【Linux】Rocky Linux 9.0 Podman服务无法正常启动

        Rocky Linux 9.0发布后，我在本地虚拟机对该版本进行了安装和测试，发现Podman服务在某些情况下，无法正常启动。

        当/etc/selinux/config配置中，SELINUX=enforcing为默认配置的时候，启动Podman服务，会出现下面的报错。

[root@rocky-9 ~]# systemctl status podman.service 
× podman.service - Podman API Service
     Loaded: loaded (/usr/lib/systemd/system/podman.service; disabled; vendor preset: disabled)
     Active: failed (Result: exit-code) since Wed 2022-08-31 22:34:44 CST; 3min 44s ago
TriggeredBy: ● podman.socket
       Docs: man:podman-system-service(1)
    Process: 1675 ExecStart=/usr/bin/podman $LOGGING system service (code=exited, status=125)
   Main PID: 1675 (code=exited, status=125)
        CPU: 83ms

8月 31 22:34:44 rocky-9.0 systemd[1]: Starting Podman API Service...
8月 31 22:34:44 rocky-9.0 systemd[1]: Started Podman API Service.
8月 31 22:34:44 rocky-9.0 podman[1675]: time="2022-08-31T22:34:44+08:00" level=info msg="/usr/bin/podman filtering at log level info"
8月 31 22:34:44 rocky-9.0 podman[1675]: time="2022-08-31T22:34:44+08:00" level=info msg="Not using native diff for overlay, this may cause degraded performance for building images: kernel has CONFIG_OVERLAY>
8月 31 22:34:44 rocky-9.0 podman[1675]: Error: error opening "/etc/cni/net.d/cni.lock": permission denied
8月 31 22:34:44 rocky-9.0 systemd[1]: podman.service: Main process exited, code=exited, status=125/n/a
8月 31 22:34:44 rocky-9.0 systemd[1]: podman.service: Failed with result 'exit-code'.

发现此问题后，我第一时间上报问题到社区论坛

        从官方技术人员给的回复来看，是selinux导致了上面问题的出现，并且说这个问题可以通过更新container-selinux到2.179版本来解决。

        但是，时隔一个多月后，我再次测试，并将container-selinux升级到了2.189版本，此问题仍未能解决。

[root@rocky-9 ~]# rpm -qa container-selinux
container-selinux-2.189.0-1.el9.noarch

[root@rocky-9 net.d]# systemctl status podman.service
● podman.service - Podman API Service
     Loaded: loaded (/usr/lib/systemd/system/podman.service; disabled; vendor
preset: disabled)
     Active: active (running) since Wed 2022-08-31 16:33:33 CST; 1ms ago
TriggeredBy: ● podman.socket
       Docs: man:podman-system-service(1)
   Main PID: 45751 (podman)
      Tasks: 1 (limit: 50279)
     Memory: 492.0K
        CPU: 2ms
     CGroup: /system.slice/podman.service
             └─45751 /usr/bin/podman --log-level=info system service

8月 31 16:33:33 rocky-9.0 systemd[1]: Starting Podman API Service...
8月 31 16:33:33 rocky-9.0 systemd[1]: Started Podman API Service.

[root@rocky-9 net.d]# systemctl status podman.service
● podman.service - Podman API Service
     Loaded: loaded (/usr/lib/systemd/system/podman.service; disabled; vendor
preset: disabled)
     Active: active (running) since Wed 2022-08-31 16:33:50 CST; 243ms ago
TriggeredBy: ● podman.socket
       Docs: man:podman-system-service(1)
   Main PID: 47014
      Tasks: 2 (limit: 50279)
     Memory: 23.3M
        CPU: 272ms
     CGroup: /system.slice/podman.service

8月 31 16:33:50 rocky-9.0 systemd[1]: podman.service: Failed with result
'exit-code'.
8月 31 16:33:50 rocky-9.0 systemd[1]: Starting Podman API Service...
8月 31 16:33:50 rocky-9.0 systemd[1]: Started Podman API Service.
8月 31 16:33:50 rocky-9.0 podman[47014]: time="2022-08-31T16:33:50+08:00"
level=info msg="/usr/bin/podman filtering at log level info"
8月 31 16:33:50 rocky-9.0 podman[47014]: time="2022-08-31T16:33:50+08:00"
level=info msg="Not using native diff for overlay, this may cause degraded
performance for building images: kernel has CONFIG_OVERLA>
8月 31 16:33:50 rocky-9.0 podman[47014]: Error: error opening
"/etc/cni/net.d/cni.lock": permission denied
8月 31 16:33:50 rocky-9.0 systemd[1]: podman.service: Main process exited,
code=exited, status=125/n/a
8月 31 16:33:50 rocky-9.0 systemd[1]: podman.service: Failed with result
'exit-code'.

