22.0.tar.gz
1 directory, 2 files
[root@192 nginx]# podman build -t nginx .
STEP 1/5: FROM docker.io/library/centos
Trying to pull docker.io/library/centos:latest...
Getting image source signatures
// 修改镜像名
[root@192 ~]# podman tag docker.io/library/nginx:latest docker.io/glume007/nginx:v1
// 登录并上传镜像
[root@192 ~]# podman login docker.io // 需要告诉其要登录到docker仓库
[root@192 ~]# podman login docker.io
Username: luojialong123 #账户
Password: ******** #密码
Login Succeeded!
[root@localhost nginx]# podman push docker.io/glume007/nginx:v1 //上传镜像
Getting image source signatures
Copying blob 38c40d6c2c85 done
Copying blob fee76a531659 done
Copying blob c2adabaecedb done
Copying config 7f3589c0b8 done
Writing manifest to image destination
Copying config 7f3589c0b8 done
Writing manifest to image destination
Storing signatures
