使用 Podman

最新推荐文章于 2025-04-23 16:24:33 发布

著名抢人头选手

最新推荐文章于 2025-04-23 16:24:33 发布

阅读量1.1k

点赞数

文章标签： docker 运维 linux

本文链接：https://blog.youkuaiyun.com/weixin_72901306/article/details/126356400

版权

本文介绍了 Podman 的使用，包括如何运行和管理容器，配置别名以兼容 Docker，以及非 root 用户的权限设置。内容涵盖 Podman 的基本命令如 `podman run` 和 `podman ps`，用户操作如配置 `/etc/subuid` 和 `/etc/subgid`，以及容器存储卷和端口映射。此外，还讨论了在非特权用户环境下使用 Podman 的注意事项，如 cgroup V2、slirp4netns 和 fuse-overlayfs 的安装，以及如何启用非特权 ping 功能。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

使用 Podman

使用 Podman 非常的简单，Podman 的指令跟 Docker 大多数都是相同的。下面我们来看几个常用的例子：

运行一个容器

podman run d –name httpd docker.io/library/httpd //运行一个容器

[root@localhost ~]#  podman run -d --name httpd docker.io/library/httpd
Trying to pull docker.io/library/httpd:latest...
Getting image source signatures
Copying blob 1efc276f4ff9 done  
Copying blob aed046121ed8 done  
Copying blob 80e368ef21fc done  
Copying blob 4340e7be3d7f done  
Copying blob 80cb79a80bbe done  
Copying config f2a976f932 done  
Writing manifest to image destination
Storing signatures
87c8f6d682da1bc768ec923f5ffc938880da80369685c0ab56f4b28f6790d5da
[root@localhost ~]# 
查看镜像
docker.io/library/httpd         latest      f2a976f932ec  13 days ago    149 MB

podman ps //列出运行的容器

[root@localhost ~]# podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS       NAMES
87c8f6d682da  docker.io/library/httpd:latest  httpd-foreground  3 minutes ago  Up 3 minutes ago              httpd
[root@localhost ~]#

注意：如果在ps命令中添加-a，Podman 将显示所有容器。

检查正在运行的容器

您可以“检查”正在运行的容器的元数据和有关其自身的详细信息。我们甚至可以使用 inspect 子命令查看分配给容器的 IP 地址。由于容器以无根模式运行，因此未分配 IP 地址，并且该值将在检查的输出中列为“无”。

podman inspect l| grep i address //使用 inspect 子命令查看分配给容器的 IP 地址

[root@localhost ~]# podman inspect -l| grep -i address
            "IPAddress": "10.88.0.2",
            "GlobalIPv6Address": "",
            "MacAddress": "c6:22:60:ac:e3:67",
            "LinkLocalIPv6Address": "",
                    "IPAddress": "10.88.0.2",
                    "GlobalIPv6Address": "",
                    "MacAddress": "c6:22:60:ac:e3:67",
[root@localhost ~]# curl 10.88.0.2
<html><body><h1>It works!</h1></body></html>
[root@localhost ~]#

注意：-l 是最新容器的便利参数。您还可以使用容器的 ID 代替 -l。

查看一个运行中容器的日志

选项
  --latest    #最近的
[root@localhost ~]# podman logs --latest
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.2. Set the 'ServerName' directive globally to suppress this message
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.2. Set the 'ServerName' directive globally to suppress this message
[Mon Aug 15 12:00:01.088281 2022] [mpm_event:notice] [pid 1:tid 140034235927872] AH00489: Apache/2.4.54 (Unix) configured -- resuming normal operations
[Mon Aug 15 12:00:01.088617 2022] [core:notice] [pid 1:tid 140034235927872] AH00094: Command line: 'httpd -D FOREGROUND'
10.88.0.1 - - [15/Aug/2022:12:05:28 +0000] "GET / HTTP/1.1" 200 45
[root@localhost ~]#

查看一个运行容器中的进程资源使用情况，可以使用top观察容器中的 nginx pid

语法：

[root@localhost ~]# podman top httpd
USER        PID         PPID        %CPU        ELAPSED          TTY         TIME        COMMAND
root        1           0           0.000       8m52.932781729s  ?           0s          httpd -DFOREGROUND 
www-data    7           1           0.000       8m52.932905865s  ?           0s          httpd -DFOREGROUND 
www-data    8           1           0.000       8m52.932993084s  ?           0s          httpd -DFOREGROUND 
www-data    9           1           0.000       8m52.933076665s  ?           0s          httpd -DFOREGROUND 
[root@localhost ~]#

