podman

最新推荐文章于 2024-06-11 14:49:12 发布

战战7

最新推荐文章于 2024-06-11 14:49:12 发布

阅读量1.2k

点赞数

文章标签：容器

本文链接：https://blog.csdn.net/qq_57006788/article/details/124679501

版权

podman的工作原理

Podman 是一个开源的容器运行时项目，可在大多数 Linux 平台上使用。Podman 提供与 Docker 非常相似的功能。正如前面提到的那样，它不需要在你的系统上运行任何守护进程，并且它也可以在没有 root 权限的情况下运行。

Podman 可以管理和运行任何符合 OCI（Open Container Initiative）规范的容器和容器镜像。Podman 提供了一个与 Docker 兼容的命令行前端来管理 Docker 镜像。

Podman的使用与docker有什么区别？

podman的定位也是与docker兼容，因此在使用上面尽量靠近docker。在使用方面，可以分成两个方面来说，一是系统构建者的角度，二是使用者的角度。

在系统构建者方面，用podman的默认软件，与docker的区别不大，只是在进程模型、进程关系方面有所区别。如果习惯了docker几个关联进程的调试方法，在podman中则需要适应。可以通过pstree命令查看进程的树状结构。总体来看，podman比docker要简单。由于podman比docker少了一层daemon，因此重启的机制也就不同了。

在使用者方面，podman与docker的命令基本兼容，都包括容器运行时（run/start/kill/ps/inspect），本地镜像（images/rmi/build）、镜像仓库（login/pull/push）等几个方面。因此podman的命令行工具与docker类似，比如构建镜像、启停容器等。甚至可以通过alias docker=podman可以进行替换。因此，即便使用了podman，仍然可以使用docker.io作为镜像仓库，这也是兼容性最关键的部分。

podman的常用命令

podman run          创建并启动容器
podman start       #启动容器
podman ps          #查看容器
podman stop        #终止容器
podman restart     #重启容器
podman attach      #进入容器
podman exec        #进入容器
podman export      #导出容器
podman import      #导入容器快照
podman rm          #删除容器
podman logs        #查看日志
podman search      #检索镜像
docke pull         #获取镜像
podman images      #列出镜像
podman image Is    #列出镜像
podman rmi         #删除镜像
podman image rm    #删除镜像
podman save        #导出镜像
podman load        #导入镜像
podmanfile         #定制镜像（三个）
podman build       #构建镜像
podman run         #运行镜像
podmanfile         #常用指令（四个）
COPY               #复制文件
ADD                #高级复制
CMD                #容器启动命令
ENV                #环境变量
EXPOSE             #暴露端口

podman的应用

//安装podman
[root@localhost ~]# yum -y install podman
[root@localhost ~]# which podman
/usr/bin/podman

//配置加速器
[root@localhost ~]# cd /etc/containers/
[root@localhost containers]# ls
  certs.d  policy.json      registries.conf.d  storage.conf
[root@localhost containers]# vim registries.conf
#unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "registry.centos.org", "docker.io"]
unqualified-search-registries = [ "docker.io"]
[[registry]]
prefix = "docker.io"
location = "sl4ks7g2.mirror.aliyuncs.com
[root@localhost containers]# podman info  //查看是否配置成功
  ...
  registries:
    docker.io:
      Blocked: false
      Insecure: false
      Location: bxrtqrie.mirror.aliyuncs.com
      MirrorByDigestOnly: false
      Mirrors: null
      Prefix: docker.io
    search:
    - docker.io


