podman案例：通过容器，普通用户生成系统服务，并有权限进行管理

最新推荐文章于 2023-11-24 22:00:00 发布

云梦归遥

最新推荐文章于 2023-11-24 22:00:00 发布

阅读量1.1k

点赞数 1

分类专栏： Linux 文章标签：容器 linux apache

本文链接：https://blog.csdn.net/qq_45834685/article/details/121144765

版权

Linux 专栏收录该内容

10 篇文章 0 订阅

订阅专栏

podman案例：通过容器，普通用户掌握管理服务的权利

1.准备环境：RHEL8.3系统或更高级别的系统（RHEL8.2其实就已经支持了，但是对于服务的开机自启支持不好）

本次实验目的是通过普通用户，也可以拥有掌控服务的权利，而不需要切换为root用户或得到sudo授权。
得益于podman的这一特性，容器也可以晋升为服务单元，并且可以实现开机容器自启，关机容器自动销毁，管理起来和root管理系统服务的感受一模一样。
我现在使用的是RHEL8.3
务必注意：请使用普通用户以SSH形式远程登录系统，否则中途容器在生成服务的时候会出现BUG

[root@rhel-liuyunfei-8-3 ~]# ssh liuyunfei@192.168.159.136
Last failed login: Thu Nov  4 14:33:42 CST 2021 from 192.168.159.136 on ssh:notty
There was 1 failed login attempt since the last successful login.
# 务必以普通用户登录，这才是本次实验所要实现的现象
[liuyunfei@rhel-liuyunfei-8-3 ~]$

2.拉取镜像，创建容器

# 登录红帽官方镜像仓库，获取拉取权限
[liuyunfei@rhel-liuyunfei-8-3 ~]$ podman login registry.redhat.io
Username: feiyunliu
Password:
Login Succeeded!
# 拉取镜像
[liuyunfei@rhel-liuyunfei-8-3 ~]$ podman pull registry.redhat.io/rhel8/httpd-24
Trying to pull registry.redhat.io/rhel8/httpd-24...
Getting image source signatures
Copying blob e9046716b06d done
Copying blob 9ea3e616d557 done
Copying blob 47aa3ed2034c done
Copying blob eac1b95df832 done
Copying config 0d04740850 done
Writing manifest to image destination
Storing signatures
0d04740850e8ba516528b96feea3871e49d858fb684c1a015b2846e4e73dd77e
[liuyunfei@rhel-liuyunfei-8-3 ~]$ podman images
REPOSITORY                         TAG     IMAGE ID      CREATED     SIZE
registry.redhat.io/rhel8/httpd-24  latest  0d04740850e8  8 days ago  462 MB

# 创建外部目录，实现数据持久化
[liuyunfei@rhel-liuyunfei-8-3 ~]$ mkdir -p ~/httpd/html
# 书写测试内容
[liuyunfei@rhel-liuyunfei-8-3 ~]$ echo "By podman I will create a system unit in user level" > ~/httpd/html/index.html
[liuyunfei@rhel-liuyunfei-8-3 ~]$ cat ~/httpd/html/index.html
By podman I will create a system unit in user level

# 启动Apache容器
[liuyunfei@rhel-liuyunfei-8-3 ~]$ podman run -d --name=apache-unit -p 8080:8080 -v ~/httpd:/var/www/:Z registry.redhat.io/rhel8/httpd-24
62c923926631925d8517015debd869647d26a5a3b6e6467e79445d55402033b3
[liuyunfei@rhel-liuyunfei-8-3 ~]$ podman ps
CONTAINER ID  IMAGE                                     COMMAND               CREATED        STATUS            PORTS                   NAMES
62c923926631  registry.redhat.io/rhel8/httpd-24:latest  /usr/bin/run-http...  5 seconds ago  Up 4 seconds ago  0.0.0.0:8080->8080/tcp  apache-unit

2.1访问容器，目前没有问题

[liuyunfei@rhel-liuyunfei-8-3 ~]$ curl http://localhost:8080
By podman I will create a system unit in user level

3.普通用户通过容器创建系统服务

# 必须在用户家目录创建此目录，不能更改名字
[liuyunfei@rhel-liuyunfei-8-3 ~]$ mkdir -p ~/.config/systemd/user
[liuyunfei@rhel-liuyunfei-8-3 ~]$ cd ~/.config/systemd/user
[liuyunfei@rhel-liuyunfei-8-3 user]$ ls
# 此时目录为新创建，是空的