停止一个运行中的容器

[root@localhost ~]# podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED         STATUS             PORTS       NAMES
87c8f6d682da  docker.io/library/httpd:latest  httpd-foreground  12 minutes ago  Up 12 minutes ago              httpd
[root@localhost ~]# 
[root@localhost ~]# podman stop --latest
87c8f6d682da1bc768ec923f5ffc938880da80369685c0ab56f4b28f6790d5da
[root@localhost ~]#  podman ps
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
[root@localhost ~]#

删除一个容器

[root@localhost ~]# podman ps -a
CONTAINER ID  IMAGE                           COMMAND           CREATED         STATUS                     PORTS       NAMES
87c8f6d682da  docker.io/library/httpd:latest  httpd-foreground  13 minutes ago  Exited (0) 10 seconds ago              httpd
[root@localhost ~]# podman rm -f --latest
87c8f6d682da1bc768ec923f5ffc938880da80369685c0ab56f4b28f6790d5da
[root@localhost ~]# podman ps -a
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
[root@localhost ~]#

以上这些特性基本上都和 Docker 一样，Podman 除了兼容这些特性外，还支持了一些新的特性。

上传镜像

例如，如果我们想在 http://docker.io 上分享我们新建的 Nginx 容器镜像，这很容易。首先登录码头:

总而言之，Podman 使查找、运行、构建和共享容器变得容易。

配置别名

如果习惯了使用 Docker 命令，可以直接给 Podman 配置一个别名来实现无缝转移。你只需要在 .bashrc 下加入以下行内容即可:

用户操作

在允许没有root特权的用户运行Podman之前，管理员必须安装或构建Podman并完成以下配置

cgroup V2Linux内核功能允许用户限制普通用户容器可以使用的资源，如果使用cgroupV2启用了运行Podman的Linux发行版，则可能需要更改默认的OCI运行时。某些较旧的版本runc不适用于cgroupV2，必须切换到备用OCI运行时crun。

[root@localhost ~]# yum -y install crun
[root@localhost ~]# vim /usr/share/containers/containers.conf
# Default OCI runtime
#
runtime = "crun" //取消注释
#runtime = "runc" //runc注释
[root@localhost ~]# podman run -d --name web -p 80:80 docker.io/libra
ry/nginx
Trying to pull docker.io/library/nginx:latest...
Getting image source signatures
[root@localhost ~]# podman run -d --name web -p 80:80 docker.io/library/nginx
Trying to pull docker.io/library/nginx:latest...
Getting image source signatures
Copying blob 1efc276f4ff9 skipped: already exists  
Copying blob 6a17c8e7063d done  
Copying blob 05396a986fd3 done  
Copying blob baf2da91597d done  
Copying blob b1349eea8fc5 done  
Copying blob 27e0d286aeab done  
Copying config b692a91e4e done  
Writing manifest to image destination
Storing signatures
c9cce6cf2feb465ad6ecfcf2e7b38fb357b050eb20ce1e37423d2e728eb72b51
[root@localhost ~]#  podman inspect web | grep crun
        "OCIRuntime": "crun",
            "crun",
[root@localhost ~]#

安装slirp4netns和fuse-overlayfs

在普通用户环境中使用Podman时，建议使用fuse-overlayfs而不是VFS文件系统，至少需要版本0.7.6。现在新版本默认就是了。

[root@localhost ~]# yum -y install slirp4netns
[root@localhost ~]# yum -y install fuse-overlayfs
[root@localhost ~]# vim /etc/containers/storage.conf
mount_program = "/usr/bin/fuse-overlayfs" //取消注释

/ etc / subuid和/ etc / subgid配置
Podman要求运行它的用户在/ etc / subuid和/ etc / subgid文件中列出一系列UID,shadowutils或
newuid包提供这些文件

[root@localhost ~]# useradd hh
[root@localhost ~]# cat /etc/subuid
hh:100000:65536
[root@localhost ~]# cat /etc/subuid
hh:100000:65536
[root@localhost ~]# sysctl -w "net.ipv4.ping_group_range=0 200000"
net.ipv4.ping_group_range = 0 200000
[root@localhost ~]#

这个文件的格式是 USERNAME:UID:RANGE中/etc/passwd或输出中列出的用户名getpwent。
为用户分配的初始 UID。
为用户分配的 UID 范围的大小。
该usermod程序可用于为用户分配 UID 和 GID，而不是直接更新文件。

[root@localhost ~]# usermod --add-subuids 200000-201000 --add-subgids 200000-201000 hh
[root@localhost ~]# cat /etc/subuid
hh:100000:65536
hh:200000:1001
[root@localhost ~]#

用户配置文件
三个主要的配置文件是container.conf、storage.conf和registries.conf。用户可以根据需要修改这些
文件。
container.conf

[root@localhost ~]# cat /usr/share/containers/containers.conf
# The containers configuration file specifies all of the available configuration
# command-line options/flags for container engine tools like Podman & Buildah,
# but in a TOML format that can be easily modified and versioned.

