• Virtualization
• podman

Virtualization/podman

About

Podman (the POD MANager) is a tool for managing containers and images, volumes mounted into those containers, and pods made from groups of containers. Podman runs containers on Linux, but can also be used on Mac and Windows systems using a Podman-managed virtual machine. Podman is based on libpod, a library for container lifecycle management that is also contained in this repository. The libpod library provides APIs for managing containers, pods, container images, and volumes.

Podman releases a new major or minor release 4 times a year, during the second week of February, May, August, and November. Patch releases are more frequent and may occur at any time to get bugfixes out to users. All releases are PGP signed. Public keys of members of the team approved to make releases are located here.

• Apache License 2.0

• https://podman.io/

• https://podman.io/docs

• https://github.com/containers/

• github.com containers/podman Podman performance guide

• https://containertoolbx.org/

Installation

Install podman

   1 apt install podman

Debian Stable has a quite old version. But there's not really an alternative.

Privileged ports

1. --privileged containers

   • Same rights and capabilities as the user, that the container runs as
   • User needs to be privileged to bind to privileged ports
   • Container gains additional unnecessary capabilities

   • -> suboptimal

2. setcap cap_net_bind_service=ep /usr/bin/rootlesskit

   • All containers may bind to privileged ports

   • -> suboptimal

3. sysctl net.ipv4.ip_unprivileged_port_start=$PORT_NUMBER

   • All containers may bind to specified privileged port

   • -> suboptimal

4. Redirection via firewall

   • iptables

     • deprecated

   • nftables

     • redirect to

       • Special case of dnat to (with target localhost)

     • dnat to can also NAT to remote addresses

     • -> optimal

5. Local tunnel

   • Create local tunnel with socat started by systemd

   • -> optimal

Maintenance

Remove dangling images

Please see:

• man 1 podman-images

• docs.podman.io latest - podman-images

List dangling images

   1 $ podman images --filter dangling=true
   2 $ podman image ls --filter dangling=true
   3 REPOSITORY  TAG         IMAGE ID      CREATED      SIZE
   4 <none>      <none>      a5cd2e6f7c97  6 weeks ago  106 MB

Please see:

• man 1 podman-image-prune

• docs.podman.io latest - podman-image-prune

Remove dangling images

   1 $ podman image prune
   2 WARNING! This command removes all dangling images.
   3 Are you sure you want to continue? [y/N]