podman应用

于 2021-08-13 12:49:19 发布
阅读量286 收藏
点赞数
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.youkuaiyun.com/B_memory/article/details/119655679
版权
本文介绍了Podman的基本操作，如拉取镜像、运行容器和查看日志，强调了在没有root权限的情况下如何进行配置。普通用户需要安装slirp4netns和fuse-overlayfs，调整cgroup V2的OCI运行时，并设置/ etc / subuid和/ etc / subgid文件。此外，还提到不同用户可以创建同名容器，但普通用户无法访问root用户的镜像，且映射端口需注意权限问题。

摘要生成于 C知道 ，由 DeepSeek-R1 满血版支持， 前往体验 >

podman基本操作
podman的操作和docker是一样的

  • 拉取镜像
[root@host ~]# podman pull httpd
Resolving "httpd" using unqualified-search registries (/etc/containers/registries.conf)
Trying to pull docker.io/library/httpd:latest...
Getting image source signatures
Copying blob 33847f680f63 skipped: already exists  
Copying blob 763d74736d95 done  
Copying blob a8c75048351a done  
Copying blob d74938eee980 done  
Copying blob 963cfdce5a0c done  
Copying config bde40dcb22 done  
Writing manifest to image destination
Storing signatures
bde40dcb22a7a82392a45bcc7f191bb2f807d57711934d4eda869d3d649a3643
  • 运行容器
[root@host ~]# podman run  -d  --name t1 -p 80 docker.io/library/httpd
c035037877efeb0523b81865f2b677407fb2f0e6bd174e2b029f1ad9dd834254
[root@host ~]# podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS                  NAMES
c035037877ef  docker.io/library/httpd:latest  httpd-foreground  9 seconds ago  Up 8 seconds ago  0.0.0.0:35965->80/tcp  t1

#-l 查看最新的容器信息
[root@host ~]# podman inspect -l
[
    {
        "Id": "c035037877efeb0523b81865f2b677407fb2f0e6bd174e2b029f1ad9dd834254",
        "Created": "2021-08-12T10:44:14.434329075-04:00",
        "Path": "httpd-foreground",
        "Args": [
            "httpd-foreground"
        ],
        "State": {
            "OciVersion": "1.0.2-dev",
            "Status": "running",
......
[root@host ~]# curl 192.168.149.143:35965
<html><body><h1>It works!</h1></body></html>
  • podman logs查看容器日志
[root@host ~]# podman logs  -l
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.2. Set the 'ServerName' directive globally to suppress this message
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.2. Set the 'ServerName' directive globally to suppress this message
[Thu Aug 12 14:44:15.289622 2021] [mpm_event:notice] [pid 1:tid 140190884684928] AH00489: Apache/2.4.48 (Unix) configured -- resuming normal operations
[Thu Aug 12 14:44:15.289915 2021] [core:notice] [pid 1:tid 140190884684928] AH00094: Command line: 'httpd -D FOREGROUND'
192.168.149.143 - - [12/Aug/2021:14:46:02 +0000] "GET / HTTP/1.1" 200 45
  • pod top <container_id>产看容器pid
[root@host ~]# podman top t1
USER        PID         PPID        %CPU        ELAPSED         TTY         TIME        COMMAND
root        1           0           0.000       3m5.218706179s  ?           0s          httpd -DFOREGROUND 
daemon      7           1           0.000       3m4.218877391s  ?           0s          httpd -DFOREGROUND 
daemon      8           1           0.000       3m4.219010462s  ?           0s          httpd -DFOREGROUND 
daemon      9           1           0.000       3m4.219060556s  ?           0s          httpd -DFOREGROUND
  • 镜像上传
[root@host ~]# podman login
Username: xialuo
Password: 
Login Succeeded!
[root@host ~]# podman tag docker.io/library/nginx:latest xialuo/test:nginx
[root@host ~]# podman push xialuo/test:nginx
Getting image source signatures
Copying blob e3135447ca3e done  
Copying blob 988d9a3509bb done  
Copying blob 59b01b87c9e7 done  
Copying blob b85734705991 done  
Copying blob 7c0b223167b9 done  
Copying blob 814bff734324 done  
Copying config 08b152afcf done  
Writing manifest to image destination
Storing signatures

