podman容器开机自启、podman网络

一、 配置加速器

[root@localhost ~]# vim /etc/containers/registries.conf  

#unqualified-search-registries = ["registry.fedoraproject.org",   "registry.access.redhat.com", "registry.centos.org", "docker.io"]  #取消注释，改为下行
unqualified-search-registries = ["docker.io"]

# [[registry]]   #取消注释
 [[registry]]


# prefix = "example.com/foo"    #取消注释，改为下行
prefix = "docker.io"

# location = internal-registry-for-example.com/bar"   #取消注释，改为下行
location =  "in3617d8.mirror.aliyuncs.com"     #此地址为自己的阿里云加速器地址

二、podman容器的开机自启

root用户

[root@localhost ~]# podman pull busybox
Resolved "busybox" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/busybox:latest...
Getting image source signatures
Copying blob 3cb635b06aa2 done  
Copying config ffe9d497c3 done  
Writing manifest to image destination
Storing signatures
ffe9d497c32414b1c5cdad8178a85602ee72453082da2463f1dede592ac7d5af

[root@localhost ~]# podman run --name test -dit  docker.io/library/busybox 
437fe6c8c8d100a59c2e2e71e7bf1418843995ba0a211b154dda124c8e9c0310
[root@localhost ~]# podman  ps
CONTAINER ID  IMAGE                             COMMAND     CREATED         STATUS             PORTS       NAMES
437fe6c8c8d1  docker.io/library/busybox:latest  sh          34 seconds ago  Up 34 seconds ago              test


#创建容器自启动service文件
[root@localhost ~]# podman generate systemd --files --name test
/root/container-test.service
#如果希望每次启动容器都会删除旧的容器,启动一个全新的容器，则使用--new选项（推荐用法）
[root@localhost ~]# podman generate systemd --files --name test --new

#转移service文件
[root@localhost ~]# ls
anaconda-ks.cfg  container-test.service
[root@localhost ~]# mv container-test.service  /usr/lib/systemd/system/

#重载
[root@localhost ~]# systemctl daemon-reload

#关闭selinux
[root@localhost ~]# setenforce 0
[root@localhost ~]# vim /etc/selinux/config 
SELINUX=disabled

#设置容器自启动
[root@localhost ~]# systemctl  enable --now container-test.service
Created symlink /etc/systemd/system/multi-user.target.wants/container-test.service → /usr/lib/systemd/system/container-test.service.
Created symlink /etc/systemd/system/default.target.wants/container-test.service → /usr/lib/systemd/system/container-test.service.

普通用户

#创建用户
[root@localhost ~]# useradd  jerry
[root@localhost ~]# su - jerry


[jerry@localhost ~]$ podman pull busybox
Resolved "busybox" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/busybox:latest...
  Getting image source signatures
Copying blob 3cb635b06aa2 done  
Copying config ffe9d497c3 done  
Writing manifest to image destination
Storing signatures
ffe9d497c32414b1c5cdad8178a85602ee72453082da2463f1dede592ac7d5af


[jerry@localhost ~]$ podman  run --name test -dit docker.io/library/busybox 
b1cbea168be3ced718bdae93c4c6cdc7405d0f0f9380c856e3d76d9496901c60
[jerry@localhost ~]$ podman ps
CONTAINER ID  IMAGE                             COMMAND     CREATED        STATUS            PORTS       NAMES
b1cbea168be3  docker.io/library/busybox:latest  sh          5 seconds ago  Up 5 seconds ago              test

#创建service文件
[jerry@localhost ~]$ podman generate systemd --files --name test --new
/home/jerry/container-test.service
[jerry@localhost ~]$ ls
container-test.service

[jerry@localhost ~]$  mkdir -p ~/.config/systemd/user
[jerry@localhost ~]$ mv container-test.service ~/.config/systemd/user


#ssh远程连接
[root@localhost ~]# ssh jerry@localhost
The authenticity of host 'localhost (::1)' can't be established.
ECDSA key fingerprint is SHA256:BycR/AEKrPbE2/K7IZGMQOaOky9SOcep6J4h0bMYt4Y.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.
jerry@localhost's password: 
Last login: Wed Dec 15 22:26:20 2021
[jerry@localhost ~]$ systemctl --user   enable --now container-test.service
Created symlink /home/jerry/.config/systemd/user/multi-user.target.wants/container-test.service → /home/jerry/.config/systemd/user/container-test.service.
Created symlink /home/jerry/.config/systemd/user/default.target.wants/container-test.service → /home/jerry/.config/systemd/user/container-test.service.

