Podman之Podman容器基础

Podman之Podman容器基础

1. 什么是podman

Podman 原来是 CRI-O 项目的一部分，后来被分离成一个单独的项目叫 libpod。Podman 的使用体验和 Docker 类似，不同的是 Podman 没有 daemon。以前使用 Docker CLI 的时候，Docker CLI 会通过 gRPC API 去跟 Docker Engine 说「我要启动一个容器」，然后 Docker Engine 才会通过 OCI Container runtime（默认是 runc）来启动一个容器。这就意味着容器的进程不可能是 Docker CLI 的子进程，而是 Docker Engine 的子进程。

Podman 比较简单粗暴，它不使用 Daemon，而是直接通过 OCI runtime（默认也是 runc）来启动容器，所以容器的进程是 podman 的子进程。这比较像 Linux 的 fork/exec 模型，而 Docker 采用的是 C/S（客户端/服务器）模型。

2. 安装与使用podman

2.1 安装

[root@podman ~]# dnf -y install podman

//定义别名
[root@podman ~]# alias docker=podman 
[root@podman ~]# docker images 
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE
[root@podman ~]# podman images 
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE

2.2 podman的使用

2.2.1 podman基础命令

search 查找镜像

[root@podman ~]# podman search httpd --filter=is-official //指定查找官方版本的httpd
INDEX       NAME                     DESCRIPTION                     STARS       OFFICIAL    AUTOMATED
docker.io   docker.io/library/httpd  The Apache HTTP Server Project  3794        [OK] 

podman pull 拉取镜像

[root@podman ~]# podman images 
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE

[root@podman ~]# podman pull docker.io/library/nginx 
Trying to pull docker.io/library/nginx:latest...
Getting image source signatures
Copying blob 44be98c0fab6 done  
Copying blob ed835de16acd done  
Copying blob e5ae68f74026 done  
Copying blob 21e0df283cd6 done  
Copying blob 881ff011f1c9 done  
Copying blob 77700c52c969 done  
Copying config f652ca386e done  
Writing manifest to image destination
Storing signatures
f652ca386ed135a4cbe356333e08ef0816f81b2ac8d0619af01e2b256837ed3e

podman images 显示所有镜像

[root@podman ~]# podman images 
REPOSITORY               TAG         IMAGE ID      CREATED      SIZE
docker.io/library/nginx  latest      f652ca386ed1  11 days ago  146 MB

podman run 运行容器

[root@podman ~]# podman run -it --rm --name nginx docker.io/library/nginx
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration

podman ps 列出正在运行的容器

[root@podman ~]# podman  ps 
CONTAINER ID  IMAGE                           COMMAND               CREATED         STATUS             PORTS       NAMES
32955d96f3e4  docker.io/library/nginx:latest  nginx -g daemon o...  25 seconds ago  Up 25 seconds ago              nginx

//如果添加 -a 命令，Podman 将显示所有容器（已创建、已退出、正在运行等）
[root@podman ~]# podman  ps -a 
CONTAINER ID  IMAGE                           COMMAND               CREATED             STATUS                 PORTS       NAMES
32955d96f3e4  docker.io/library/nginx:latest  nginx -g daemon o...  About a minute ago  Up About a minute ago              nginx

podman inspect 查看容器详细信息

[root@podman ~]# podman inspect 32955d96f3e4
[
    {
        "Id": "32955d96f3e46e98042ea887bab13529215b0536959bdf988f627b25b2501fd1",
        "Created": "2021-12-14T05:23:57.191968767-05:00",
        "Path": "/docker-entrypoint.sh",
        "Args": [
            "nginx",
            "-g",
            "daemon off;"
.......

