Podman 的使用

于 2022-08-15 17:36:55 发布
阅读量396 收藏
点赞数
文章标签： 运维 java 服务器
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.youkuaiyun.com/m0_64735681/article/details/126351324
版权

文章目录

基础

运行容器

//查看镜像
[root@localhost ~]# podman images
REPOSITORY                 TAG         IMAGE ID      CREATED      SIZE
docker.io/library/httpd    latest      f2a976f932ec  13 days ago  149 MB
docker.io/library/busybox  latest      7a80323521cc  2 weeks ago  1.47 MB

[root@localhost ~]# podman run -dit --name web1 httpd
7e2d1fd56acd4f33b7329ac896256ffc47bedc143c2de6e9448280f71857fab0

[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:5e:7e:b4 brd ff:ff:ff:ff:ff:ff
    inet 192.168.91.128/24 brd 192.168.91.255 scope global dynamic noprefixroute ens160
       valid_lft 1136sec preferred_lft 1136sec
    inet6 fe80::2e9a:a6f4:ae9f:d298/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: cni-podman0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether fe:a6:2e:01:33:36 brd ff:ff:ff:ff:ff:ff
    inet 10.88.0.1/16 brd 10.88.255.255 scope global cni-podman0
       valid_lft forever preferred_lft forever
    inet6 fe80::fca6:2eff:fe01:3336/64 scope link 
       valid_lft forever preferred_lft forever
4: veth9fc12352@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master cni-podman0 state UP group default 
    link/ether 76:c3:f5:bc:84:f9 brd ff:ff:ff:ff:ff:ff link-netns cni-82697eef-97bf-c1f0-a0a9-fe069e7cfc30
    inet6 fe80::74c3:f5ff:febc:84f9/64 scope link 
       valid_lft forever preferred_lft forever

列出运行的容器

[root@localhost ~]# podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED         STATUS             PORTS       NAMES
7e2d1fd56acd  docker.io/library/httpd:latest  httpd-foreground  11 seconds ago  Up 11 seconds ago              web1

注意：如果在 ps 命令中添加 -a，Podman 将显示所有容器。

检查正在运行的容器

您可以“检查”正在运行的容器的元数据和有关其自身的详细信息。我们甚至可以使用inspect子命令查看分配给容器的 IP 地址。由于容器以无根模式运行，因此未分配 IP 地址，并且该值将在检查的输出中列为“无”。

[root@localhost ~]# podman inspect web1 | grep -i address
            "IPAddress": "10.88.0.2",
            "GlobalIPv6Address": "",
            "MacAddress": "32:d2:1a:88:12:cb",
            "LinkLocalIPv6Address": "",
                    "IPAddress": "10.88.0.2",
                    "GlobalIPv6Address": "",
                    "MacAddress": "32:d2:1a:88:12:cb",

[root@localhost ~]# podman inspect -l | grep -i addr
            "IPAddress": "10.88.0.2",
            "GlobalIPv6Address": "",
            "MacAddress": "32:d2:1a:88:12:cb",
            "LinkLocalIPv6Address": "",
                    "IPAddress": "10.88.0.2",
                    "GlobalIPv6Address": "",
                    "MacAddress": "32:d2:1a:88:12:cb",

[root@localhost ~]# curl 10.88.0.2
<html><body><h1>It works!</h1></body></html>

注意：-l 是最新容器的便利参数。您还可以使用容器的 ID 代替 -l 。

查看一个运行中容器的日志

选项：–latest #最近的

[root@localhost ~]# podman run -d httpd
90d1b5231ba6097e099c8390ff68002928e9f6360947c7a0c4ff046e2914f7b8
[root@localhost ~]# podman run -d httpd
fea52a7a51219beaf5d32aef64a138981443c7647f835da8ab30dd1b06c846ac
[root@localhost ~]# podman run -d httpd
0bbd427d23abb9524868f48f7f5fa4539ca43c71dd7860b802b5c5b954bc8355

