podman进阶

最新推荐文章于 2023-02-04 12:11:40 发布

minyao922

最新推荐文章于 2023-02-04 12:11:40 发布

阅读量1.6k

点赞数

文章标签： linux java bash

本文链接：https://blog.csdn.net/minyao922/article/details/121936132

版权

podman故障排除

网络设置

//首先先定义一个别名，podman等于docker
[root@localhost ~]# alias docker=podman
[root@localhost ~]# alias
alias cp='cp -i'
alias docker='podman'
alias egrep='egrep --color=auto'
alias fgrep='fgrep --color=auto'
alias grep='grep --color=auto'
alias l.='ls -d .* --color=auto'
alias ll='ls -l --color=auto'
alias ls='ls --color=auto'
alias mv='mv -i'

//运行两个容器
[root@localhost ~]# podman run -it docker.io/library/busybox /bin/sh
/ #  ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0@if4: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether ce:ef:d3:9e:e5:86 brd ff:ff:ff:ff:ff:ff
    inet 10.88.0.2/16 brd 10.88.255.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::ccef:d3ff:fe9e:e586/64 scope link 
       valid_lft forever preferred_lft forever


[root@localhost ~]# podman run -it docker.io/library/busybox /bin/sh
/ # 
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether d2:42:5c:7f:b5:5c brd ff:ff:ff:ff:ff:ff
    inet 10.88.0.3/16 brd 10.88.255.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::d042:5cff:fe7f:b55c/64 scope link 
       valid_lft forever preferred_lft forever
//ping能ping通
/ # ping 10.88.0.3
PING 10.88.0.3 (10.88.0.3): 56 data bytes
64 bytes from 10.88.0.3: seq=0 ttl=64 time=0.041 ms
64 bytes from 10.88.0.3: seq=1 ttl=64 time=0.040 ms
64 bytes from 10.88.0.3: seq=2 ttl=64 time=0.034 ms
^Z[1]+  Stopped                    ping 10.88.0.3

cni：Container Network Interface（容器网络接口）

//容器启动时会生成网卡，容器退出后网卡也会没有，但cni网卡依然存在
[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:0d:28:93 brd ff:ff:ff:ff:ff:ff
    inet 192.168.47.164/24 brd 192.168.47.255 scope global dynamic noprefixroute ens33
       valid_lft 1312sec preferred_lft 1312sec
    inet6 fe80::7f17:7566:4adf:f2cd/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: cni-podman0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 86:40:c8:13:13:5f brd ff:ff:ff:ff:ff:ff
    inet 10.88.0.1/16 brd 10.88.255.255 scope global cni-podman0
       valid_lft forever preferred_lft forever
    inet6 fe80::8440:c8ff:fe13:135f/64 scope link 
       valid_lft forever preferred_lft forever
4: vethd5f6f81e@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master cni-podman0 state UP group default 
    link/ether e6:7c:83:34:e8:9e brd ff:ff:ff:ff:ff:ff link-netns cni-f8e06840-f838-325f-98b0-9a6a14977430
    inet6 fe80::e47c:83ff:fe34:e89e/64 scope link 
       valid_lft forever preferred_lft forever
5: veth3cd5a4b7@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master cni-podman0 state UP group default 
    link/ether a2:7f:ab:54:52:ee brd ff:ff:ff:ff:ff:ff link-netns cni-cbd03cfe-f61f-b3fd-da8d-4cb7be07dad0
    inet6 fe80::a07f:abff:fe54:52ee/64 scope link 
       valid_lft forever preferred_lft forever
//在这里把上面两个容器退出
[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:0d:28:93 brd ff:ff:ff:ff:ff:ff
    inet 192.168.47.164/24 brd 192.168.47.255 scope global dynamic noprefixroute ens33
       valid_lft 1156sec preferred_lft 1156sec
    inet6 fe80::7f17:7566:4adf:f2cd/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: cni-podman0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 86:40:c8:13:13:5f brd ff:ff:ff:ff:ff:ff
    inet 10.88.0.1/16 brd 10.88.255.255 scope global cni-podman0
       valid_lft forever preferred_lft forever
    inet6 fe80::8440:c8ff:fe13:135f/64 scope link 
       valid_lft forever preferred_lft forever

podman防火墙规则

//查看防火墙规则，现在没有规则
[root@localhost ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
//运行一个容器，映射80端口
[root@localhost ~]# podman run -d -p 80:80 --name web docker.io/library/httpd
7fa2fc2390f81018f72606bfd586cc776b091aeedf0a40f816e39a88248e81a0
//查看端口映射
[root@localhost ~]# podman port web
80/tcp -> 0.0.0.0:80
//查看防火墙规则，发现多了一条
[root@localhost ~]# iptables -t nat -nvL
Chain CNI-807cc9c30b332fae8a5f041a (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            10.88.0.0/16         /* name: "podman" id: "7fa2fc2390f81018f72606bfd586cc776b091aeedf0a40f816e39a88248e81a0" */