# 注意当前所在路径，使用podman生成系统服务（依照当前容器自动生成）
[liuyunfei@rhel-liuyunfei-8-3 user]$ podman generate systemd --name apache-unit --files --new
/home/liuyunfei/.config/systemd/user/container-apache-unit.service
[liuyunfei@rhel-liuyunfei-8-3 user]$ ls
container-apache-unit.service

# 关闭容器，删除容器
[liuyunfei@rhel-liuyunfei-8-3 user]$ podman stop apache-unit
62c923926631925d8517015debd869647d26a5a3b6e6467e79445d55402033b3
[liuyunfei@rhel-liuyunfei-8-3 user]$ podman rm apache-unit
62c923926631925d8517015debd869647d26a5a3b6e6467e79445d55402033b3
[liuyunfei@rhel-liuyunfei-8-3 user]$ podman ps
CONTAINER ID  IMAGE   COMMAND  CREATED  STATUS  PORTS   NAMES

# 再三提醒：如果不是ssh登录，或者不是重新进入Linux系统的方式，以下内容会出现问题
# 加载一下系统服务
[liuyunfei@rhel-liuyunfei-8-3 user]$ systemctl --user daemon-reload

# 立即启用服务
[liuyunfei@rhel-liuyunfei-8-3 user]$ systemctl --user enable container-apache-unit.service --now
Created symlink /home/liuyunfei/.config/systemd/user/multi-user.target.wants/container-apache-unit.service → /home/liuyunfei/.config/systemd/user/container-apache-unit.service.
Created symlink /home/liuyunfei/.config/systemd/user/default.target.wants/container-apache-unit.service → /home/liuyunfei/.config/systemd/user/container-apache-unit.service.

# 查看服务的状态，已经处于运行状态
[liuyunfei@rhel-liuyunfei-8-3 user]$ systemctl --user status container-apache-unit.service
● container-apache-unit.service - Podman container-apache-unit.service
   Loaded: loaded (/home/liuyunfei/.config/systemd/user/container-apache-unit.service; enabled>
   Active: active (running) since Thu 2021-11-04 15:54:08 CST; 2min 7s ago
     Docs: man:podman-generate-systemd(1)
  Process: 3297 ExecStart=/usr/bin/podman run --conmon-pidfile /run/user/1000/container-apache>
  Process: 3296 ExecStartPre=/bin/rm -f /run/user/1000/container-apache-unit.pid /run/user/100>
 Main PID: 3330 (conmon)
   CGroup: /user.slice/user-1000.slice/user@1000.service/container-apache-unit.service
           ├─3307 /usr/bin/fuse-overlayfs -o lowerdir=/home/liuyunfei/.local/share/containers/>
           ├─3310 /usr/bin/slirp4netns --disable-host-loopback --mtu 65520 --enable-sandbox -->
           ├─3312 containers-rootlessport
           ├─3319 containers-rootlessport-child
           ├─3330 /usr/bin/conmon --api-version 1 -c bc3c0b9b7e0836c6c596483c85a599be0b002f849>
           └─bc3c0b9b7e0836c6c596483c85a599be0b002f849ea85ba5252ae4ae69c96bb6
             ├─3340 httpd -D FOREGROUND
             ├─3380 /usr/bin/coreutils --coreutils-prog-shebang=cat /usr/bin/cat
             ├─3381 /usr/bin/coreutils --coreutils-prog-shebang=cat /usr/bin/cat
             ├─3382 /usr/bin/coreutils --coreutils-prog-shebang=cat /usr/bin/cat
             ├─3383 /usr/bin/coreutils --coreutils-prog-shebang=cat /usr/bin/cat
             ├─3384 httpd -D FOREGROUND
             ├─3385 httpd -D FOREGROUND
             ├─3403 httpd -D FOREGROUND
             └─3404 httpd -D FOREGROUND

