在无根环境中的基本设置和使用Podman

最新推荐文章于 2024-05-22 09:47:14 发布

暖春忽见

最新推荐文章于 2024-05-22 09:47:14 发布

阅读量526

点赞数

分类专栏：奋斗文章标签： linux 运维服务器

本文链接：https://blog.csdn.net/nuanchunhujian/article/details/126382990

版权

奋斗专栏收录该内容

19 篇文章 0 订阅

订阅专栏

无根用户基本设置和使用Podman

文章目录

无根用户基本设置和使用Podman
@[toc]
安装slirp4netns和fuse-overlayfs
/etc / subuid和/ etc / subgid配置
授权文件
普通用户管理容器
卷

在允许没有root特权的用户运行Podman之前，管理员必须安装或构建Podman并完成以下配置

cgroup V2Linux内核功能允许用户限制普通用户容器可以使用的资源，如果使用cgroupV2启用了运行Podman的Linux发行版，则可能需要更改默认的OCI运行时。某些较旧的版本runc不适用于cgroupV2，必须切换到备用OCI运行时crun。

[root@localhost ~]# yum -y install crun
Failed to set locale, defaulting to C.UTF-8
Last metadata expiration check: 1:25:25 ago on Tue Aug 16 04:22:14 2022.
Dependencies resolved.
=========================================================================
 Package
       Arch    Version                                  Repository  Size
=========================================================================
Installing:
 crun  x86_64  1.4.3-1.module_el8.7.0+1106+45480ee0     appstream  209 k
Installing dependencies:
 yajl  x86_64  2.1.0-11.el8                             appstream   41 k

Transaction Summary
=========================================================================
Install  2 Packages
...
Installed:
  crun-1.4.3-1.module_el8.7.0+1106+45480ee0.x86_64                       
  yajl-2.1.0-11.el8.x86_64                                               

Complete!
[root@localhost ~]# 
[root@localhost ~]# vim /usr/share/containers/containers.conf
runtime = "crun"		#这一行取消注释
#runtime = "runc" 		#这一行给他注释掉
随便拉取一个镜像
[root@localhost ~]# podman run -d --name web -p 80:80 httpd
✔ docker.io/library/httpd:latest
Trying to pull docker.io/library/httpd:latest...
Getting image source signatures
Copying blob 1efc276f4ff9 done  
Copying blob 80cb79a80bbe done  
Copying blob 4340e7be3d7f done  
Copying blob 80e368ef21fc done  
Copying blob aed046121ed8 done  
Copying config f2a976f932 done  
Writing manifest to image destination
Storing signatures
1de41726ed8647dd389e6e6c4bcdf932ca9dd14e21b095a3ab407a90001a32e2
[root@localhost ~]# 
[root@localhost ~]# podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED             STATUS                 PORTS               NAMES
1de41726ed86  docker.io/library/httpd:latest  httpd-foreground  About a minute ago  Up About a minute ago  0.0.0.0:80->80/tcp  web
[root@localhost ~]# 
这里可以看到已经是这个模式了
root@localhost ~]# podman inspect web | grep crun
          "OCIRuntime": "crun",
[root@localhost ~]# podman inspect web | grep crun

安装slirp4netns和fuse-overlayfs

在普通用户环境中使用Podman时，建议使用fuse-overlayfs而不是VFS文件系统，至少需要版本0.7.6。现在新版本默认就是了。

#一般情况只要时yum安装的podman基本上自带的这个包
[root@localhost ~]# yum -y install slirp4netns
Failed to set locale, defaulting to C.UTF-8
Last metadata expiration check: 1:58:49 ago on Tue Aug 16 04:22:14 2022.
Package slirp4netns-1.1.8-2.module_el8.7.0+1106+45480ee0.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
[root@localhost ~]# yum -y install fuse-overlayfs
Failed to set locale, defaulting to C.UTF-8
Last metadata expiration check: 1:59:12 ago on Tue Aug 16 04:22:14 2022.
Package fuse-overlayfs-1.8.2-1.module_el8.7.0+1106+45480ee0.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
[root@localhost ~]# 
#进这个配置文件，
[root@localhost ~]# vim /etc/containers/storage.conf 
mountopt = "nodev,metacopy=on" //#把这一行取消注释
#看能不能看到这一条命令路径
[root@localhost ~]# which fuse-overlayfs
/usr/bin/fuse-overlayfs
[root@localhost ~]#