//运行容器
[root@localhost ~]# podman run -d --name web -p 80:80 httpd
Resolving "httpd" using unqualified-search registries (/etc/containers/registries.conf)
Trying to pull docker.io/library/httpd:latest...
Getting image source signatures
Copying blob d982c879c57e done  
Copying blob 67283bbdd4a0 done  
Copying blob dcc4698797c8 done  
Copying blob 41c22baa66ec done  
Copying blob a2abf6c4d29d done  
Copying config dabbfbe0c5 done  
Writing manifest to image destination
Storing signatures
9f716e5c1f695af4288e88128c56369902113627dd289f69b0d56aa5334f68ff
[root@localhost ~]# podman ps    //查看正在进行的容器
CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS               NAMES
9f716e5c1f69  docker.io/library/httpd:latest  httpd-foreground  3 minutes ago  Up 3 minutes ago  0.0.0.0:80->80/tcp  web
[root@localhost ~]# podman images    //查看镜像
REPOSITORY               TAG         IMAGE ID      CREATED       SIZE
docker.io/library/httpd  latest      dabbfbe0c57b  4 months ago  148 MB
[root@localhost ~]# podman ps -a    //列出所有容器
CONTAINER ID  IMAGE                           COMMAND           CREATED        STATUS            PORTS               NAMES
9f716e5c1f69  docker.io/library/httpd:latest  httpd-foreground  5 minutes ago  Up 5 minutes ago  0.0.0.0:80->80/tcp  web
[root@localhost ~]# podman inspect -l |grep -i ipaddr   //查看最近容器的ip地址   
            "IPAddress": "10.88.0.2", 
                    "IPAddress": "10.88.0.2",
[root@localhost ~]# podman logs -l                     //查看最近一个容器日志
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.2. Set the 'ServerName' directive globally to suppress this message
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.2. Set the 'ServerName' directive globally to suppress this message
[Mon May 09 19:34:37.083143 2022] [mpm_event:notice] [pid 1:tid 140292517489984] AH00489: Apache/2.4.52 (Unix) configured -- resuming normal operations
[Mon May 09 19:34:37.083248 2022] [core:notice] [pid 1:tid 140292517489984] AH00094: Command line: 'httpd -D FOREGROUND'
192.168.74.1 - - [09/May/2022:19:37:59 +0000] "GET / HTTP/1.1" 200 45
192.168.74.1 - - [09/May/2022:19:37:59 +0000] "GET /favicon.ico HTTP/1.1" 404 196
192.168.74.1 - - [09/May/2022:19:38:51 +0000] "-" 408 -
[root@localhost ~]# 
[root@localhost ~]# podman rm -f -l         //删除最近一个容器
9f716e5c1f695af4288e88128c56369902113627dd289f69b0d56aa5334f68ff
[root@localhost ~]# podman ps -a
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
[root@localhost ~]# 
[root@localhost ~]# podman run -d httpd
67276f11f9633d147541f775d7fdc46fa3b0e58e0ce5caa33005c56d1c2acb7e
[root@localhost ~]# podman top -l
USER        PID         PPID        %CPU        ELAPSED       TTY         TIME        COMMAND
root        1           0           0.000       3.287691446s  ?           0s          httpd -DFOREGROUND 
www-data    7           1           0.000       3.287827195s  ?           0s          httpd -DFOREGROUND 
www-data    8           1           0.000       3.287862803s  ?           0s          httpd -DFOREGROUND 
www-data    9           1           0.000       3.287898633s  ?           0s          httpd -DFOREGROUND

用podmanfile制作镜像

[root@localhost ~]# podman pull busybox    //拉镜像
Resolved "busybox" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/busybox:latest...
Getting image source signatures
Copying blob 5cc84ad355aa done  
Copying config beae173cca done  
Writing manifest to image destination
Storing signatures
beae173ccac6ad749f76713cf4440fe3d21d1043fe616dfbe30775815d1d0f6a
[root@localhost ~]# ls
anaconda-ks.cfg
[root@localhost ~]# mkdir test
[root@localhost ~]# cd test/
[root@localhost test]# ls
[root@localhost test]# vim Podmanfile
[root@localhost test]# cat Podmanfile 
FROM busybox

ENV a 10

[root@localhost test]# podman build -f Podmanfile -t test:v0.1 .
STEP 1/2: FROM busybox
STEP 2/2: ENV a 10
COMMIT test:v0.1
--> 1188ca08b0a
Successfully tagged localhost/test:v0.1
1188ca08b0a7c7491749d459a4c731bb8d1b80f6c263186222d2c89f2fea049e
[root@localhost test]# 
[root@localhost test]# podman run -it test:v0.1 /bin/sh
/ # echo $a
10
/ # exit

上传镜像

//修改镜像名
[root@localhost ~]# podman tag localhost/test:v0.1 docker.io/zhanzhan777/busybox:1005    
[root@localhost ~]# podman images
REPOSITORY                     TAG         IMAGE ID      CREATED         SIZE
localhost/test                 v0.1        1188ca08b0a7  12 minutes ago  1.46 MB
docker.io/zhanzhan777/busybox  1005        1188ca08b0a7  12 minutes ago  1.46 MB
docker.io/library/busybox      latest      beae173ccac6  4 months ago    1.46 MB
docker.io/library/httpd        latest      dabbfbe0c57b  4 months ago    148 MB
[root@localhost ~]# 
[root@localhost ~]# podman login docker.io    //登录官方仓库上传镜像

