podman basic

1
2
3
4

pacman -S podman
# 提示选择 crun, runc, 选 crun
# netavark aardvark-dns 会默认安装
# 正常情况，安装 podman 之后不需要重启系统, 但是如果有异常，比如 CNI 之类 的问题，可以考虑重启一下...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

sudo apt-get -y update
sudo apt-get -y install podman

# ------
. /etc/os-release
echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/ /" | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/Release.key | sudo apt-key add -

sudo apt-get update
sudo apt-get -y upgrade
sudo apt-get -y install podman

1

dnf install podman

1

sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm

1

sudo dnf config-manager --set-enabled PowerTools

1
2
3
4
5
6

sudo dnf -y update
sudo systemctl reboot

sudo dnf module list | grep container-tools
sudo dnf install -y @container-tools
podman version

1
2

podman run --rm hello-world
# 能打印 Hello from Docker! 就是成功了

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

podman version
podman info --debug

podman ps

# 按名字过滤
podman ps -f  name=zookeeper

# 显示指定的列
podman ps -a --format "{{.ID}} {{.Names}}"

# 查看元数据, env, volume...
sudo podman inspect postgres

# 查看一部分元数据
sudo podman inspect --format "{{.Mounts}}" postgres

podman ps -a
podman inspect -l

podman top <container_id>
podman container checkpoint <container_id>
podman container restore <container_id>

podman stop --latest
podman rm --latest
podman --log-level=debug pull dockerhub.azk8s.cn/library/golang

# 显示虚悬镜像(dangling image)
podman image ls -f dangling=true

# 删除无效镜像
podman image prune

1

podman run --rm hello-world env

1

podman stats

1
2
3
4
5

vim /etc/containers/storage.conf
[storage]

# Default Storage Driver, Must be set for proper operation.
driver = "overlay2"

1
2

podman logs --since 1m -f conter_id_0
podman logs --latest

1
2
3
4
5
6
7
8

vim /etc/containers/registries.conf

# content
unqualified-search-registries = ["docker.io"]

[[registry]]
prefix = "docker.io"
location = "registry-1.docker.io"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

# 例：使用 podman pull registry.access.redhat.com/ubi8-minimal 时，
# 仅仅会从registry.access.redhat.com去获取镜像。
# 如果直接使用 podman pull ubuntu 时，没有明确指明仓库的时候，使用以下配置的仓库顺序去获取
unqualified-search-registries = ["docker.io", "registry.access.redhat.com"]
 
# 配置仓库的地址，可以直接在location里配置国内镜像例如：docker.mirrors.ustc.edu.cn
# 直接在location里配置的时候，可以不需要后面的 [[registry.mirror]] 内容，
# 但是这样只能配置一个镜像地址，这个镜像挂了就没法尝试其它镜像
[[registry]]
prefix = "docker.io"
location = "docker.io"
 
# 在这里可以配置多个镜像地址，前提是至少有一个[[registry]]配置。
# 需要注意的是，无论 unqualified-search-registries 选择了哪个仓库，
# 都会先从这里的上下顺序开始去拉取镜像，最后才会去匹配上 prefix 的 [[registry]]
# 配置的 location 位置拉取镜像。所以这里需要注意，上面配置的不同仓库类型，这里配置的镜像并不
# 能是通用的，所以 unqualified-search-registries 配置了多个仓库的时候，就最好直接使用
# [[registry]] 的 location 指定镜像地址，不要配置 [[registry.mirror]] 了。
# redhat 的国内镜像暂未发现。
[[registry.mirror]]
location = "docker.mirrors.ustc.edu.cn"
[[registry.mirror]]
location = "registry.docker-cn.com"

1
2
3
4
5
6

[registries.search]
registries = ['docker-registries.wiloon.com']
[registries.insecure]
registries = ['docker-registries.wiloon.com']
[registries.block]
registries = []

1
2
3
4
5
6
7
8

unqualified-search-registries = ["docker.io"]
[[registry]]
prefix = "docker.io"
location = "******.mirror.aliyuncs.com"

[[registry-insecure]]
prefix = "docker.io"
location = "docker-registries.wiloon.com"

1
2
3
4

unqualified-search-registries = ["docker.io"]
[[registry]]
prefix = "docker.io"
location = "xxxxxx.mirror.aliyuncs.com"

1
2
3
4
5
6
7
8

podman run \
-d \
--name name0 \
-p 2000:80/tcp \
-v /etc/localtime:/etc/localtime:ro \
--memory=2g \
--cpus=1 \
image0_name