 目前，此问题只能通过将selinux设置为SELINUX=disabled，并重启系统的方式，才能暂时解决。

[root@rocky-9 ~]# systemctl status podman.service podman.socket
● podman.service - Podman API Service
     Loaded: loaded (/usr/lib/systemd/system/podman.service; disabled; vendor preset: disabled)
     Active: active (running) since Wed 2022-08-31 22:52:30 CST; 1min 15s ago
TriggeredBy: ● podman.socket
       Docs: man:podman-system-service(1)
   Main PID: 2161 (podman)
      Tasks: 12 (limit: 50279)
     Memory: 40.7M
        CPU: 693ms
     CGroup: /system.slice/podman.service
             └─2161 /usr/bin/podman --log-level=info system service

8月 31 22:53:12 rocky-9.0 podman[2161]: @ - - [31/Aug/2022:22:53:12 +0800] "GET /v1.12/libpod/containers/json?all=true HTTP/1.1" 200 1189 "" ""
8月 31 22:53:12 rocky-9.0 podman[2161]: @ - - [31/Aug/2022:22:53:12 +0800] "GET /v1.12/libpod/containers/json?all=true&filters=%7B%22id%22%3A%5B%22fc733bd336856e86c4a8944e902cae0b36877511a674612807d5ca5e05c>
8月 31 22:53:12 rocky-9.0 podman[2161]: @ - - [31/Aug/2022:22:53:12 +0800] "GET /v1.12/libpod/containers/json?all=true&filters=%7B%22id%22%3A%5B%22fc733bd336856e86c4a8944e902cae0b36877511a674612807d5ca5e05c>
8月 31 22:53:12 rocky-9.0 podman[2161]: @ - - [31/Aug/2022:22:53:12 +0800] "GET /v1.12/libpod/containers/fc733bd336856e86c4a8944e902cae0b36877511a674612807d5ca5e05c65309/json?size=false HTTP/1.1" 200 6637 ">
8月 31 22:53:12 rocky-9.0 podman[2161]: @ - - [31/Aug/2022:22:53:12 +0800] "GET /v1.12/libpod/containers/fc733bd336856e86c4a8944e902cae0b36877511a674612807d5ca5e05c65309/json?size=false HTTP/1.1" 200 6637 ">
8月 31 22:53:12 rocky-9.0 podman[2161]: @ - - [31/Aug/2022:22:53:12 +0800] "GET /v1.12/libpod/containers/fc733bd336856e86c4a8944e902cae0b36877511a674612807d5ca5e05c65309/json?size=false HTTP/1.1" 200 6637 ">
8月 31 22:53:12 rocky-9.0 podman[2161]: @ - - [31/Aug/2022:22:53:12 +0800] "GET /v1.12/libpod/containers/fc733bd336856e86c4a8944e902cae0b36877511a674612807d5ca5e05c65309/json?size=false HTTP/1.1" 200 6637 ">
8月 31 22:53:19 rocky-9.0 podman[2161]: 2022-08-31 22:53:19.77482043 +0800 CST m=+49.272022630 container remove fc733bd336856e86c4a8944e902cae0b36877511a674612807d5ca5e05c65309 (image=localhost/tomcat-rocky>
8月 31 22:53:19 rocky-9.0 podman[2161]: @ - - [31/Aug/2022:22:53:19 +0800] "DELETE /v1.12/libpod/containers/fc733bd336856e86c4a8944e902cae0b36877511a674612807d5ca5e05c65309?force=false HTTP/1.1" 200 76 "" ""
8月 31 22:53:20 rocky-9.0 podman[2161]: @ - - [31/Aug/2022:22:53:20 +0800] "GET /v1.12/libpod/containers/json?all=true HTTP/1.1" 200 3 "" ""

● podman.socket - Podman API Socket
     Loaded: loaded (/usr/lib/systemd/system/podman.socket; enabled; vendor preset: disabled)
     Active: active (running) since Wed 2022-08-31 22:51:24 CST; 2min 21s ago
      Until: Wed 2022-08-31 22:51:24 CST; 2min 21s ago
   Triggers: ● podman.service
       Docs: man:podman-system-service(1)
     Listen: /run/podman/podman.sock (Stream)
     CGroup: /system.slice/podman.socket

8月 31 22:51:24 rocky-9.0 systemd[1]: Listening on Podman API Socket.

        这时，在Rocky Linux 9的可视化管理后台中，就可以正常使用Podman来下载镜像和运行容器实例了。