# 此时查看是否有容器在运行，本来我们已经手动关闭并删除了此容器，但只要服务启动，就会自动创建新的容器，只要服务关闭，该容器就会自动删除，非常人性化
# 而且此服务不需要root或sudo提权，普通用户即可对其进行控制，使用systemctl命令
[liuyunfei@rhel-liuyunfei-8-3 user]$ podman ps
CONTAINER ID  IMAGE                                     COMMAND               CREATED        STATUS            PORTS                   NAMES
bc3c0b9b7e08  registry.redhat.io/rhel8/httpd-24:latest  /usr/bin/run-http...  2 minutes ago  Up 2 minutes ago  0.0.0.0:8080->8080/tcp  apache-unit

# 服务关闭，容器自动删除，而且还可以做到开机自动创建，关机自动删除
[liuyunfei@rhel-liuyunfei-8-3 user]$ systemctl --user stop container-apache-unit.service
[liuyunfei@rhel-liuyunfei-8-3 user]$ podman ps -a
CONTAINER ID  IMAGE   COMMAND  CREATED  STATUS  PORTS   NAMES

4.设置linger参数，实现开机登录普通用户看到容器

# 设置linger，可以在以普通用户使用“su -”登录时看到容器，否则登录系统找不到容器
[liuyunfei@rhel-liuyunfei-8-3 ~]$ loginctl enable-linger liuyunfei
[liuyunfei@rhel-liuyunfei-8-3 ~]$ loginctl show-user liuyunfei | grep -i linger
Linger=yes

# 就可以看到容器，但是你会发现无法用systemctl管理容器，是因为不是使用ssh登录
[liuyunfei@rhel-liuyunfei-8-3 ~]$ podman ps
CONTAINER ID  IMAGE                                     COMMAND               CREATED         STATUS             PORTS                   NAMES
32f311465555  registry.redhat.io/rhel8/httpd-24:latest  /usr/bin/run-http...  11 minutes ago  Up 11 minutes ago  0.0.0.0:8080->8080/tcp  apache-unit

5.使用ssh登录，与”su -“普通用户不同，区别在于是否可以使用systemctl管理服务

# ======================= su -模式 =======================
# 发现再使用tab补齐的时候，无法补齐，必须使用ssh登录才行
[liuyunfei@rhel-liuyunfei-8-3 ~]$ systemctl --user status con......

# ======================= ssh 模式 =======================
[liuyunfei@rhel-liuyunfei-8-3 ~]$ systemctl --user status container-apache-unit.service
● container-apache-unit.service - Podman container-apache-unit.service
   Loaded: loaded (/home/liuyunfei/.config/systemd/user/container-apache-unit.service; enabled>
   Active: active (running) since Thu 2021-11-04 16:40:14 CST; 13min ago
     Docs: man:podman-generate-systemd(1)
  Process: 1488 ExecStart=/usr/bin/podman run --conmon-pidfile /run/user/1000/container-apache>
  Process: 1483 ExecStartPre=/bin/rm -f /run/user/1000/container-apache-unit.pid /run/user/100>
 Main PID: 1681 (conmon)
   CGroup: /user.slice/user-1000.slice/user@1000.service/container-apache-unit.service
           ├─1640 /usr/bin/slirp4netns --disable-host-loopback --mtu 65520 --enable-sandbox -->
           ├─1649 containers-rootlessport
           ├─1650 /usr/bin/fuse-overlayfs -o lowerdir=/home/liuyunfei/.local/share/containers/>
           ├─1663 containers-rootlessport-child
           ├─1681 /usr/bin/conmon --api-version 1 -c 32f311465555ebece4e12f30517e3272af12bd140>
           └─32f311465555ebece4e12f30517e3272af12bd140d58cab3eb7d47c2a5fc0193
             ├─1694 httpd -D FOREGROUND
             ├─2040 /usr/bin/coreutils --coreutils-prog-shebang=cat /usr/bin/cat
             ├─2061 /usr/bin/coreutils --coreutils-prog-shebang=cat /usr/bin/cat
             ├─2062 /usr/bin/coreutils --coreutils-prog-shebang=cat /usr/bin/cat
             ├─2063 /usr/bin/coreutils --coreutils-prog-shebang=cat /usr/bin/cat
             ├─2064 httpd -D FOREGROUND
             ├─2066 httpd -D FOREGROUND
             ├─2067 httpd -D FOREGROUND
             └─2068 httpd -D FOREGROUND