[root@localhost ~]# podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED         STATUS             PORTS       NAMES
7e2d1fd56acd  docker.io/library/httpd:latest  httpd-foreground  5 minutes ago   Up 5 minutes ago               web1
90d1b5231ba6  docker.io/library/httpd:latest  httpd-foreground  14 seconds ago  Up 14 seconds ago              xenodochial_chatterjee
fea52a7a5121  docker.io/library/httpd:latest  httpd-foreground  10 seconds ago  Up 10 seconds ago              jolly_tereshkova
0bbd427d23ab  docker.io/library/httpd:latest  httpd-foreground  7 seconds ago   Up 8 seconds ago               ecstatic_babbage

[root@localhost ~]# podman rm -f -l
0bbd427d23abb9524868f48f7f5fa4539ca43c71dd7860b802b5c5b954bc8355

[root@localhost ~]# podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED         STATUS             PORTS       NAMES
7e2d1fd56acd  docker.io/library/httpd:latest  httpd-foreground  5 minutes ago   Up 5 minutes ago               web1
90d1b5231ba6  docker.io/library/httpd:latest  httpd-foreground  32 seconds ago  Up 31 seconds ago              xenodochial_chatterjee
fea52a7a5121  docker.io/library/httpd:latest  httpd-foreground  28 seconds ago  Up 27 seconds ago              jolly_tereshkova

查看一个运行容器中的进程资源使用情况

可以使用top观察容器中的 nginx pid

语法：

 podman top <container_id>  

[root@localhost ~]# podman top web1
USER        PID         PPID        %CPU        ELAPSED          TTY         TIME        COMMAND
root        1           0           0.000       6m45.97627139s   pts/0       0s          httpd -DFOREGROUND 
www-data    7           1           0.000       6m44.976445778s  pts/0       0s          httpd -DFOREGROUND 
www-data    8           1           0.000       6m44.976548742s  pts/0       0s          httpd -DFOREGROUND 
www-data    9           1           0.000       6m44.976586589s  pts/0       0s          httpd -DFOREGROUND

停止一个运行中的容器

[root@localhost ~]# podman stop -l
fea52a7a51219beaf5d32aef64a138981443c7647f835da8ab30dd1b06c846ac

[root@localhost ~]# podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES
7e2d1fd56acd  docker.io/library/httpd:latest  httpd-foreground  7 minutes ago  Up 7 minutes ago              web1
90d1b5231ba6  docker.io/library/httpd:latest  httpd-foreground  2 minutes ago  Up 2 minutes ago              xenodochial_chatterjee

[root@localhost ~]# podman ps -a
CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS                     PORTS       NAMES
7e2d1fd56acd  docker.io/library/httpd:latest  httpd-foreground  7 minutes ago  Up 7 minutes ago                       web1
90d1b5231ba6  docker.io/library/httpd:latest  httpd-foreground  2 minutes ago  Up 2 minutes ago                       xenodochial_chatterjee
fea52a7a5121  docker.io/library/httpd:latest  httpd-foreground  2 minutes ago  Exited (0) 14 seconds ago              jolly_tereshkova

删除一个容器

[root@localhost ~]# podman rm -l
fea52a7a51219beaf5d32aef64a138981443c7647f835da8ab30dd1b06c846ac

[root@localhost ~]# podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES
7e2d1fd56acd  docker.io/library/httpd:latest  httpd-foreground  7 minutes ago  Up 7 minutes ago              web1
90d1b5231ba6  docker.io/library/httpd:latest  httpd-foreground  2 minutes ago  Up 2 minutes ago              xenodochial_chatterjee

[root@localhost ~]# podman ps -a
CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES
7e2d1fd56acd  docker.io/library/httpd:latest  httpd-foreground  7 minutes ago  Up 7 minutes ago              web1
90d1b5231ba6  docker.io/library/httpd:latest  httpd-foreground  2 minutes ago  Up 2 minutes ago              xenodochial_chatterjee