# Please refer to containers.conf(5) for details of all configuration options.
# Not all container engines implement all of the options.
# All of the options have hard coded defaults and these options will override
# the built in defaults. Users can then override these options via the command
# line. Container engines will read containers.conf files in up to three
# locations in the following order:
#  1. /usr/share/containers/containers.conf
#  2. /etc/containers/containers.conf
#  3. $HOME/.config/containers/containers.conf (Rootless containers ONLY)
#  Items specified in the latter containers.conf, if they exist, override the
# previous containers.conf settings, or the default settings.

[containers]

# List of annotation. Specified as
# "key = value"
# If it is empty or commented out, no annotations will be added
#
#annotations = []

# Used to change the name of the default AppArmor profile of container engine.
#
#apparmor_profile = "container-default"

# Default way to to create a cgroup namespace for the container
# Options are:
# `private` Create private Cgroup Namespace for the container.
# `host`    Share host Cgroup Namespace with the container.
#
#cgroupns = "private"

# Control container cgroup configuration
# Determines  whether  the  container will create CGroups.
# Options are:
# `enabled`   Enable cgroup support within container
# `disabled`  Disable cgroup support, will inherit cgroups from parent
# `no-conmon` Do not create a cgroup dedicated to conmon.
#
#cgroups = "enabled"

# List of default capabilities for containers. If it is empty or commented out,
# the default capabilities defined in the container engine will be added.
#
default_capabilities = [
    "NET_RAW",
  "CHOWN",
  "DAC_OVERRIDE",
  "FOWNER",
[root@localhost ~]# cat /etc/containers/containers.conf
[root@localhost ~]# cat ~/.config/containers/containers.conf //优先级最
高

如果它们以该顺序存在。每个文件都可以覆盖特定字段的前一个文件。
配置storage.conf文件

# /usr/share/containers/containers.conf
# /etc/containers/containers.conf
# $HOME/.config/containers/containers.conf #优先级最高

如果它们以该顺序存在。每个文件都可以覆盖特定字段的前一个文件。
storage.conf

# /etc/containers/storage.conf
# $HOME/.config/containers/storage.conf

在普通用户机中， /etc/containers/storage.conf 中某些字段将被忽略。

[root@localhost ~]# vi /etc/containers/storage.conf
[storage]
# Default Storage Driver, Must be set for proper operation.
driver = "overlay" #此处改为overlay
.......
mount_program = "/usr/bin/fuse-overlayfs" #取消注释
[root@localhost ~]# sysctl user.max_user_namespaces=15000 
user.max_user_namespaces = 15000
#
如果版本为8
以下，则需要做以下操作：

在普通用户中，这些字段默认为

graphroot="$HOME/.local/share/containers/storage"
runroot="$XDG_RUNTIME_DIR/containers"

registries.conf
配置按此顺序读入,这些文件不是默认创建的,可以从 /usr/share/containers 或复制文件
/etc/containers
并进行修改。

# /etc/containers/registries.conf
# /etc/containers/registries.d/*
# HOME/.config/containers/registries.conf

授权文件

podman login 和 podman logout 命令使用的默认授权文件位于中
${XDG_RUNTIME_DIR}/containers/auth.json 。
//使用root用户登录官网

[root@localhost ~]# podman login
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
Username: hh08042
Password: 
Login Succeeded!
[root@localhost ~]# find / -name auth.json
/run/user/0/containers/auth.json
[root@localhost ~]# cat /run/user/0/containers/auth.json
{
	"auths": {
		"docker.io": {
			"auth": "aGgwODA0MjpoY3kwODA0MmRk"
		}
	}
}[root@localhost ~]#

启用非特权 ping
在非特权容器中运行的用户可能无法使用该 ping 容器中的实用程序。
如果需要这样做，管理员必须验证用户的UID是否在 /proc/sys/net/ipv4/ping_group_range 文件范围
内。
要更改其值，管理员可以使用类似于的呼叫 sysctl w “net.ipv4.ping_group_range=0 2000000” 。
为了使更改持久存在，管理员将需要添加一个文件 .conf 扩展名， /etc/sysctl.conf 其中包含
net.ipv4.ping_group_range=0 ，该文件MAX_GID 是运行容器的用户的最高可分配GID。