// -l 查看最新信息
[root@podman ~]# podman inspect -l | grep -i ipaddress
            "IPAddress": "10.88.0.2",
                    "IPAddress": "10.88.0.2",

podman logs 查看容器日志

[root@podman ~]# podman logs -l //查看最新容器日志
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2021/12/14 10:23:57 [notice] 1#1: using the "epoll" event method
2021/12/14 10:23:57 [notice] 1#1: nginx/1.21.4
2021/12/14 10:23:57 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6) 
2021/12/14 10:23:57 [notice] 1#1: OS: Linux 4.18.0-257.el8.x86_64
2021/12/14 10:23:57 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2021/12/14 10:23:57 [notice] 1#1: start worker processes
2021/12/14 10:23:57 [notice] 1#1: start worker process 26
2021/12/14 10:23:57 [notice] 1#1: start worker process 27
2021/12/14 10:23:57 [notice] 1#1: start worker process 28
2021/12/14 10:23:57 [notice] 1#1: start worker process 29

podman top 查看容器的 pids

[root@podman ~]# podman top 32955d96f3e4
USER        PID         PPID        %CPU        ELAPSED           TTY         TIME        COMMAND
root        1           0           0.000       11m13.821628928s  pts/0       0s          nginx: master process nginx -g daemon off; 
nginx       26          1           0.000       11m13.822843688s  pts/0       0s          nginx: worker process 
nginx       27          1           0.000       11m13.823501411s  pts/0       0s          nginx: worker process 
nginx       28          1           0.000       11m13.823698742s  pts/0       0s          nginx: worker process 
nginx       29          1           0.000       11m13.823936194s  pts/0       0s          nginx: worker process 
[root@podman ~]# podman top -l //查看最新容器
USER        PID         PPID        %CPU        ELAPSED           TTY         TIME        COMMAND
root        1           0           0.000       11m23.09833528s   pts/0       0s          nginx: master process nginx -g daemon off; 
nginx       26          1           0.000       11m23.098725746s  pts/0       0s          nginx: worker process 
nginx       27          1           0.000       11m23.098964414s  pts/0       0s          nginx: worker process 
nginx       28          1           0.000       11m23.099398944s  pts/0       0s          nginx: worker process 
nginx       29          1           0.000       11m23.099511946s  pts/0       0s          nginx: worker process 

podman stop 停止容器

[root@podman ~]# podman stop 32955d96f3e4
32955d96f3e4
[root@podman ~]# podman ps 
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES

podman start 启动容器

[root@podman ~]# podman  start 32ae6ac14292
32ae6ac14292
[root@podman ~]# podman  ps 
CONTAINER ID  IMAGE                           COMMAND               CREATED         STATUS            PORTS       NAMES
32ae6ac14292  docker.io/library/nginx:latest  nginx -g daemon o...  28 seconds ago  Up 9 seconds ago              nginx

podman rm 删除容器

//-f 强制删除
[root@podman ~]# podman  rm  -f 32ae6ac14292
32ae6ac142924c9c1844ed3ec4ac7704f0c881adcd1df87e79bdbcb389820d75
[root@podman ~]# podman ps -a 
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES

podman rmi 删除镜像

//-f 强制删除
[root@podman ~]# podman  images 
REPOSITORY               TAG         IMAGE ID      CREATED      SIZE
docker.io/library/nginx  latest      f652ca386ed1  12 days ago  146 MB
[root@podman ~]# podman rmi -f f652ca386ed1 
Untagged: docker.io/library/nginx:latest
Deleted: f652ca386ed135a4cbe356333e08ef0816f81b2ac8d0619af01e2b256837ed3e
[root@podman ~]# podman  images 
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE

podman tag 修改标签（改名）

[root@podman ~]# podman  images 
REPOSITORY               TAG         IMAGE ID      CREATED      SIZE
docker.io/library/httpd  latest      ea28e1b82f31  12 days ago  148 MB
[root@podman ~]# podman tag docker.io/library/httpd:latest docker.io/library/httpd:v0.1
[root@podman ~]# podman  images 
REPOSITORY               TAG         IMAGE ID      CREATED      SIZE
docker.io/library/httpd  latest      ea28e1b82f31  12 days ago  148 MB
docker.io/library/httpd  v0.1        ea28e1b82f31  12 days ago  148 MB