用户操作

在允许没有 root 特权的用户运行 Podman 之前，管理员必须安装或构建 Podman 并完成以下配置。

cgroup（控制组）V2Linux 内核功能允许用户限制普通用户容器可以使用的资源，如果使用 cgroupV2 启用了运行 Podman 的 Linux 发行版，则可能需要更改默认的 OCI 运行时。某些较旧的版本 runc 不适用于 cgroupV2，必须切换到备用 OCI 运行时 crun。

[root@localhost ~]# rpm -qa | grep crun
[root@localhost ~]# dnf -y install crun

[root@localhost ~]# vim /usr/share/containers/containers.conf 
runtime = "crun"		//取消注释
#runtime = "runc"		//添加注释

[root@localhost ~]# podman run -d --name web -p 80:80 httpd
ecdf74967eb1967cabe551d4b1ec36d6637da1cf11bcf6f2c80f934fb7ce3513

[root@localhost ~]# podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED         STATUS             PORTS               NAMES
ecdf74967eb1  docker.io/library/httpd:latest  httpd-foreground  17 seconds ago  Up 18 seconds ago  0.0.0.0:80->80/tcp  web

[root@localhost ~]# podman inspect -l | grep crun
        "OCIRuntime": "crun",
            "crun",
[root@localhost ~]# podman inspect -l | grep runc
[root@localhost ~]#

安装 slirp4netns 和 fuse-overlayfs

在普通用户环境中使用 Podman 时，建议使用 fuse-overlayfs 而不是 VFS 文件系统，至少需要版本 0.7.6。现在新版本默认就是了。

[root@localhost ~]# rpm -qa | grep slirp4netns
slirp4netns-1.1.8-1.module_el8.5.0+890+6b136101.x86_64
[root@localhost ~]# rpm -qa | grep fuse-overlayfs
fuse-overlayfs-1.7.1-1.module_el8.5.0+890+6b136101.x86_64

[root@localhost ~]# vim /etc/containers/storage.conf 
mount_program = "/usr/bin/fuse-overlayfs"		//取消注释

[root@localhost ~]# which fuse-overlayfs
/usr/bin/fuse-overlayfs

/etc/subuid 和 /etc/subgid 配置

Podman 要求运行它的用户在/etc/subuid和/etc/subgid文件中列出一系列 UID，shadow-utils 或 newuid 包提供这些文件

[root@localhost ~]# dnf -y install shadow-utils

可以在/etc/subuid和/etc/subgid查看，每个用户的值必须唯一且没有任何重叠。

[root@localhost ~]# useradd abc
[root@localhost ~]# id abc
uid=1000(abc) gid=1000(abc) groups=1000(abc)
[root@localhost ~]# cat /etc/subuid
abc:100000:65536
[root@localhost ~]# cat /etc/subgid
abc:100000:65536

// 启动非特权ping 
[root@localhost ~]# vim /etc/sysctl.conf 
net.ipv4.ping_group_range=0 200000		//添加此行，大于100000这个就表示abc可以操作podman

[root@localhost ~]# sysctl -p
net.ipv4.ping_group_range = 0 200000

这个文件的格式是USERNAME:UID:RANGE中/etc/passwd或输出中列出的用户名 。

  • 为用户分配的初始 UID。
  • 为用户分配的 UID 范围的大小。

该 usermod 程序可用于为用户分配 UID 和 GID，而不是直接更新文件。

[root@localhost ~]# usermod --add-subuids 200000-201000 --add-subgids 200000-201000 abc

[root@localhost ~]# cat /etc/subuid
abc:100000:65536
abc:200000:1001
[root@localhost ~]# cat /etc/subgid
abc:100000:65536
abc:200000:1001