[jerry@localhost ~]$ systemctl --user status container-test.service
● container-test.service - Podman container-test.service
   Loaded: loaded (/home/jerry/.config/systemd/user/container-test.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2021-12-15 22:31:21 CST; 10s ago
     Docs: man:podman-generate-systemd(1)
  Process: 107992 ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=/run/user/1002/container-test.service.ctr-id (code=exited, status=125)
  Process: 108050 ExecStartPre=/bin/rm -f /run/user/1002/container-test.service.ctr-id (code=exited, status=0/SUCCESS)
 Main PID: 108141 (conmon)
   CGroup: /user.slice/user-1002.slice/user@1002.service/container-test.service
           ├─108134 /usr/bin/fuse-overlayfs -o ,lowerdir=/home/jerry/.local/share/containers/storage/overlay/l/7EWWT2U3CWUJFPIPVXBNGBWGFI,upperdir=/home/jerry/.local/share/>
           ├─108138 /usr/bin/slirp4netns --disable-host-loopback --mtu=65520 --enable-sandbox --enable-seccomp -c -e 3 -r 4 --netns-type=path /run/user/1002/netns/cni-370af>
           ├─108141 /usr/bin/conmon --api-version 1 -c 4ca23486d3ab0cb9a230265df8b9d5a666bfdfbd42785ac90b92bf965a4b37cc -u 4ca23486d3ab0cb9a230265df8b9d5a666bfdfbd42785ac90>
           └─108144 sh

[jerry@localhost ~]$ podman ps
CONTAINER ID  IMAGE                             COMMAND     CREATED         STATUS             PORTS       NAMES
4ca23486d3ab  docker.io/library/busybox:latest  sh          19 seconds ago  Up 19 seconds ago              test

podman网络设置

创建一个网络mynet

[root@localhost ~]# podman network create mynet
/etc/cni/net.d/mynet.conflist

–subnet指定subnet创建网络

[root@localhost ~]# podman network create --subnet  192.168.1.0/24  net1
/etc/cni/net.d/net1.conflist

–gateway 指定网关

[root@localhost ~]# podman network create --subnet  192.168.2.0/24  --gateway 192.168.2.1  net2
/etc/cni/net.d/net2.conflist

–ip-range 指定ip起始地址

[root@localhost ~]# podman network create --subnet  192.168.3.0/24  --gateway 192.168.3.1 --ip-range 192.168.3.2/24  net3
/etc/cni/net.d/net3.conflist

查看刚刚创建的网络

[root@localhost ~]# podman network ls
NETWORK ID    NAME        VERSION     PLUGINS
2f259bab93aa  podman      0.4.0       bridge,portmap,firewall,tuning
11c844f95e28  mynet       0.4.0       bridge,portmap,firewall,tuning
6c270ef2f251  net1        0.4.0       bridge,portmap,firewall,tuning
2daa9a9645f3  net2        0.4.0       bridge,portmap,firewall,tuning
3b20bf89a26e  net3        0.4.0       bridge,portmap,firewall,tuning

使用刚刚创建的网络net1，并运行一个容器

[root@localhost ~]# podman  run --name web -it  --network net1  busybox
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0@if13: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether 3e:7b:5e:72:2e:c7 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.2/24 brd 192.168.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::3c7b:5eff:fe72:2ec7/64 scope link 
       valid_lft forever preferred_lft forever

podman网络管理

查看容器网路

[root@localhost ~]# podman network ls
NETWORK ID    NAME        VERSION     PLUGINS
2f259bab93aa  podman      0.4.0       bridge,portmap,firewall,tuning
11c844f95e28  mynet       0.4.0       bridge,portmap,firewall,tuning
6c270ef2f251  net1        0.4.0       bridge,portmap,firewall,tuning
2daa9a9645f3  net2        0.4.0       bridge,portmap,firewall,tuning
3b20bf89a26e  net3        0.4.0       bridge,portmap,firewall,tuning

断开网络（disconnect）

[root@localhost ~]# podman network disconnect net1 web

重启容器网络（reload）

[root@localhost ~]# podman network reload web
edf3830ea44b5cf8dd2ebe7c62ecd2d1d3e55977dedd8e96fbd346b58de43596

删除podman网络（rm）

[root@localhost ~]# podman network rm net2 net3
net2
net3

[root@localhost ~]# podman network ls
NETWORK ID    NAME        VERSION     PLUGINS
2f259bab93aa  podman      0.4.0       bridge,portmap,firewall,tuning
11c844f95e28  mynet       0.4.0       bridge,portmap,firewall,tuning
6c270ef2f251  net1        0.4.0       bridge,portmap,firewall,tuning