podman应用

最新推荐文章于 2024-04-28 12:54:14 发布

it__happy

最新推荐文章于 2024-04-28 12:54:14 发布

阅读量350

点赞数

分类专栏： podman

本文链接：https://blog.csdn.net/happy___life/article/details/119673423

版权

podman 专栏收录该内容

1 篇文章 0 订阅

订阅专栏

文章目录

- - podman基本操作

podman基本操作

拉取镜像

[root@C82 ~]# podman pull nginx
Copying blob b10cf527a02d done  
Copying blob c90b090c213b done  
Copying blob 33847f680f63 done  
Copying blob dbb907d5159d done  
Copying blob 1f41b2f2bf94 done  
Copying blob 8a268f30c42a done  
Copying config 08b152afcf done  
Writing manifest to image destination
Storing signatures
08b152afcfae220e9709f00767054b824361c742ea03a9fe936271ba520a0a4b

运行容器并查看

[root@C82 ~]# podman images
REPOSITORY               TAG     IMAGE ID      CREATED      SIZE
docker.io/library/nginx  latest  08b152afcfae  3 weeks ago  137 MB
[root@C82 ~]# podman run  -d  --name t1 -p 80 docker.io/library/nginx
d3d91a71faf5a9986ff2df4f71a04d8746fc421a6d8f4d25dda4720551a10fe3
[root@C82 ~]# podman ps
CONTAINER ID  IMAGE                           COMMAND               CREATED        STATUS            PORTS               NAMES
d3d91a71faf5  docker.io/library/nginx:latest  nginx -g daemon o...  7 seconds ago  Up 6 seconds ago  0.0.0.0:80->80/tcp  t1
[root@C82 ~]# podman inspect -l
[
    {
        "Id": "d3d91a71faf5a9986ff2df4f71a04d8746fc421a6d8f4d25dda4720551a10fe3",
        "Created": "2021-08-13T01:20:01.478654603-04:00",
        "Path": "/docker-entrypoint.sh",
        "Args": [
            "nginx",
            "-g",
            "daemon off;"
        ],
        "State": {
            "OciVersion": "1.0.2-dev",
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 545287,
            "ConmonPid": 545275,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2021-08-13T01:20:02.083693882-04:00",
            "FinishedAt": "0001-01-01T00:00:00Z",
            "Healthcheck": {
                "Status": "",
                "FailingStreak": 0,
                "Log": null
            }

[root@C82 ~]# curl 192.168.10.30:80
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

podman logs查看容器日志

[root@C82 ~]# podman logs -l
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
192.168.10.30 - - [13/Aug/2021:05:23:43 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.61.1" "-"
......

pod top <container_id>产看容器pid

[root@C82 ~]# podman top t1
USER    PID   PPID   %CPU    ELAPSED           TTY   TIME   COMMAND
root    1     0      0.000   6m13.809962985s   ?     0s     nginx: master process nginx -g daemon off; 
nginx   32    1      0.000   6m13.810405688s   ?     0s     nginx: worker process 
nginx   33    1      0.000   6m13.810447288s   ?     0s     nginx: worker process 
nginx   34    1      0.000   6m13.810553274s   ?     0s     nginx: worker process 
nginx   35    1      0.000   6m13.810596036s   ?     0s     nginx: worker process

上传镜像

[root@C82 ~]# podman login
Username: diligence
Password: 
Login Succeeded!
[root@C82 ~]# podman tag docker.io/library/nginx:latest diligence/test:nginx
[root@C82 ~]# podman push diligence/test:nginx
Getting image source signatures
Copying blob e3135447ca3e done  
Copying blob 988d9a3509bb done  
Copying blob 59b01b87c9e7 done  
Copying blob b85734705991 done  
Copying blob 7c0b223167b9 done  
Copying blob 814bff734324 done  
Copying config 08b152afcf done  
Writing manifest to image destination
Storing signatures

普通用户使用的配置

在允许没有root特权的用户运行Podman之前，管理员必须安装或构建Podman并完成以下配置

cgroup V2Linux内核功能允许用户限制普通用户容器可以使用的资源，如果使用cgroupV2启用了运行Podman的Linux发行版，则可能需要更改默认的OCI运行时。某些较旧的版本runc不适用于cgroupV2，必须切换到备用OCI运行时crun。

yum  -y install crun

可以修改containers.conf文件runtime = "runc"到runtime = “crun”

[root@ ~]# C82vim /usr/share/containers/containers.conf
......
# volume_path = "/var/lib/containers/storage/volumes"

# Default OCI runtime
#
# runtime = "crun"
runtime = "crun"

# List of the OCI runtimes that support --format=json.  When json is supported
# engine will use it for reporting nicer errors.
......
[root@C82 ~]# podman start t1
[root@C82 ~]# podman inspect t1 | grep runc
        "OCIRuntime": "runc",
            "runc",

安装slirp4netns和fuse-overlayfs

slirp4nets包为普通用户提供一种网络模式
在普通用户环境中使用Podman时，建议使用fuse-overlayfs而不是VFS文件系统

yum -y install slirp4netns
yum -y install fuse-overlayfs

配置storage.conf文件

[root@C82 ~]# vim /etc/containers/storage.conf
# This file is is the configuration file for all tools
# that use the containers/storage library.
# See man 5 containers-storage.conf for more information
# The "container storage" table contains all of the server options.
[storage]