//查看IP能访问
[root@localhost ~]# podman inspect -l|grep -i address
            "IPAddress": "10.88.0.4",
            "GlobalIPv6Address": "",
            "MacAddress": "76:45:02:92:6b:83",
            "LinkLocalIPv6Address": "",
                    "IPAddress": "10.88.0.4",
                    "GlobalIPv6Address": "",
                    "MacAddress": "76:45:02:92:6b:83",
[root@localhost ~]# curl 10.88.0.4
<html><body><h1>It works!</h1></body></html>
//清空防火墙规则
[root@localhost ~]# iptables --flush #刷新
[root@localhost ~]# iptables -t nat -F #指定表清空
[root@localhost ~]# iptables -t nat -nvL #规则已被清空
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
//规则删除后发现访问不了
[root@localhost ~]# curl 10.88.0.4
curl: (7) Failed to connect to 10.88.0.4 port 80: 没有到主机的路由

//使用podman network reload 命令重新加载，规则存在
[root@localhost ~]# podman network reload web
7fa2fc2390f81018f72606bfd586cc776b091aeedf0a40f816e39a88248e81a0
[root@localhost ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CNI-HOSTPORT-DNAT  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

配置文件

//podman的桥配置文件，容器里面的IP可通过这个控制
[root@localhost ~]# cat /etc/cni/net.d/87-podman.conflist 
{
  "cniVersion": "0.4.0",
  "name": "podman",
  "plugins": [
    {
      "type": "bridge",   #模式
      "bridge": "cni-podman0",   #桥的名字
      "isGateway": true,   #是不是网关
      "ipMasq": true,
      "hairpinMode": true,
      "ipam": {
        "type": "host-local",
        "routes": [{ "dst": "0.0.0.0/0" }],
        "ranges": [
          [
            {
              "subnet": "10.88.0.0/16",
              "gateway": "10.88.0.1"
            }
          ]
        ]
      }
    },
    {
      "type": "portmap",  #端口映射
      "capabilities": {
        "portMappings": true
      }
    },
    {
      "type": "firewall"
    },
    {
      "type": "tuning"
    }
  ]
}

查看子命令的用法

//查看attach这个子命令的用法
[root@localhost ~]# man podman-attach
EXAMPLES
       Attach to a container called "foobar".

              $ podman attach foobar

       Attach to the latest created container.

              $ podman attach --latest

       Attach to a container that start with the ID "1234".

              $ podman attach 1234

       Attach to a container without attaching STDIN.

              $ podman attach --no-stdin foobar

SEE ALSO
       podman(1), podman-exec(1), podman-run(1),
       containers.conf(5)

 
~
~
/EXAMPLE  #可在下面搜索例子

基础命令


//指定镜像做的历史
[root@localhost ~]# podman history docker.io/library/busybox
ID            CREATED     CREATED BY                                     SIZE        COMMENT
ffe9d497c324  6 days ago  /bin/sh -c #(nop)  CMD ["sh"]                  0 B         
<missing>     6 days ago  /bin/sh -c #(nop) ADD file:e2d2d9591696b14...  1.46 MB  

//使用iamge管理镜像，使用images看镜像   
[root@localhost ~]# podman image --help
Manage images

Description:
  Manage images

Usage:
  podman image [command]

Available Commands:
  build       Build an image using instructions from Containerfiles
  diff        Inspect changes to the image's file systems
  exists      Check if an image exists in local storage
  history     Show history of a specified image
  import      Import a tarball to create a filesystem image
  inspect     Display the configuration of an image
  list        List images in local storage
  load        Load image(s) from a tar archive
  mount       Mount an image's root filesystem
  prune       Remove unused images
  pull        Pull an image from a registry
  push        Push an image to a specified destination
  rm          Removes one or more images from local storage
  save        Save image(s) to an archive
  scp         securely copy images
  search      Search registry for image
  sign        Sign an image
  tag         Add an additional name to a local image
  tree        Prints layer hierarchy of an image in a tree format
  trust       Manage container image trust policy
  unmount     Unmount an image's root filesystem
  untag       Remove a name from a local image
  
//查看镜像有几层
[root@localhost ~]# podman image tree docker.io/my922/nginx
Image ID: c69af231e7f6
Tags:     [localhost/nginx:latest docker.io/my922/nginx:latest]
Size:     565.4MB
Image Layers
├── ID: 74ddd0ec08fa Size: 238.6MB Top Layer of: [docker.io/library/centos:latest]
├── ID: d253d66bdbee Size: 6.723MB
└── ID: 60c95eeded28 Size: 320.1MB Top Layer of: [localhost/nginx:latest docker.io/my922/nginx:latest]

//查看详细信息
[root@localhost ~]# podman info
host:
  arch: amd64
  buildahVersion: 1.23.1
  cgroupControllers:
  - cpuset
  - cpu
  - cpuacct
  - blkio
  - memory
  - devices
  - freezer
  - net_cls
  - perf_event
  - net_prio
  - hugetlb
  - pids
  - rdma
  cgroupManager: systemd
  cgroupVersion: v1
  conmon:
    package: conmon-2.0.30-1.module_el8.6.0+944+d413f95e.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.0.30, commit: e28f6ed9f4a6f18e27f3efdab92de483806e6b9c'