用户配置文件

三个主要的配置文件是container.conf、storage.conf和registries.conf。用户可以根据需要修改这些文件。

  • container.conf
    • ~/.config/containers/containers.conf：优先级最高
    • /etc/containers/containers.conf：优先级次之
    • /usr/share/containers/containers.conf：优先级最低
      如果它们以该顺序存在。每个文件都可以覆盖特定字段的前一个文件。
[root@localhost ~]# find / -name containers.conf
/usr/share/containers/containers.conf
  • 配置 storage.conf 文件
    • /etc/containers/storage.conf：优先级最高
    • $HOME/.config/containers/storage.conf
[root@localhost ~]# find / -name storage.conf
/etc/containers/storage.conf

在普通用户中/etc/containers/storage.conf的一些字段将被忽略

[root@localhost ~]# vim /etc/containers/storage.conf
[storage]

# Default Storage Driver, Must be set for proper operation.
driver = "overlay"
.......
mount_program = "/usr/bin/fuse-overlayfs"		//取消注释

[root@localhost ~]# vim /etc/sysctl.conf 
user.max_user_namespaces=15000		//添加此行，用户的最大名称空间为15000，不指定也可

[root@localhost ~]# sysctl -p
net.ipv4.ping_group_range = 0 200000
user.max_user_namespaces = 15000

在普通用户中这些字段默认

graphroot="$HOME/.local/share/containers/storage"
runroot="$XDG_RUNTIME_DIR/containers"
  • registries.conf
    配置按此顺序读入，这些文件不是默认创建的,可以从/usr/share/containers或复制文件/etc/containers并进行修改。
    • /etc/containers/registries.conf：优先级最高
    • /etc/containers/registries.d/*：优先级次之
    • HOME/.config/containers/registries.conf：优先级最低
[root@localhost ~]# find / -name registries.conf
/etc/containers/registries.conf

授权文件

此文件里面写了 docker 账号的密码，以加密方式显示

[root@localhost ~]# podman login
Username: starskysmile
Password: 
Login Succeeded!

[root@localhost ~]# cat /run/user/0/containers/auth.json 
{
	"auths": {
		"docker.io": {
			"auth": "c3RhcnNreXNtaWxlOktBTkc5OTgzIQ=="
		}
	}
}

普通用户是无法看见root用户的镜像的

//root用户
[root@localhost ~]# podman images
REPOSITORY                 TAG         IMAGE ID      CREATED         SIZE
<none>                     <none>      dfacc5d09d31  55 minutes ago  245 MB
docker.io/library/httpd    latest      f2a976f932ec  13 days ago     149 MB
docker.io/library/busybox  latest      7a80323521cc  2 weeks ago     1.47 MB
docker.io/library/centos   latest      5d0da3dc9764  11 months ago   239 MB

//普通用户
[root@localhost ~]# su - abc
[abc@localhost ~]$ podman images
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE

卷

  • 容器与 root 用户一起运行，则 root 容器中的用户实际上就是主机上的用户。
  • UID GID 是在/etc/subuid和/etc/subgid等用户映射中指定的第一个 UID GID。
  • 如果普通用户的身份从主机目录挂载到容器中，并在该目录中以根用户身份创建文件，则会看到它实际上是你的用户在主机上拥有的。

使用卷

[root@localhost ~]# su - abc
Last login: Mon Aug 15 16:56:40 CST 2022 on pts/1
[abc@localhost ~]$ mkdir /home/abc/data
[abc@localhost ~]$ ls
data

[abc@localhost ~]$ podman run -it -v $(pwd)/data:/data:Z busybox /bin/sh
Resolved "busybox" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/busybox:latest...
Getting image source signatures
Copying blob 50783e0dfb64 done  
Copying config 7a80323521 done  
Writing manifest to image destination
Storing signatures
/ # ls
bin   data  dev   etc   home  proc  root  run   sys   tmp   usr   var
/ # cd data/
/data # ls
/data # touch 2 3 4
/data # ls
2  3  4

在主机上查看

[root@localhost ~]# su - abc
Last login: Mon Aug 15 17:02:16 CST 2022 on pts/0
[abc@localhost ~]$ ls
data
[abc@localhost ~]$ cd data/
[abc@localhost data]$ ls
2  3  4

