podman容器的网络&开机自启
podman网络
在没有运行过容器的时候,本机是没有podman0这个网卡的,一旦运行过容器不管这个容器是否存在或者状态如何这个网卡依旧存在,而docker是docker守护进程一起动就会有一个docker0的网卡,默认情况下这个网卡的IP地址是所有容器的网关地址
查看没有运行过容器时podman网络的状态
[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:9e:92:e1 brd ff:ff:ff:ff:ff:ff
inet 192.168.164.141/24 brd 192.168.164.255 scope global dynamic noprefixroute ens160
valid_lft 1717sec preferred_lft 1717sec
inet6 fe80::d68f:1be3:2ad4:4605/64 scope link noprefixroute
valid_lft forever preferred_lft forever
运行过一个容器过后,就会出现podman0这个网卡
[root@localhost ~]# podman run -d --name httpd docker.io/library/httpd
[root@localhost ~]# podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
c7c39352b2e9 docker.io/library/httpd:latest httpd-foreground About a minute ago Up About a minute ago httpd
//查看ip
[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:a7:ed:84 brd ff:ff:ff:ff:ff:ff
inet 192.168.164.141/24 brd 192.168.164.255 scope global dynamic noprefixroute ens160
valid_lft 1797sec preferred_lft 1797sec
inet6 fe80::b7d8:f396:bd33:bc34/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: cni-podman0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 86:73:1d:74:1d:34 brd ff:ff:ff:ff:ff:ff
inet 10.88.0.1/16 brd 10.88.255.255 scope global cni-podman0
valid_lft forever preferred_lft forever
inet6 fe80::8473:1dff:fe74:1d34/64 scope link
valid_lft forever preferred_lft forever
4: vetha777c1a9@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master cni-podman0 state UP group default
link/ether e2:b9:bf:61:ac:66 brd ff:ff:ff:ff:ff:ff link-netns cni-1e4e81ac-ad29-47b2-8dc4-abc02efbb892
inet6 fe80::e0b9:bfff:fe61:ac66/64 scope link
valid_lft forever preferred_lft forever
//关闭容器,cni-podman0网卡依然在
[root@localhost ~]# podman stop httpd
httpd
[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:a7:ed:84 brd ff:ff:ff:ff:ff:ff
inet 192.168.164.141/24 brd 192.168.164.255 scope global dynamic noprefixroute ens160
valid_lft 1363sec preferred_lft 1363sec
inet6 fe80::b7d8:f396:bd33:bc34/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: cni-podman0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 86:73:1d:74:1d:34 brd ff:ff:ff:ff:ff:ff
inet 10.88.0.1/16 brd 10.88.255.255 scope global cni-podman0
valid_lft forever preferred_lft forever
inet6 fe80::8473:1dff:fe74:1d34/64 scope link
valid_lft forever preferred_lft forever
//删除容器,查看cni-podman0网卡
[root@localhost ~]# podman rm -l
c7c39352b2e9f9952ae62936c3e5e0225d8e93b7b7b3b1204b3577d3922dbe52
[root@192 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:a7:ed:84 brd ff:ff:ff:ff:ff:ff
inet 192.168.164.141/24 brd 192.168.164.255 scope global dynamic noprefixroute ens160
valid_lft 1293sec preferred_lft 1293sec
inet6 fe80::b7d8:f396:bd33:bc34/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: cni-podman0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 86:73:1d:74:1d:34 brd ff:ff:ff:ff:ff:ff
inet 10.88.0.1/16 brd 10.88.255.255 scope global cni-podman0
valid_lft forever preferred_lft forever
inet6 fe80::8473:1dff:fe74:1d34/64 scope link
valid_lft forever preferred_lft forever
podman容器的开机自启
root用户
//创建一个容器
[root@localhost ~]# podman create --name nginx nginx:latest
67dbffd980c2a0f1fd13a1ab523936cf6878998684f819c8946190a400c6eee1
[root@localhost ~]# podman ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
67dbffd980c2 docker.io/library/nginx:latest nginx -g daemon o... 6 seconds ago Created nginx
//生成service文件
[root@localhost ~]# podman generate systemd --new --files --name nginx
/root/container-nginx.service
[root@localhost ~]# ls
anaconda-ks.cfg container-nginx.service
//放入/usr/lib/systemd/system/路径下
[root@localhost ~]# mv container-nginx.service /usr/lib/systemd/system/
//查看状态
[root@localhost ~]# systemctl status container-nginx
● container-nginx.service - Podman container-nginx.service
Loaded: loaded (/usr/lib/systemd/system/container-nginx.service; disabled>
Active: inactive (dead)
Docs: man:podman-generate-systemd(1)
//启动服务
[root@localhost ~]# systemctl enable --now container-nginx
[root@localhost ~]# systemctl status container-nginx
● container-nginx.service - Podman container-nginx.service
Loaded: loaded (/usr/lib/systemd/system/container-nginx.service; enabled;>
Active: active (running) since Tue 2021-12-14 18:40:28 CST; 37s ago
Docs: man:podman-generate-systemd(1)
Process: 2566 ExecStartPre=/bin/rm -f /run/container-nginx.service.ctr-id >
Main PID: 2672 (conmon)
Tasks: 3 (limit: 12322)
Memory: 5.3M
CGroup: /system.slice/container-nginx.service
├─2607 /usr/bin/fuse-overlayfs -o metacopy=on,lowerdir=/var/lib/c>
└─2672 /usr/bin/conmon --api-version 1 -c 42ceb83e2a917c73991cbb7>
Dec 14 18:40:28 localhost.localdomain systemd[1]: Starting Podman container->
Dec 14 18:40:28 localhost.localdomain podman[2568]: 67dbffd980c2a0f1fd13a1ab>
Dec 14 18:40:28 localhost.localdomain systemd[1]: Started Podman container-n>
Dec 14 18:40:28 localhost.localdomain podman[2568]: 42ceb83e2a917c73991cbb75>
lines 1-16/16 (END)
//查看容器状态
[root@localhost ~]# podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
42ceb83e2a91 docker.io/library/nginx:latest nginx -g daemon o... About a minute ago Up About a minute ago nginx
非根用户容器设置开机自启
非根用户 就是普通用户
注意:请使用普通用户以SSH形式远程登录系统,否则中途容器在生成服务的时候会出现错误
//给普通用户设置密码
[root@localhost ~]# echo 'wjm123' | passwd --stdin wjm
# 更改用户wjm的密码为wjm123 。
//ssh登录
[root@localhost ~]# ssh wjm@192.168.164.141
The authenticity of host '192.168.164.141 (192.168.164.141)' can't be established.