2.2.2普通用户使用podman的方式

在允许没有root特权的用户运行Podman之前，管理员必须安装或构建Podman并完成以下配置

cgroup V2Linux内核功能允许用户限制普通用户容器可以使用的资源，如果使用cgroup V2启用了运行Podman的Linux发行版，则可能需要更改默认的OCI运行时。某些较旧的版本runc不适用于cgroup V2，必须切换到备用OCI运行时crun。

[root@podman ~]# dnf -y install crun

//可以使用–runtime选项在命令行中打开对cgroup V2的替代OCI运行时支持
[root@podman ~]# podman --runtime crun

//也可以修改containers.conf文件runtime = "runc"到runtime = “crun”
[root@podman ~]# vim /usr/share/containers/containers.conf
.....
# Default OCI runtime
#
runtime = "crun"
#runtime = "runc"
.....

安装slirp4netns

slirp4nets包为普通用户提供一种网络模式

[root@podman ~]# dnf -y install slirp4netns

安装fuse-overlayfs

在普通用户环境中使用Podman时，建议使用fuse-overlayfs而不是VFS文件系统，至少需要版本0.7.6。

[root@podman ~]# dnf -y install fuse-overlayfs

//配置storage.conf文件
[root@podman ~]# vim /etc/containers/storage.conf
...
# Path to an helper program to use for mounting the file system instead of mounting it
# directly.
mount_program = "/usr/bin/fuse-overlayfs"
...

// /etc/subuid和/etc/subgid配置
[root@podman ~]# useradd xym 
[root@podman ~]# cat /etc/subuid
xym:100000:65536
[root@podman ~]# cat /etc/subgid
xym:100000:65536

使用卷

[xym@podman ~]$ podman run -itd -v "$(pwd)"/test:/test:Z docker.io/library/busybox /bin/sh 
9e6fef2dd3a7775ab567c622e5c36c5e4be99a181f38512c1d1efa593b61b912

[xym@podman ~]$ podman  ps 
CONTAINER ID  IMAGE                             COMMAND     CREATED         STATUS             PORTS       NAMES
9e6fef2dd3a7  docker.io/library/busybox:latest  /bin/sh     12 seconds ago  Up 12 seconds ago              hungry_jennings

[xym@podman ~]$ podman exec -it 9e6fef2dd3a7 /bin/sh 
/ # cd test/
/test # touch ss
/test # ls
ss
/test # exit 
[xym@podman ~]$ ls test/
ss

2.2.3 podman容器的开机自启

[root@podman ~]# podman generate --help
Generate structured data based on containers, pods or volumes

Description:
  Generate structured data (e.g., Kubernetes YAML or systemd units) based on containers, pods or volumes.

Usage:
  podman generate [command]

Available Commands:
  kube        Generate Kubernetes YAML from containers, pods or volumes.
  systemd     Generate systemd units.


[root@podman ~]# podman generate  systemd --help
Generate systemd units.

Description:
  Generate systemd units for a pod or container.
  The generated units can later be controlled via systemctl(1).

Usage:
  podman generate systemd [options] {CONTAINER|POD}

Examples:
  podman generate systemd CTR
  podman generate systemd --new --time 10 CTR
  podman generate systemd --files --name POD