# Default Storage Driver, Must be set for proper operation.
driver = "overlay"   //此处改为overlay  

# Temporary storage location
runroot = "/run/containers/storage"
......
# Path to an helper program to use for mounting the file system instead of mounting it
# directly.
mount_program = "/usr/bin/fuse-overlayfs"   //取消注释

/ etc / subuid和/ etc / subgid配置

Podman要求运行它的用户在/ etc / subuid和/ etc / subgid文件中列出一系列UID,shadow-utils或newuid包提供这些文件

yum -y install shadow-utils

可以在/ etc / subuid和/ etc / subgid查看，每个用户的值必须唯一且没有任何重叠。

[root@C82 ~]# useradd xx
[root@C82 ~]# cat /etc/subuid
xx:10000065536
[root@C82 ~]# cat /etc/subgid
xx:100000:65536

该文件的格式为USERNAME：UID：RANGE

在/ etc / passwd或getpwent中列出的用户名。
为用户分配的初始uid。
为用户分配的UID范围的大小

普通用户是无法看见root用户的镜像的

[root@C82 ~]# podman images
REPOSITORY               TAG         IMAGE ID      CREATED      SIZE
docker.io/library/nginx  latest      08b152afcfae  3 weeks ago  137 MB

[root@ ~]# sC82u - xx
[xx@C82 ~]$ podman images
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE

不同用户可以创建相同名字的容器，互不相干

[root@C82 ~]# podman run -d --name web nginx
dc0d7ebeaf2ad3245ce9d3964f8afe8b075dd25e014024d02846540f47f1b578
[root@C82 ~]# podman ps -a
CONTAINER ID  IMAGE                           COMMAND               CREATED         STATUS             PORTS               NAMES
dc0d7ebeaf2a  docker.io/library/nginx:latest  nginx -g daemon o...  8 seconds ago   Up 7 seconds ago                       web
d3d91a71faf5  docker.io/library/nginx:latest  nginx -g daemon o...  20 minutes ago  Up 20 minutes ago  0.0.0.0:80->80/tcp  t1

[xx@C82 ~]$ podman run -d --name web nginx
05a0373053548f83e15b1719ee535ab1d0f448b655ffb033867eeeb06c273cb6
[xx@C82 ~]$ podman ps -a
CONTAINER ID  IMAGE                           COMMAND               CREATED         STATUS             PORTS       NAMES
05a037305354  docker.io/library/nginx:latest  nginx -g daemon o...  40 seconds ago  Up 39 seconds ago              web

使用卷

容器与root用户一起运行，则root容器中的用户实际上就是主机上的用户。UID / GID是在/etc/subuid和/etc/subgid等中用户映射中指定的第一个UID / GID。如果普通用户的身份从主机目录挂载到容器中，并在该目录中以根用户身份创建文件，则会看到它实际上是你的用户在主机上拥有的。

[xx@C82 ~]$ pwd
/home/xx
[xx@C82 ~]$ podman run -it --name web1 -v /home/xx/bb:/data:Z docker.io/library/nginx /bin/sh
# ls
bin   data  docker-entrypoint.d   etc   lib    media  opt   root  sbin  sys  usr
boot  dev   docker-entrypoint.sh  home  lib64  mnt    proc  run   srv   tmp  var
# cd data 
# ls
# touch 789
# ls
789
# pwd
/data
# exit
[xx@C82 ~]$ ls
bb
[xx@C82 ~]$ ls bb
789

–userns=keep-id标志，以确保用户被映射到容器内自己的UID和GID。

[xx@C82 ~]$ podman run -it --name t10086 -v "$(pwd)"/dd:/aa --userns=keep-id busybox /bin/sh
~ $ touch aa/abc
~ $ ls -l aa/
total 0
-rw-r--r--    1 xx       xx               0 Aug 13 06:22 123
-rw-r--r--    1 xx       xx               0 Aug 13 06:24 abc
~ $ exit
[xx@C82 ~]$ ll dd/
总用量 0
-rw-r--r--. 1 xx xx 0 8月  13 06:22 123
-rw-r--r--. 1 xx xx 0 8月  13 06:24 abc

配置echo ‘net.ipv4.ip_unprivileged_port_start=80’ >> /etc/sysctl.conf

[root@C82 ~]# echo  'net.ipv4.ip_unprivileged_port_start=80'  >> /etc/sysctl.conf
[root@C82 ~]# sysctl -p
net.ipv4.ip_unprivileged_port_start = 80

[xx@C82 ~]$ podman  run  --name nginx  -d  -p 80:80 nginx
380630dccb56825c8d56ad19ddf22cbebb535ae5fcc40a4232270673da050bd0
[xx@C82 ~]$ podman ps
CONTAINER ID  IMAGE                           COMMAND               CREATED             STATUS                 PORTS                 NAMES
380630dccb56  docker.io/library/nginx:latest  nginx -g daemon o...  5 seconds ago       Up 5 seconds ago       0.0.0.0:80->80/tcp    nginx

it__happy

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
podman应用

podman基本操作podman的操作和docker是一样的拉取镜像[root@C82 ~]# podman pull nginxCopying blob b10cf527a02d done Copying blob c90b090c213b done Copying blob 33847f680f63 done Copying blob dbb907d5159d done Copying blob 1f41b2f2bf94 done Copying blob 8a268f3
复制链接

扫一扫

专栏目录