Username: zhanzhan777
Password: 
Login Succeeded!
[root@localhost ~]# podman images
REPOSITORY                     TAG         IMAGE ID      CREATED         SIZE
localhost/test                 v0.1        1188ca08b0a7  16 minutes ago  1.46 MB
docker.io/zhanzhan777/busybox  1005        1188ca08b0a7  16 minutes ago  1.46 MB
docker.io/library/busybox      latest      beae173ccac6  4 months ago    1.46 MB
docker.io/library/httpd        latest      dabbfbe0c57b  4 months ago    148 MB
[root@localhost ~]# podman push docker.io/zhanzhan777/busybox:1005
Getting image source signatures
Copying blob 01fd6df81c8e done  
Copying config 1188ca08b0 done  
Writing manifest to image destination
Storing signatures
[root@localhost ~]# alias docker='podman'   //设置别名
[root@localhost ~]# docker images
REPOSITORY                     TAG         IMAGE ID      CREATED         SIZE
localhost/test                 v0.1        1188ca08b0a7  22 minutes ago  1.46 MB
docker.io/zhanzhan777/busybox  1005        1188ca08b0a7  22 minutes ago  1.46 MB
docker.io/library/busybox      latest      beae173ccac6  4 months ago    1.46 MB
docker.io/library/httpd        latest      dabbfbe0c57b  4 months ago    148 MB
[root@localhost ~]# 
[root@localhost ~]# rpm -qa|grep crun
[root@localhost ~]# dnf list all|grep crun
crun.x86_64                                            1.0-1.module+el8.5.0+12582+56d94c81                    AppStream    
[root@localhost ~]# dnf -y install crun
[root@localhost containers]# cd /usr/share/containers/
[root@localhost containers]# ls
containers.conf  mounts.conf  seccomp.json  selinux
[root@localhost containers]# vim containers.conf 
runtime = "crun"    //取消注释
#runtime = "runc"   //注释
[root@localhost containers]# podman run -d httpd
47b02cf39876d0555e908fadff0fd197d1a82bd36617988cc32f336e19c39744
[root@localhost containers]# podman inspect -l|grep -i runtime
        "OCIRuntime": "crun",
            "--runtime",
            "Runtime": "oci",
            "CpuRealtimeRuntime": 0,
[root@localhost containers]# dnf list all|grep slir
libslirp.x86_64                                        4.4.0-1.module+el8.5.0+12582+56d94c81                  @AppStream   
slirp4netns.x86_64                                     1.1.8-1.module+el8.5.0+12582+56d94c81                  @AppStream   
libslirp-devel.x86_64                                  4.4.0-1.module+el8.5.0+12582+56d94c81                  AppStream    
[root@localhost containers]# dnf -y install slirp4netns
[root@localhost containers]# dnf -y install fuse-overlayfs

[root@localhost ~]# cd /etc/containers/
[root@localhost containers]# ls
certs.d  oci  policy.json  registries.conf  registries.conf.d  registries.d  storage.conf
[root@localhost containers]# vim storage.conf 
mount_program = "/usr/bin/fuse-overlayfs"   //取消注释


[root@localhost containers]# dnf list all|grep shadow
shadow-utils.x86_64                                    2:4.6-14.el8                                           @anaconda    
[root@localhost containers]# rpm -qa|grep shadow
shadow-utils-4.6-14.el8.x86_64
[root@localhost containers]# cat /etc/subuid
[root@localhost containers]# cat /etc/subgid
[root@localhost containers]# useradd tom
[root@localhost containers]# cat /etc/subuid
tom:100000:65536
[root@localhost containers]# cat /etc/subgid
tom:100000:65536
[root@localhost ~]# vim /etc/sysctl.conf    //永久生效
[root@localhost ~]# cat /etc/sysctl.conf
# sysctl settings are defined through files in
# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
#
# Vendors settings live in /usr/lib/sysctl.d/.
# To override a whole file, create a new file with the same in
# /etc/sysctl.d/ and put new settings there. To override
# only specific settings, add a file with a lexically later
# name in /etc/sysctl.d/ and put new settings there.
#
# For more information, see sysctl.conf(5) and sysctl.d(5).
net.ipv4.ping_group_range=0 200000 
[root@localhost ~]# sysctl -p   //立即生效
net.ipv4.ping_group_range = 0 200000