Options:
      --container-prefix string   Systemd unit name prefix for containers (default "container")
  -f, --files                     Generate .service files instead of printing to stdout
      --format string             Print the created units in specified format (json)
  -n, --name                      Use container/pod names instead of IDs
      --new                       Create a new container or pod instead of starting an existing one
      --no-header                 Skip header generation
      --pod-prefix string         Systemd unit name prefix for pods (default "pod")
      --restart-policy string     Systemd restart-policy (default "on-failure")
      --separator string          Systemd unit name separator between name/id and prefix (default "-")
  -t, --time uint                 Stop timeout override (default 10)

root podman容器自启动

[root@podman ~]# podman run -d --rm --name nginx nginx 
✔ docker.io/library/nginx:latest
Trying to pull docker.io/library/nginx:latest...
Getting image source signatures
Copying blob e5ae68f74026 skipped: already exists  
Copying blob ed835de16acd done  
Copying blob 881ff011f1c9 done  
Copying blob 77700c52c969 done  
Copying blob 44be98c0fab6 done  
Copying blob 21e0df283cd6 done  
Copying config f652ca386e done  
Writing manifest to image destination
Storing signatures
7e2800ce33e5b717f252b6f31bd8b05250568d1b549432bc34689f952c993124

[root@podman system]# podman  generate systemd --files --name ngx 
/usr/lib/systemd/system/container-nginx.service

[root@podman system]# systemctl status container-nginx.service
● container-nginx.service - Podman container-nginx.service
   Loaded: loaded (/usr/lib/systemd/system/container-nginx.servi
   Active: inactive (dead)
     Docs: man:podman-generate-systemd(1)
lines 1-4/4 (END)

● container-nginx.service - Podman container-nginx.service
   Loaded: loaded (/usr/lib/systemd/system/container-nginx.ser>
   Active: inactive (dead)
     Docs: man:podman-generate-systemd(1)

[root@podman ~]# systemctl enable --now container-nginx 
Created symlink /etc/systemd/system/multi-user.target.wants/container-nginx.service → /usr/lib/systemd/system/container-nginx.service.
Created symlink /etc/systemd/system/default.target.wants/container-nginx.service → /usr/lib/systemd/system/container-nginx.service.

[root@podman ~]# systemctl status container-nginx.service
● container-nginx.service - Podman container-nginx.service
   Loaded: loaded (/usr/lib/systemd/system/container-nginx.ser>
   Active: active (running) since Wed 2021-12-15 06:15:05 EST;>
     Docs: man:podman-generate-systemd(1)
  Process: 2859 ExecStart=/usr/bin/podman start nginx (code=ex>
 Main PID: 2735 (conmon)
    Tasks: 0 (limit: 23486)
   Memory: 1.6M
   CGroup: /system.slice/container-nginx.service
           ‣ 2735 /usr/bin/conmon --api-version 1 -c f70381d4a>

Dec 15 06:15:04 podman systemd[1]: Starting Podman container-n>
Dec 15 06:15:05 podman systemd[1]: Started Podman container-ng>

非跟用户容器开机自启

[xym@podman ~]$ podman run -itd --name nginx nginx 
✔ docker.io/library/nginx:latest
Trying to pull docker.io/library/nginx:latest...
Getting image source signatures
Copying blob 44be98c0fab6 done  
Copying blob ed835de16acd done  
Copying blob 881ff011f1c9 done  
Copying blob 77700c52c969 done  
Copying blob e5ae68f74026 done  
Copying blob 21e0df283cd6 done  
Copying config f652ca386e done  
Writing manifest to image destination
Storing signatures
d2ccf52d01b57c6cde3a9d27d82e614c218cb632eb7107f3b32c80638fc0df97

[xym@podman ~]$ podman  ps 
CONTAINER ID  IMAGE                           COMMAND               CREATED         STATUS             PORTS       NAMES
d2ccf52d01b5  docker.io/library/nginx:latest  nginx -g daemon o...  32 seconds ago  Up 32 seconds ago              nginx

[xym@podman ~]$ mkdir -p ~/.config/systemd/user 
[xym@podman ~]$ podman generate systemd --name nginx --files --new 
/home/xym/container-nginx.service
[xym@podman ~]$ mv container-nginx.service ~/.config/systemd/user/

普通用户设置开机自启

[xym@podman ~]$ sudo systemctl --user daemon-reload 

[sudo] password for xym: 
sudo: 3 incorrect password attempts

[xym@podman ~]$ systemctl --user enable --now container-nginx 
Created symlink /home/xym/.config/systemd/user/multi-user.target.wants/container-nginx.service → /home/xym/.config/systemd/user/container-nginx.service.
Unit /home/xym/.config/systemd/user/container-nginx.service is added as a dependency to a non-existent unit multi-user.target.
Created symlink /home/xym/.config/systemd/user/default.target.wants/container-nginx.service → /home/xym/.config/systemd/user/container-nginx.service.