设置开机自启


//先创建一个容器，不启动
[root@localhost ~]# podman create --name nginx nginx:latest
[root@localhost ~]# podman ps -a
CONTAINER ID  IMAGE                   COMMAND               CREATED         STATUS      PORTS       NAMES
59ceb04e76fc  localhost/nginx:latest  nginx -g daemon o...  35 seconds ago  Created                 nginx

//生成service文件，但是此命令光生成找不到文件，建议用下一条命令
[root@localhost ~]# podman generate systemd --restart-policy=always -t 1 nginx
# container-59ceb04e76fc859f57cee88ac813534945dbeddd3c88229017151e031fb52a9e.service
# autogenerated by Podman 3.4.1-dev
# Tue Dec 14 22:22:56 CST 2021

[Unit]
Description=Podman container-59ceb04e76fc859f57cee88ac813534945dbeddd3c88229017151e031fb52a9e.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=/run/containers/storage

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=always
TimeoutStopSec=61
ExecStart=/usr/bin/podman start 59ceb04e76fc859f57cee88ac813534945dbeddd3c88229017151e031fb52a9e
ExecStop=/usr/bin/podman stop -t 1 59ceb04e76fc859f57cee88ac813534945dbeddd3c88229017151e031fb52a9e
ExecStopPost=/usr/bin/podman stop -t 1 59ceb04e76fc859f57cee88ac813534945dbeddd3c88229017151e031fb52a9e
PIDFile=/run/containers/storage/overlay-containers/59ceb04e76fc859f57cee88ac813534945dbeddd3c88229017151e031fb52a9e/userdata/conmon.pid
Type=forking

[Install]
WantedBy=multi-user.target default.target

//生成service文件，把nginx容器生成一个文件，指定文件名
[root@localhost ~]# podman generate systemd --files --name nginx
/root/container-nginx.service，查看状态

//把文件移动到systemd
[root@localhost ~]# mv container-nginx.service /usr/lib/systemd/system/
[root@localhost ~]# systemctl status container-nginx
● container-nginx.service - Podman container-nginx.service
   Loaded: loaded (/usr/lib/systemd/system/container-nginx.serv>
   Active: inactive (dead)
     Docs: man:podman-generate-systemd(1)
     
//把容器设置开机自启
[root@localhost ~]# systemctl enable --now container-nginx
Created symlink /etc/systemd/system/multi-user.target.wants/container-nginx.service → /usr/lib/systemd/system/container-nginx.service.
Created symlink /etc/systemd/system/default.target.wants/container-nginx.service → /usr/lib/systemd/system/container-nginx.service.

使用普通用户设置开机自启

//切换到普通用户
[root@localhost ~]# su - tom
上一次登录：二 12月 14 19:08:41 CST 2021pts/2 上
[tom@localhost ~]$ podman ps -a
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES

//创建一个容器
[tom@localhost ~]$ podman run --name web -d nginx
✔ docker.io/library/nginx:latest
Trying to pull docker.io/library/nginx:latest...
Getting image source signatures
Copying blob 881ff011f1c9 done  
Copying blob 21e0df283cd6 [>------------------] 1.7MiB / 24.2MiB
Copying blob e5ae68f74026 [>------------------] 1.0MiB / 29.9MiB
Copying blob ed835de16acd done  
Copying blob 77700c52c969 done  
Copying blob 44be98c0fab6 done  
[tom@localhost ~]$ podman ps
CONTAINER ID  IMAGE                           COMMAND               CREATED             STATUS                 PORTS       NAMES
dcc006816f20  docker.io/library/nginx:latest  nginx -g daemon o...  About a minute ago  Up About a minute ago              web

//创建一个用户
[tom@localhost ~]$ cd .config/
[tom@localhost .config]$ ls
cni
[tom@localhost .config]$ mkdir systemd/user -p
[tom@localhost .config]$ tree
.
├── cni
│   └── net.d
│       └── 87-podman.conflist
└── systemd
    └── user
//生成service文件
[tom@localhost user]$ pwd
/home/tom/.config/systemd/user
[tom@localhost user]$ podman generate systemd --files --name web
/home/tom/.config/systemd/user/container-web.service

//先停掉容器
[tom@localhost user]$ podman stop web
web
[tom@localhost user]$ podman ps -a
CONTAINER ID  IMAGE                           COMMAND               CREATED        STATUS                    PORTS       NAMES
dcc006816f20  docker.io/library/nginx:latest  nginx -g daemon o...  5 minutes ago  Exited (0) 5 seconds ago              web

//加载
[tom@localhost user]$ systemctl daemon-reload
==== AUTHENTICATING FOR org.freedesktop.systemd1.reload-daemon ====
Authentication is required to reload the systemd state.
Authenticating as: root
Password: 
==== AUTHENTICATION COMPLETE ====