普通用户使用podman

//普通用户
[tom@localhost ~]$ podman images
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE
[tom@localhost ~]$ podman pull busybox
Resolved "busybox" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/busybox:latest...
Getting image source signatures
Copying blob 5cc84ad355aa done  
Copying config beae173cca done  
Writing manifest to image destination
Storing signatures
beae173ccac6ad749f76713cf4440fe3d21d1043fe616dfbe30775815d1d0f6a
[tom@localhost ~]$ podman images
REPOSITORY                 TAG         IMAGE ID      CREATED       SIZE
docker.io/library/busybox  latest      beae173ccac6  4 months ago  1.46 MB
[tom@localhost ~]$ podman run -it --rm busybox /bin/sh
/ # 
//root账户
[root@localhost ~]# podman ps   //不能查看，每个用户只能管理自己的
CONTAINER ID  IMAGE                           COMMAND           CREATED            STATUS                PORTS      httpd-foreground  About an hour ago  Up About an hour ago              nostalgic_blackburn

卷

容器与root用户一起运行，则root容器中的用户实际上就是主机上的用户。
UID GID是在/etc/subuid和/etc/subgid等中用户映射中指定的第一个UID GID。
如果普通用户的身份从主机目录挂载到容器中，并在该目录中以根用户身份创建文件，则会看到它实际上是你的用户在主机上拥有的。

[tom@localhost ~]$ mkdir data
[tom@localhost ~]$ ls
data
[tom@localhost ~]$ ll
total 0
drwxrwxr-x. 2 tom tom 6 May 10 06:00 data
[tom@localhost ~]$ pwd
/home/tom
//要加一个Z，表示放行selinux规则
[tom@localhost ~]$ podman run -it --rm -v $(pwd)/data:/data:Z  busybox /bin/sh
/ # 
/ # ls
bin   data  dev   etc   home  proc  root  run   sys   tmp   usr   var
/ # cd /data/
/data # ls
/data # touch abc
/data # ls -l
total 0
-rw-r--r--    1 root     root             0 May  9 22:10 abc
/data # 
[tom@localhost ~]$ ll data/
total 0
-rw-r--r--. 1 tom tom 0 May 10 06:10 abc
[tom@localhost ~]$ echo 'hello world' >data/abc
[tom@localhost ~]$ 
/data # cat abc
hello world
[tom@localhost ~]$ podman run -d --name web -p 80:80 httpd
Resolving "httpd" using unqualified-search registries (/etc/containers/registries.conf)
Trying to pull docker.io/library/httpd:latest...
Getting image source signatures
Copying blob d982c879c57e done  
Copying blob a2abf6c4d29d done  
Copying blob dcc4698797c8 done  
Copying blob 41c22baa66ec done  
Copying blob 67283bbdd4a0 done  
Copying config dabbfbe0c5 done  
Writing manifest to image destination
Storing signatures
Error: rootlessport cannot expose privileged port 80, you can add 'net.ipv4.ip_unprivileged_port_start=80' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen tcp 0.0.0.0:80: bind: permission denied
//这种报错用8080能解决
[tom@localhost ~]$ podman run -d --name web -p 8080:80 httpd
733f154fa3fd9442f9642e5a39a7fae601fe6e2eb1f251c8153a8348a5ae940c

//如果必须要用80，需要切换root用户
[root@localhost ~]#  vim /etc/sysctl.conf 
net.ipv4.ip_unprivileged_port_start=80   //添加此行
[root@localhost ~]# sysctl -p
net.ipv4.ping_group_range = 0 200000
user.max_user_namespaces = 15000
net.ipv4.ip_unprivileged_port_start = 80
[root@localhost ~]# sysctl -p    //让它生效
net.ipv4.ping_group_range = 0 200000
user.max_user_namespaces = 15000
net.ipv4.ip_unprivileged_port_start = 8


[tom@localhost ~]$ podman run -d --name web -p 80:80 httpd
b35c86239ede94d50b842ac4c067f7d88a4c2f0dc2fdfd3cb1f82d953ab4fbaa
[tom@localhost ~]$ podman ps
CONTAINER ID  IMAGE                           COMMAND           CREATED         STATUS             PORTS               NAMES
b35c86239ede  docker.io/library/httpd:latest  httpd-foreground  38 seconds ago  Up 38 seconds ago  0.0.0.0:80->80/tcp  web

战战7

关注

0
点赞
踩
3

收藏

觉得还不错? 一键收藏
0
评论
podman

podman的工作原理Podman 是一个开源的容器运行时项目，可在大多数 Linux 平台上使用。Podman 提供与 Docker 非常相似的功能。正如前面提到的那样，它不需要在你的系统上运行任何守护进程，并且它也可以在没有 root 权限的情况下运行。Podman 可以管理和运行任何符合 OCI（Open Container Initiative）规范的容器和容器镜像。Podman 提供了一个与 Docker 兼容的命令行前端来管理 Docker 镜像。Podman的使用与docker.
复制链接

扫一扫