[xym@podman ~]$ systemctl --user status container-nginx.service 
● container-nginx.service - Podman container-nginx.service
   Loaded: loaded (/home/xym/.config/systemd/user/container-ng>
   Active: active (running) since Wed 2021-12-15 06:36:12 EST;>
     Docs: man:podman-generate-systemd(1)
  Process: 4665 ExecStartPre=/bin/rm -f /run/user/1000/contain>
 Main PID: 4709 (conmon)
   CGroup: /user.slice/user-1000.slice/user@1000.service/conta>
           ├─4703 /usr/bin/fuse-overlayfs -o ,lowerdir=/home/x>
           ├─4706 /usr/bin/slirp4netns --disable-host-loopback>
           ├─4709 /usr/bin/conmon --api-version 1 -c b1e854bab>
           ├─4712 nginx: master process nginx -g daemon off;
           ├─4738 nginx: worker process
           ├─4739 nginx: worker process
           ├─4740 nginx: worker process
           └─4741 nginx: worker process

2.2.4 podman网络

rootfull和rootless容器网络之间的差异

podman容器联网的指导因素之一将是容器是否由root用户运行。这是因为非特权用户无法在主机上创建网络接口。因此，对于rootfull容器，默认网络模式是使用容器网络接口(CNI)插件，特别是桥接插件。对于rootless，默认的网络模式是slir4netns。由于权限有限，slirnetns缺少CNI组网的一些功能；例如，slirp4netns无法为容器提供可路由的IP地址。cni是容器网络接口。

三部曲

• podman network create 创建网络
• 修改 /etc/cni/net.d/mynetwork.conflist 配置文件
• 修改设置/usr/share/containers/containers.conf 将其为默认网络

创建网络

[root@podman ~]# podman network create new 
/etc/cni/net.d/new.conflist

[root@podman ~]# podman  network ls 
NETWORK ID    NAME        VERSION     PLUGINS
2f259bab93aa  podman      0.4.0       bridge,portmap,firewall,tuning
11507a0e2f5e  new         0.4.0       bridge,portmap,firewall,tuning

//修改/etc/cni/net.d/mynetwork.conflist 配置文件
[root@podman ~]# vim /etc/cni/net.d/new.conflist 

{
   "cniVersion": "0.4.0",
   "name": "new",
   "plugins": [
      {
         "type": "bridge",
         "bridge": "cni-podman1",
         "isGateway": true,
         "ipMasq": true,
         "hairpinMode": true,
         "ipam": {
            "type": "host-local",
            "routes": [
               {
                  "dst": "0.0.0.0/0"
               }
            ],
            "ranges": [
               [
                  {
                     "subnet": "192.168.88.0/24",
                     "gateway": "192.168.88.1"
                  }
               ]
            ]
         }
      },
      {
         "type": "portmap",
         "capabilities": {
            "portMappings": true
         }
      },
      {
         "type": "firewall",
         "backend": ""
      },
      {
         "type": "tuning"
      }
   ]
}
//修改/usr/share/containers/containers.conf 将其为默认网络
[root@podman ~]# vim /usr/share/containers/containers.conf
....
#
default_network = "new"
#default_network = "podman"
....