[root@localhost ~]# vim /etc/sysctl.conf
net.ipv4.ping_group_range=0 2000000 #添加一行写入，大于100000这个就表示tom可
以操作podman

[root@localhost ~]# sysctl -p
net.ipv4.ping_group_range = 0 2000000
[root@localhost ~]#

Podman存储卷

容器与root用户一起运行，则root容器中的用户实际上就是主机上的用户。
UID GID是在/etc/subuid和/etc/subgid等中用户映射中指定的第一个UID GID。
如果普通用户的身份从主机目录挂载到容器中，并在该目录中以根用户身份创建文件，则会看到
它实际上是你的用户在主机上拥有的。
使用卷

[root@localhost ~]# su - hh
[hh@localhost ~]$ pwd
/home/hh
[hh@localhost ~]$ ls
[hh@localhost ~]$ mkdir data 
[hh@localhost ~]$ cd data/
[hh@localhost data]$ pwd
/home/hh/data
[hh@localhost data]$ podman login
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
Username: hh08042
Password: 
Login Succeeded!
[hh@localhost data]$ podman run -it -v /home/hh/data/:/data:Z busybox /bin/sh
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
Resolved "busybox" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/busybox:latest...
Getting image source signatures
Copying blob 50783e0dfb64 done  
Copying config 7a80323521 done  
Writing manifest to image destination
Storing signatures
/ # ls
bin   data  dev   etc   home  proc  root  run   sys   tmp   usr   var
/ # cd data/
/data # ls
/data # touch h c y
/data # ls
c  h  y
/data #

在主机上查看

[hh@localhost data]$ ls
c  h  y

//写入文件

[hh@localhost data]$ echo leg > y
[hh@localhost data]$ cat y
leg
[hh@localhost data]$

容器里查看

[hh@localhost data]$ podman run -it -v /home/hh/data/:/data:Z busybox /bin/sh
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
/ # cd data/
/data # ls
c  h  y
/data # cat y
leg
/data #

配置echo ‘net.ipv4.ip_unprivileged_port_start=80’ >> /etc/sysctl.conf后可以映射大于等于80的端口

[root@localhost ~]# echo 'net.ipv4.ip_unprivileged_port_start=80' >> /etc/sysctl.conf
[root@localhost ~]# sysctl -p
net.ipv4.ping_group_range = 0 2000000
net.ipv4.ip_unprivileged_port_start = 80
[root@localhost ~]#

[hh@localhost ~]$ podman run -it --name leg -v "$(pwd)"/data:/data:Z --userns=keep-id docker.io/library/busybox:latest /bin/sh
~ $ cd data/
/data $ ls -l
total 4
-rw-r--r--    1 hh       hh               0 Aug 15 13:10 c
-rw-r--r--    1 hh       hh               0 Aug 15 13:10 h
-rw-r--r--    1 hh       hh               4 Aug 15 13:12 y
/data $

使用普通用户映射容器端口时会报“ permission denied”的错误

[hh@localhost ~]$ podman run -d -p 80:80 httpd
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
Error: rootlessport Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
listen tcp 0.0.0.0:80: bind: address already in use
[hh@localhost ~]$

普通用户可以映射>= 1024的端口

[hh@localhost ~]$ podman run -d -p 1024:80 httpd
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
ffa6b8688640e4047bd5a3f3a2739d096a5fd7e26d96750841292b1a8088aef6
[hh@localhost ~]$ podman ps
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
Failed to read /etc/containers/storage.conf Near line 8 (last key parsed 'storage.driver'): expected value but found "overlay" instead
CONTAINER ID  IMAGE                           COMMAND           CREATED         STATUS             PORTS                 NAMES
ffa6b8688640  docker.io/library/httpd:latest  httpd-foreground  10 seconds ago  Up 10 seconds ago  0.0.0.0:1024->80/tcp  wizardly_gould
[hh@localhost ~]$

配置echo ‘net.ipv4.ip_unprivileged_port_start=80’ >> /etc/sysctl.conf后可以映射大于等于80的端口

[hh@localhost ~]$ podman run -d -p 80:80 httpd
7f6a1fffaff405679d8caaa770294628ca8c86efea379f39b8febe52d6759bed
[hh@localhost ~]$

//我们可以发现在容器里面的文件的属主和属组都属于root，那么如何才能让其属于tom用户呢？下面告诉你答案

/data # ls -l
total 4
-rw-r--r--    1 root     root             0 Aug 15 13:10 c
-rw-r--r--    1 root     root             0 Aug 15 13:10 h
-rw-r--r--    1 root     root             4 Aug 15 13:12 y
/data #