ECDSA key fingerprint is SHA256:xO8Rw6Y2+7i7JHav8GQJEkzSO2U7PIvJIHSrtYzSE/o.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.164.141' (ECDSA) to the list of known hosts.
wjm@192.168.164.141's password:
Last login: Wed Dec 15 03:24:42 2021
[wjm@localhost ~]$ podman login docker.io
Username: wjm1734321
Password:
Login Succeeded!
[wjm@localhost ~]$ podman run -d --name httpd -p 8080:8080 docker.io/library/httpd
d9c513f7d5d8c59bbffe6a21cc46155962eea689dbda45bfbbd46fcc7f25eed5
[wjm@localhost ~]$ podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
d9c513f7d5d8 docker.io/library/httpd:latest httpd-foreground 27 seconds ago Up 27 seconds ago 0.0.0.0:8080->8080/tcp httpd
//必须在用户家目录创建此目录,不能更改名字
[wjm@localhost ~]$ mkdir -p ~/.config/systemd/user
[wjm@localhost ~]$ cd ~/.config/systemd/user/
[wjm@localhost user]$ ls
#此时目录为新创建,是空的
//注意当前所在路径,使用podman生成系统服务(依照当前容器自动生成)
[wjm@localhost user]$ podman generate systemd --name httpd --files --new
/home/wjm/.config/systemd/user/container-httpd.service
[wjm@localhost user]$ ls
container-httpd.service
//关闭容器
[wjm@localhost user]$ podman stop httpd
httpd
[wjm@localhost user]$ podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
//加载一下系统服务
[wjm@localhost user]$ systemctl --user daemon-reload
//立即启用服务
[wjm@localhost user]$ systemctl --user enable container-httpd.service --now
Created symlink /home/wjm/.config/systemd/user/multi-user.target.wants/container-httpd.service → /home/wjm/.config/systemd/user/container-httpd.service.
Created symlink /home/wjm/.config/systemd/user/default.target.wants/container-httpd.service → /home/wjm/.config/systemd/user/container-httpd.service.
//查看服务的状态,已经处于运行状态
[wjm@localhost user]$ systemctl --user status container-httpd.service
● container-httpd.service - Podman container-httpd.service
Loaded: loaded (/home/wjm/.config/systemd/user/container-httpd.service; enabled; vendor preset:>
Active: active (running) since Wed 2021-12-15 04:16:49 CST; 1min 2s ago
Docs: man:podman-generate-systemd(1)
Process: 156584 ExecStartPre=/bin/rm -f /run/user/1000/container-httpd.service.ctr-id (code=exi>
Main PID: 156666 (conmon)
CGroup: /user.slice/user-1000.slice/user@1000.service/container-httpd.service
├─156646 /usr/bin/fuse-overlayfs -o ,lowerdir=/home/wjm/.local/share/containers/storage>
├─156647 /usr/bin/slirp4netns --disable-host-loopback --mtu=65520 --enable-sandbox --e>
├─156651 containers-rootlessport
├─156657 containers-rootlessport-child
├─156666 /usr/bin/conmon --api-version 1 -c 1bffe49cb00a11ee8d4a4ae8b21ae73f442c0e76c3>
├─156669 httpd -DFOREGROUND
├─156692 httpd -DFOREGROUND
├─156693 httpd -DFOREGROUND
└─156694 httpd -DFOREGROUND
//此时查看是否有容器在运行,本来我们已经手动关闭,但只要服务启动,就会自动创建新的容器,只要服务关闭,该容器就会自动删除,非常人性化
#而且此服务不需要root或sudo提权,普通用户即可对其进行控制,使用systemctl命令
[wjm@localhost user]$ podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
1bffe49cb00a docker.io/library/httpd:latest httpd-foreground About a minute ago Up About a minute ago 0.0.0.0:8080->8080/tcp httpd
//服务关闭,容器自动删除,而且还可以做到开机自动创建,关机自动删除
[wjm@localhost user]$ systemctl --user stop container-httpd.service
[wjm@localhost user]$ podman ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
[wjm@localhost user]$ systemctl --user start container-httpd.service
[wjm@localhost user]$ podman ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
6616be7602ed docker.io/library/httpd:latest httpd-foreground 4 seconds ago Up 4 seconds ago 0.0.0.0:8080->8080/tcp httpd