普通用户使用的配置
在允许没有root特权的用户运行Podman之前，管理员必须安装或构建Podman并完成以下配置

cgroup V2Linux内核功能允许用户限制普通用户容器可以使用的资源，如果使用cgroup V2启用了运行Podman的Linux发行版，则可能需要更改默认的OCI运行时。某些较旧的版本runc不适用于cgroup V2，必须切换到备用OCI运行时crun。

[root@host ~]# yum  -y install crun

可以使用--runtime选项在命令行中打开对cgroup V2的替代OCI运行时支持

podman  --runtime crun

也可以修改containers.conf文件runtime = "runc"到runtime = "crun"

[root@host ~]# vim /usr/share/containers/containers.conf
......
# volume_path = "/var/lib/containers/storage/volumes"

# Default OCI runtime
#
# runtime = "crun"
runtime = "crun"

# List of the OCI runtimes that support --format=json.  When json is supported
# engine will use it for reporting nicer errors.
......
[root@host ~]# podman start t1
[root@host ~]# podman inspect t1 | grep runc
        "OCIRuntime": "runc",
            "runc",

安装slirp4netns
slirp4nets包为普通用户提供一种网络模式

[root@host ~]# yum -y install slirp4netns

安装fuse-overlayfs
在普通用户环境中使用Podman时，建议使用fuse-overlayfs而不是VFS文件系统

[root@host ~]#  yum -y install fuse-overlayfs

配置storage.conf文件

[root@host ~]# vim /etc/containers/storage.conf
# This file is is the configuration file for all tools
# that use the containers/storage library.
# See man 5 containers-storage.conf for more information
# The "container storage" table contains all of the server options.
[storage]

# Default Storage Driver, Must be set for proper operation.
driver = "overlay"   此处改为overlay  #这里好像就是一样的

# Temporary storage location
runroot = "/run/containers/storage"
......
# Path to an helper program to use for mounting the file system instead of mounting it
# directly.
mount_program = "/usr/bin/fuse-overlayfs"   这里取消注释

/ etc / subuid和/ etc / subgid配置
Podman要求运行它的用户在/ etc / subuid和/ etc / subgid文件中列出一系列UID,shadow-utils或newuid包提供这些文件

[root@host ~]# yum -y install shadow-utils

可以在/ etc / subuid和/ etc / subgid查看，每个用户的值必须唯一且没有任何重叠。

[root@host ~]# useradd xx
[root@host ~]# cat /etc/subuid
xx:100000:65536
[root@host ~]# cat /etc/subgid
xx:100000:65536

该文件的格式为USERNAME：UID：RANGE

  • 在/ etc / passwd或getpwent中列出的用户名。
  • 为用户分配的初始uid。
  • 为用户分配的UID范围的大小

普通用户是无法看见root用户的镜像的

[root@host ~]# podman images
REPOSITORY               TAG         IMAGE ID      CREATED      SIZE
docker.io/library/httpd  latest      bde40dcb22a7  6 days ago   142 MB
docker.io/library/nginx  latest      08b152afcfae  3 weeks ago  137 MB

[root@host ~]# su - xx
[xx@host ~]$ podman images
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE

不同用户可以创建相同名字的容器，互不相干

[root@host ~]# podman run -d --name web nginx
6d30f187cef38d858382f66330425c7486e6c12fe50c4484633b5ae6a9a14396
[root@host ~]# podman ps -a
CONTAINER ID  IMAGE                           COMMAND               CREATED         STATUS             PORTS                  NAMES
c035037877ef  docker.io/library/httpd:latest  httpd-foreground      27 minutes ago  Up 27 minutes ago  0.0.0.0:35965->80/tcp  t1
6d30f187cef3  docker.io/library/nginx:latest  nginx -g daemon o...  9 seconds ago   Up 10 seconds ago                         web