1
2
3
4
5
6
7

# 容器名跟服务名一致
export service_name=foo
podman generate systemd $service_name > /usr/lib/systemd/system/$service_name.service
# enable service
systemctl enable $service_name
# enable and start service
systemctl --now enable $service_name

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

yay -S podlet

mkdir -p /etc/containers/systemd/

podlet podlet podman run -d --name bitwarden -v bitwarden-data:/data/ -p 8000:80 vaultwarden/server:1.28.1-alpine > /etc/containers/systemd/bitwarden.container

# content
# bitwarden.container
[Container]
ContainerName=bitwarden
Image=vaultwarden/server:1.28.1-alpine
PublishPort=8000:80
Volume=bitwarden-data:/data/

[Install]
WantedBy=multi-user.target default.target

systemctl daemon-reload
systemctl start bitwarden

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

podman network create --driver bridge net0
podman network create --driver bridge \
--subnet 172.22.16.0/24 \
--gateway 172.22.16.1 net0

podman network ls
podman network inspect net0

podman run -it --network=net0 busybox
# 指定ip
podman run -it --network=net0 --ip 172.22.16.8 busybox

1
2
3
4

podman volume ls
podman volume create volume0
podman volume rm volume0
podman volume volume0

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# backup
podman run --rm \
  --volume volume0:/tmp \
  --volume $(pwd):/backup \
  alpine \
  tar cvf /backup/volume0.tar /tmp

# restore
podman run --rm \
  --volume volume0:/tmp \
  --volume $(pwd):/backup \
  alpine \
  tar xvf /backup/volume0.tar -C /tmp --strip 1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

#!/bin/sh
workdir=/data/bitwarden/backup
find $workdir -mtime +30 -type f -name "*.*" -exec rm -f {} \;

timestamp=$(date '+%Y%m%d%H%M%S')
filename=bitwarden-data-${timestamp}.tar 

container_path=/backup
podman run --rm \
  --volume bitwarden-data:/tmp \
  --volume $workdir:$container_path \
  alpine \
  tar cvf $container_path/$filename /tmp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

workdir=/data/bitwarden/backup
find $workdir -mtime +30 -type f -name "*.*" -exec rm -f {} \;

timestamp=$(date '+%Y%m%d%H%M%S')
filename=bitwarden-data-${timestamp}.tar 

container_path=/backup

docker run --rm \
  --volume bitwarden-data:/tmp \
  --volume $workdir:$container_path \
  alpine \
  tar xvf $container_path/$filename -C /tmp --strip 1

1
2
3
4
5
6
7

podman pod --help
podman pod create --help
podman pod ps
podman pod rm pod0

podman pod create -n pod_0 -p 8086:8086 -p 3000:3000 -p 8888:8888
# 使用pod, 端口映射要配置到pod上，pod内的容器不配端口

1

podman run -d --pod pod_name_0 influxdb

1
2
3
4
5
6
7
8
9

pacman  -S crun
usr/share/containers/libpod.conf -- runtime="crun"

sudo touch /etc/subuid
sudo touch /etc/subgid
sudo usermod --add-subuids 10000-65536 user0
sudo usermod --add-subgids 10000-65536 user0
getcap /usr/bin/newuidmap
getcap /usr/bin/newgidmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# docker network create -d macvlan --subnet=172.16.10.0/24 --gateway=172.16.10.1 -o parent=enp0s8 mac1
podman network create \
--subnet=192.168.50.0/24 \
--gateway=192.168.50.1 \
--macvlan=enp1s0 mac1

-d 指定 Docker 网络 driver
--subnet 指定 macvlan 网络所在的网络
--gateway 指定网关
-o parent 指定用来分配 macvlan 网络的物理网卡
 cat /etc/cni/net.d/mac1.conflist

1

podman run -itd --name c1 --ip=192.168.50.99 --network mac1 busybox

1
2
3

podman images -a
podman image prune
podman image rm image-id-0

1
2

podman unshare cat /proc/self/uid_map
unshare -U

1

podman system reset

1

podman history image0

1

podman ps -a -f "status=exited"

1
2
3
4

# 如果执行 podman save 时磁盘上已经存在 kafka.tar 会提示: docker-archive doesn't support modifying existing images
# --format=docker-archiv, podman save 保存成兼容 docker 的文件格式
sudo podman save --format=docker-archive -o kafka.tar 5701259bb69a bitnami/kafka:3.4.0
podman save be96e19ac6ef > pingd-proxy.tar

1
2
3
4
5
6

podman run \
-d \
--name foo \
-p 1234:80 \
-v /etc/localtime:/etc/localtime:ro \
project0:0.0.1

1
2
3
4
5

sudo pacman -S podman-compose

podman-compose --help
podman-compose up --help
podman-compose up