//创建容器检测
[root@podman ~]# podman run -dit --name new busybox
46f5f3c605919ca1bf30b01f287747afe8b7b0f290529a05c5b950e444be0349

[root@podman ~]# podman exec -it new /bin/sh
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
    link/ether fe:b1:ec:61:cb:c4 brd ff:ff:ff:ff:ff:ff
    inet 192.168.88.2/24 brd 192.168.88.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::fcb1:ecff:fe61:cbc4/64 scope link 
       valid_lft forever preferred_lft forever
       
/ # ping baidu.com    //测试是否能与外网联通
PING baidu.com (220.181.38.251): 56 data bytes
64 bytes from 220.181.38.251: seq=0 ttl=127 time=59.113 ms
64 bytes from 220.181.38.251: seq=1 ttl=127 time=75.623 ms
64 bytes from 220.181.38.251: seq=2 ttl=127 time=61.185 ms

防火墙

[root@podman ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CNI-b3d5ece77c897b52b8cbe349  all  --  *      *       192.168.88.5         0.0.0.0/0            /* name: "new" id: "5e710ea578b977524f86c7989ecb73a2039ef8d4340a41e5d059908c4ccf04c6" */

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain CNI-b3d5ece77c897b52b8cbe349 (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            192.168.88.0/24      /* name: "new" id: "5e710ea578b977524f86c7989ecb73a2039ef8d4340a41e5d059908c4ccf04c6" */
    0     0 MASQUERADE  all  --  *      *       0.0.0.0/0           !224.0.0.0/4          /* name: "new" id: "5e710ea578b977524f86c7989ecb73a2039ef8d4340a41e5d059908c4ccf04c6" */

//运行一个容器 映射80端口
[root@podman ~]# podman run -d -p 80:80 --name nginx nginx 
6e43e51db98deee3f373f292e0615d81af0cc865eed17542d389fce7424710a9
[root@podman ~]# podman ps -a 
CONTAINER ID  IMAGE                             COMMAND               CREATED             STATUS                 PORTS               NAMES
5e710ea578b9  docker.io/library/busybox:latest  sh                    About a minute ago  Up About a minute ago                      new
6e43e51db98d  docker.io/library/nginx:latest    nginx -g daemon o...  6 seconds ago       Up 6 seconds ago       0.0.0.0:80->80/tcp  nginx

//查看防火墙规则
[root@podman ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CNI-HOSTPORT-DNAT  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    9   556 CNI-HOSTPORT-MASQ  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* CNI portfwd requiring masquerade */
    0     0 CNI-b3d5ece77c897b52b8cbe349  all  --  *      *       192.168.88.5         0.0.0.0/0            /* name: "new" id: "5e710ea578b977524f86c7989ecb73a2039ef8d4340a41e5d059908c4ccf04c6" */
    0     0 CNI-ba66ce3bdc2ed059f5f7bead  all  --  *      *       192.168.88.6         0.0.0.0/0            /* name: "new" id: "6e43e51db98deee3f373f292e0615d81af0cc865eed17542d389fce7424710a9" */

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CNI-HOSTPORT-DNAT  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain CNI-b3d5ece77c897b52b8cbe349 (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            192.168.88.0/24      /* name: "new" id: "5e710ea578b977524f86c7989ecb73a2039ef8d4340a41e5d059908c4ccf04c6" */
    0     0 MASQUERADE  all  --  *      *       0.0.0.0/0           !224.0.0.0/4          /* name: "new" id: "5e710ea578b977524f86c7989ecb73a2039ef8d4340a41e5d059908c4ccf04c6" */

Chain CNI-ba66ce3bdc2ed059f5f7bead (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            192.168.88.0/24      /* name: "new" id: "6e43e51db98deee3f373f292e0615d81af0cc865eed17542d389fce7424710a9" */
    0     0 MASQUERADE  all  --  *      *       0.0.0.0/0           !224.0.0.0/4          /* name: "new" id: "6e43e51db98deee3f373f292e0615d81af0cc865eed17542d389fce7424710a9" */

Chain CNI-HOSTPORT-SETMARK (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* CNI portfwd masquerade mark */ MARK or 0x2000