[xx@host ~]$ podman run -d --name web nginx
05a0373053548f83e15b1719ee535ab1d0f448b655ffb033867eeeb06c273cb6
[xx@host ~]$ podman ps -a
CONTAINER ID  IMAGE                           COMMAND               CREATED         STATUS             PORTS       NAMES
05a037305354  docker.io/library/nginx:latest  nginx -g daemon o...  40 seconds ago  Up 39 seconds ago              web

** 使用卷**
容器与root用户一起运行，则root容器中的用户实际上就是主机上的用户。UID / GID 1是在/etc/subuid和/etc/subgid等中用户映射中指定的第一个UID / GID 。如果普通用户的身份从主机目录挂载到容器中，并在该目录中以根用户身份创建文件，则会看到它实际上是你的用户在主机上拥有的。

[xx@host ~]$ pwd
/home/xx
[xx@host ~]$ podman run -it --name web1 -v /home/xx/dd:/data:Z docker.io/library/nginx /bin/sh
# ls
bin   data  docker-entrypoint.d   etc   lib    media  opt   root  sbin  sys  usr
boot  dev   docker-entrypoint.sh  home  lib64  mnt    proc  run   srv   tmp  var
# cd data 
# ls
# touch 123 
# ls
123
# pwd
/data
# exit
[xx@host ~]$ ls
dd
[xx@host ~]$ ls dd
123

--userns=keep-id标志，以确保用户被映射到容器内自己的UID和GID。

[xx@host ~]$ podman run -it --name t10086 -v "$(pwd)"/dd:/aa --userns=keep-id busybox /bin/sh
~ $ touch aa/abc
~ $ ls -l aa/
total 0
-rw-r--r--    1 xx       xx               0 Aug 13 04:43 123
-rw-r--r--    1 xx       xx               0 Aug 13 04:45 abc
~ $ exit
[xx@host ~]$ ll dd/
总用量 0
-rw-r--r--. 1 xx xx 0 8月  13 00:43 123
-rw-r--r--. 1 xx xx 0 8月  13 00:45 abc
  • 使用普通用户映射容器端口时会报“ permission denied”的错误
[xx@host ~]$ podman  run  --name nginx  -d  -p 80:80 nginx
Error: rootlessport cannot expose privileged port 80, you can add 'net.ipv4.ip_unprivileged_port_start=80' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen tcp 0.0.0.0:80: bind: permission denied
  • 可以映射>= 1024的端口
[xx@host ~]$ podman  run  --name t0  -d  -p 1024:80 nginx
da9ae693f1e10958f7a870de56144f650de732b16356a81babb09fca0c4fbb91
[xx@host ~]$ podman ps
CONTAINER ID  IMAGE                           COMMAND               CREATED        STATUS            PORTS                 NAMES
da9ae693f1e1  docker.io/library/nginx:latest  nginx -g daemon o...  3 seconds ago  Up 3 seconds ago  0.0.0.0:1024->80/tcp  t0
  • 配置echo 'net.ipv4.ip_unprivileged_port_start=80' >> /etc/sysctl.conf
[root@host ~]# echo  'net.ipv4.ip_unprivileged_port_start=80'  >> /etc/sysctl.conf
[root@host ~]# sysctl -p
net.ipv4.ip_unprivileged_port_start = 80

[xx@host ~]$ podman  run  --name nginx  -d  -p 80:80 nginx
aaad33c415081dec0a491dcd7d755699a7f808310b1419a8f247ee40215d163f
[xx@host ~]$ podman ps
CONTAINER ID  IMAGE                           COMMAND               CREATED             STATUS                 PORTS                 NAMES
da9ae693f1e1  docker.io/library/nginx:latest  nginx -g daemon o...  About a minute ago  Up About a minute ago  0.0.0.0:1024->80/tcp  t0
aaad33c41508  docker.io/library/nginx:latest  nginx -g daemon o...  5 seconds ago       Up 5 seconds ago       0.0.0.0:80->80/tcp    nginx2
B_memory
关注
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值