/etc / subuid和/ etc / subgid配置

Podman要求运行它的用户在/ etc / subuid和/ etc / subgid文件中列出一系列UID,shadow-utils或newuid包提供这些文件

[root@localhost ~]# yum -y install shadow-utils
Failed to set locale, defaulting to C.UTF-8
Last metadata expiration check: 2:05:34 ago on Tue Aug 16 04:22:14 2022.
Package shadow-utils-2:4.6-16.el8.x86_64 is already installed.
Dependencies resolved.
=========================================================================
 Package            Architecture Version              Repository    Size
===============================================================
...
Upgraded:
  shadow-utils-2:4.6-17.el8.x86_64                                       

Complete!
#创建用户用cat看一下
[root@localhost ~]# 
[root@localhost ~]# useradd nuanchun
[root@localhost ~]# cat /etc/subgid
mysql:100000:65536
nuanchun:165536:65536
#你再创建用户用户的uid只会是之前那个用户的uid和后面的数字之和的基础上分配
[root@localhost ~]# 
[root@localhost ~]# useradd hujian
[root@localhost ~]# cat /etc/subgid
mysql:100000:65536
nuanchun:165536:65536
hujian:231072:65536
[root@localhost ~]# 
#你可以在这个配置文件里修改这种规则
[root@localhost ~]# vim /etc/sysctl.conf 
net.ipv4.ping_group_range=0 400000
这样的话他之后创建的用户的uid只会从400000的范围分配

这个文件的格式是 USERNAME:UID:RANGE中/etc/passwd或输出中列出的用户名getpwent。

为用户分配的初始 UID。
为用户分配的 UID 范围的大小。

该usermod程序可用于为用户分配 UID 和 GID，而不是直接更新文件。

[root@localhost ~]# usermod --add-subuids 200000-201000 --add-subgids 200000-201000 hh
grep hh /etc/subuid /etc/subgid
/etc/subuid:hh:200000:1001
/etc/subgid:hh:200000:1001

#这个是只允许15000个用户访问，可以加可以不加
[root@localhost ~]# vim /etc/sysctl.conf
user.max_user_namespaces=15000

授权文件

此文件里面写了docker账号的密码，以加密方式显示

#先登录才能看到授权文件
[root@localhost ~]# podman login
Username: nuanchun
Password: 
Login Succeeded!
[root@localhost ~]# find / -name auth.json
/run/user/0/containers/auth.json
[root@localhost ~]# cat /run/user/0/containers/auth.json
{
        "auths": {
                "docker.io": {
                        "auth": "bnVhbmNodW46d3V0azAyMDE3"
                }
        }
}[root@localhost ~]# 
#用普通用户也是一样的效果
[nuanchun@localhost ~]$ podman login
Username: nuanchun
Password: 
Login Succeeded!
[nuanchun@localhost ~]$ cat /tmp/podman-run-1001/containers/auth.json
{
        "auths": {
                "docker.io": {
                        "auth": "bnVhbmNodW46d3V0azAyMDE3"
                }
        }
[nuanchun@localhost ~]$