Chain CNI-HOSTPORT-MASQ (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      *       0.0.0.0/0            0.0.0.0/0            mark match 0x2000/0x2000

Chain CNI-HOSTPORT-DNAT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CNI-DN-ba66ce3bdc2ed059f5f7b  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* dnat name: "new" id: "6e43e51db98deee3f373f292e0615d81af0cc865eed17542d389fce7424710a9" */ multiport dports 80

Chain CNI-DN-ba66ce3bdc2ed059f5f7b (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CNI-HOSTPORT-SETMARK  tcp  --  *      *       192.168.88.0/24      0.0.0.0/0            tcp dpt:80
    0     0 CNI-HOSTPORT-SETMARK  tcp  --  *      *       127.0.0.1            0.0.0.0/0            tcp dpt:80
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:192.168.88.6:80

//过滤容器ip
[root@podman ~]# podman inspect -l | grep -i address 
            "IPAddress": "192.168.88.6",
            "GlobalIPv6Address": "",
            "MacAddress": "76:90:58:31:5c:29",
            "LinkLocalIPv6Address": "",
                    "IPAddress": "192.168.88.6",
                    "GlobalIPv6Address": "",
                    "MacAddress": "76:90:58:31:5c:29",

清空防火墙规则

[root@podman ~]# iptables -t nat -F 
[root@podman ~]# iptables --flush 
[root@podman ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain CNI-b3d5ece77c897b52b8cbe349 (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain CNI-ba66ce3bdc2ed059f5f7bead (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain CNI-HOSTPORT-SETMARK (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain CNI-HOSTPORT-MASQ (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain CNI-HOSTPORT-DNAT (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain CNI-DN-ba66ce3bdc2ed059f5f7b (0 references)
 pkts bytes target     prot opt in     out     source         


//重载规则
[root@podman ~]# podman network reload nginx 
6e43e51db98deee3f373f292e0615d81af0cc865eed17542d389fce7424710a9
[root@podman ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CNI-HOSTPORT-DNAT  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    1    60 CNI-HOSTPORT-MASQ  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* CNI portfwd requiring masquerade */
    0     0 CNI-ba66ce3bdc2ed059f5f7bead  all  --  *      *       192.168.88.6         0.0.0.0/0            /* name: "new" id: "6e43e51db98deee3f373f292e0615d81af0cc865eed17542d389fce7424710a9" */

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CNI-HOSTPORT-DNAT  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain CNI-b3d5ece77c897b52b8cbe349 (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain CNI-HOSTPORT-SETMARK (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* CNI portfwd masquerade mark */ MARK or 0x2000

Chain CNI-HOSTPORT-MASQ (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      *       0.0.0.0/0            0.0.0.0/0            mark match 0x2000/0x2000

Chain CNI-HOSTPORT-DNAT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CNI-DN-ba66ce3bdc2ed059f5f7b  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* dnat name: "new" id: "6e43e51db98deee3f373f292e0615d81af0cc865eed17542d389fce7424710a9" */ multiport dports 80

Chain CNI-ba66ce3bdc2ed059f5f7bead (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            192.168.88.0/24      /* name: "new" id: "6e43e51db98deee3f373f292e0615d81af0cc865eed17542d389fce7424710a9" */
    0     0 MASQUERADE  all  --  *      *       0.0.0.0/0           !224.0.0.0/4          /* name: "new" id: "6e43e51db98deee3f373f292e0615d81af0cc865eed17542d389fce7424710a9" */

Chain CNI-DN-ba66ce3bdc2ed059f5f7b (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CNI-HOSTPORT-SETMARK  tcp  --  *      *       192.168.88.0/24      0.0.0.0/0            tcp dpt:80
    0     0 CNI-HOSTPORT-SETMARK  tcp  --  *      *       127.0.0.1            0.0.0.0/0            tcp dpt:80
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:192.168.88.6:80