//写入文件
[abc@localhost data]$ echo "hello world" > a
[abc@localhost data]$ cat a
hello world

[abc@localhost data]$ ls -l
total 4
-rw-r--r--. 1 abc abc  0 Aug 15 17:09 2
-rw-r--r--. 1 abc abc  0 Aug 15 17:09 3
-rw-r--r--. 1 abc abc  0 Aug 15 17:09 4
-rw-rw-r--. 1 abc abc 12 Aug 15 17:14 a

容器里查看

/data # cat a
hello world

//我们可以发现在容器里面的文件的属主和属组都属于root，那么如何才能让其属于tom用户呢？下面告诉你答案
/data # ls -l
total 4
-rw-r--r--    1 root     root             0 Aug 15 09:09 2
-rw-r--r--    1 root     root             0 Aug 15 09:09 3
-rw-r--r--    1 root     root             0 Aug 15 09:09 4
-rw-rw-r--    1 root     root            12 Aug 15 09:14 a

//只要在运行容器的时候加上一个--userns=keep-id即可。
[abc@localhost ~]$ podman rm -f -l
fe143d07ac4e8b35ccca983df65ae036939521a14d452a3d0ff1e828f90a778c
[abc@localhost ~]$ podman run -it -v $(pwd)/data:/data:Z --userns=keep-id busybox /bin/sh
~ $ cd data/
/data $ ls -l
total 4
-rw-r--r--    1 abc      abc              0 Aug 15 09:09 2
-rw-r--r--    1 abc      abc              0 Aug 15 09:09 3
-rw-r--r--    1 abc      abc              0 Aug 15 09:09 4
-rw-rw-r--    1 abc      abc             12 Aug 15 09:14 a

/data $ id
uid=1000(abc) gid=1000(abc)

使用普通用户映射容器端口时会报“ permission denied”的错误

[abc@localhost ~]$ podman run -d -p 80:80 httpd
Resolving "httpd" using unqualified-search registries (/etc/containers/registries.conf)
Trying to pull docker.io/library/httpd:latest...
Getting image source signatures
Copying blob 1efc276f4ff9 done  
Copying blob 80cb79a80bbe done  
Copying blob 80e368ef21fc done  
Copying blob 4340e7be3d7f done  
Copying blob aed046121ed8 done  
Copying config f2a976f932 done  
Writing manifest to image destination
Storing signatures
Error: rootlessport cannot expose privileged port 80, you can add 'net.ipv4.ip_unprivileged_port_start=80' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen tcp 0.0.0.0:80: bind: permission denied

普通用户可以映射>= 1024的端口

[abc@localhost ~]$ podman run -d -p 1024:80 httpd
a0aea79862261a91acee38482d05d3252537c4faf1ac677620eaaa4a49d913cd
[abc@localhost ~]$ ss -antl
State   Recv-Q  Send-Q   Local Address:Port     Peer Address:Port  Process  
LISTEN  0       128            0.0.0.0:80            0.0.0.0:*              
LISTEN  0       128            0.0.0.0:22            0.0.0.0:*              
LISTEN  0       128               [::]:22               [::]:*              
LISTEN  0       128                  *:1024                *:*

在 root 用户下配置echo ‘net.ipv4.ip_unprivileged_port_start=80’ >> /etc/sysctl.conf后可以映射大于等于 80 的端口

[root@localhost ~]# vim  
net.ipv4.ip_unprivileged_port_start=80		//添加此行

[root@localhost ~]# sysctl -p
net.ipv4.ping_group_range = 0 200000
user.max_user_namespaces = 15000
net.ipv4.ip_unprivileged_port_start = 80

[abc@localhost ~]$ podman run -d -p 81:80 httpd
c7f8171cd8a4ca3e71fc505d86ae9dd3e19387b85277db6d4649e4dcbb3fa3b9
Cristal.木
关注
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值