普通用户管理容器

[root@localhost ~]# cat /etc/subuid
mysql:100000:65536
nuanchun:165536:65536
hujian:231072:65536
nuanchunhujian:296608:65536
[root@localhost ~]# tail -2 /etc/sysctl.conf 
#这行说明在100000到400000这个范围的用户是可以管理podman容器的
net.ipv4.ping_group_range=0 400000
user.max_user_namespaces=15000
[root@localhost ~]# 
#无根用户和root用户之间是隔离的。因此互相看不到对方有什么容器和镜像
[hujian@localhost ~]$ podman ps
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
[hujian@localhost ~]$ podman images
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE
[hujian@localhost ~]$ 
[root@localhost ~]# podman images
REPOSITORY               TAG         IMAGE ID      CREATED      SIZE
docker.io/library/httpd  latest      f2a976f932ec  2 weeks ago  149 MB
#拉取和运行容器
[hujian@localhost ~]$ podman run -dit --name k1 -p 8080:80 httpd
Resolving "httpd" using unqualified-search registries (/etc/containers/registries.conf)
Trying to pull docker.io/library/httpd:latest...
Getting image source signatures
CopyCopying blob 80e368ef21fc [====================>-----] 18.2MiB / 22.CopyCopying blob 80e368ef21fc [====================>-----] 18.2MiB / 22.CopyCopying blob 80e368ef21fc [====================>-----] 18.4MiB / 22.Copying blob 80e368ef21fc done  
Copying blob aed046121ed8 done  
Copying blob 80cb79a80bbe done  
Copying blob 4340e7be3d7f done  
Copying blob 1efc276f4ff9 done  
Copying config f2a976f932 done  
Writing manifest to image destination
Storing signatures
a641aef1a0918ffa8eff47afad38ae493d8615270fa7f0bd95e554b51c6bd949
#查看拉去下来的镜像
[hujian@localhost ~]$ podman images
REPOSITORY               TAG         IMAGE ID      CREATED      SIZE
docker.io/library/httpd  latest      f2a976f932ec  2 weeks ago  149 MB
#查看运行的镜像
[hujian@localhost ~]$ podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED         STATUS             PORTS                 NAMES
a641aef1a091  docker.io/library/httpd:latest  httpd-foreground  36 seconds ago  Up 37 seconds ago  0.0.0.0:8080->80/tcp  k1
#这里你可以发无根用户是没有IP地址的
[hujian@localhost ~]$ podman inspect -l | grep -i addre
               "IPAddress": "",
               "GlobalIPv6Address": "",
               "MacAddress": "",
               "LinkLocalIPv6Address": "",
[hujian@localhost ~]$ 
#因为我们运行容器的时候是暴漏了端口的，所以就算没有IP地址也可也访问的到。
[hujian@localhost ~]$ curl 192.168.171.134:8080
<html><body><h1>It works!</h1></body></html>
[hujian@localhost ~]$ 
所以容器他没有IP地址是可以使用的，当然也可以进入容器也可以访问外网。
[kang@localhost ~]$ podman run -it --rm --name web2 busybox
/ # ping baidu.com
PING baidu.com (39.156.66.10): 56 data bytes
64 bytes from 39.156.66.10: seq=0 ttl=255 time=38.518 ms
64 bytes from 39.156.66.10: seq=1 ttl=255 time=38.133 ms
64 bytes from 39.156.66.10: seq=2 ttl=255 time=37.666 ms
^C

卷

容器与root用户一起运行，则root容器中的用户实际上就是主机上的用户。
UID GID是在/etc/subuid和/etc/subgid等中用户映射中指定的第一个UID GID。
如果普通用户的身份从主机目录挂载到容器中，并在该目录中以根用户身份创建文件，则会看到它实际上是你的用户在主机上拥有的。

使用卷

实际上里面还是root的用户，那要怎么才能改成kang用户呢

[kang@localhost ~]$ ls
abc
[kang@localhost ~]$ ll
total 0
drwxrwxr-x. 2 kang kang 15 Aug 16 22:43 abc 
[kang@localhost ~]$ podman run -dit --name web1 -v /home/kang/abc/:/abc -p 8080:80 httpd
4d503c3ef46715e5069d309a29235f7f008ae1527c7549bf44783317cbd3f6e4
[kang@localhost ~]$ podman exec -it web1 /bin/bash
root@4d503c3ef467:/usr/local/apache2# ls -l / --color
total 4
drwxrwxr-x.   2 root   root      15 Aug 17 02:43 abc
drwxr-xr-x.   1 root   root       6 Aug  2 04:35 bin
root@602807ec776b:/usr/local/apache2# cd /abc/
bash: cd: /abc/: Permission denied
root@602807ec776b:/usr/local/apache2# 
发现权限被拒绝
root@602807ec776b:/usr/local/apache2# exit
exit
[kang@localhost ~]$ podman rm -f web1 
602807ec776bf279af09b0a82f52b0258f169a86d5a9075e242bacbdc5b824de
[kang@localhost ~]$ podman run -dit --name web1 -v /home/kang/abc/:/abc:Z -p 8080:80 httpd
在次创建容器，在参数加上Z这里的Z是改写防火墙规则的。可以实现私有且未共享，他还有一个参数小写z就是实现公共共享。
716d0ee1f47e721a140c3356874ab33f86de18376f4af2d0f048e5d413667922
[kang@localhost ~]$ podman exec -it web1 /bin/bash
root@716d0ee1f47e:/usr/local/apache2# cd /abc
root@716d0ee1f47e:/abc# ls
1  2
root@716d0ee1f47e:/abc# 
这里就实现了目录共享。
这里要想要容器里的目录属组属主都是kang用户，就必须要加--userns=keep-id然后也需要加上：Z。
[kang@localhost ~]$ podman run -dit --name web1 -v /home/kang/abc/:/abc:Z --userns=keep-id busybox
d92edb8c8ce46203fdc0c4320506690e9be4972fe7e09ef5242a5243cac778e9
[kang@localhost ~]$ podman ps
CONTAINER ID  IMAGE                             COMMAND     CREATED        STATUS            PORTS       NAMES
d92edb8c8ce4  docker.io/library/busybox:latest  sh          4 seconds ago  Up 4 seconds ago              web1
[kang@localhost ~]$ id
uid=1004(kang) gid=1004(kang) groups=1004(kang) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[kang@localhost ~]$ podman exec -it web1 /bin/sh
~ $ id
uid=1004(kang) gid=1004(kang)
~ $ cd /abc/
/abc $ ll
/bin/sh: ll: not found
/abc $ ls -l
total 0
-rw-rw-r--    1 kang     kang             0 Aug 17 02:53 1
-rw-rw-r--    1 kang     kang             0 Aug 17 02:53 2
/abc $ 

[kang@localhost ~]$ podman run -dit --name web -p 82:80 httpd
Error: rootlessport cannot expose privileged port 82, you can add 'net.ipv4.ip_unprivileged_port_start=82' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen tcp 0.0.0.0:82: bind: permission denied
[kang@localhost ~]$ 
这里我们想创建一个映射82端口的容器，但是这里报错，无根用户无法创建82端口那他的报错已经提示了net.ipv4.ip_unprivileged_port_start=82把这一行配置加上/etc/sysctl.conf这个配置文件里面。
[root@localhost ~]# vim /etc/sysctl.conf 
#这一步必须要做，就是让配置文件生效
[root@localhost ~]# sysctl -p
net.ipv4.ping_group_range = 0 400000
user.max_user_namespaces = 15000
net.ipv4.ip_unprivileged_port_start = 80
[root@localhost ~]# 
[kang@localhost ~]$ podman run -dit --name web2 -p 81:80 httpd 
abe3a16d3d8a5af7fa1b815f04707ac2ecdc975f043b6cdf4ee6d7d84e69eaa6
[kang@localhost ~]$ ss -antl
State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port Process  
LISTEN  0       128            0.0.0.0:80          0.0.0.0:*             
LISTEN  0       128            0.0.0.0:22          0.0.0.0:*             
LISTEN  0       128                  *:81                *:*             
LISTEN  0       128               [::]:22             [::]:*             
[kang@localhost ~]$