拉取镜像
[root@host ~]# podman pull httpd
Resolving "httpd" using unqualified-search registries (/etc/containers/registries.conf)
Trying to pull docker.io/library/httpd:latest...
Getting image source signatures
Copying blob 33847f680f63 skipped: already exists
Copying blob 763d74736d95 done
Copying blob a8c75048351a done
Copying blob d74938eee980 done
Copying blob 963cfdce5a0c done
Copying config bde40dcb22 done
Writing manifest to image destination
Storing signatures
bde40dcb22a7a82392a45bcc7f191bb2f807d57711934d4eda869d3d649a3643
运行容器
[root@host ~]# podman run -d --name t1 -p 80 docker.io/library/httpd
c035037877efeb0523b81865f2b677407fb2f0e6bd174e2b029f1ad9dd834254
[root@host ~]# podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
c035037877ef docker.io/library/httpd:latest httpd-foreground 9 seconds ago Up 8 seconds ago 0.0.0.0:35965->80/tcp t1
#-l 查看最新的容器信息
[root@host ~]# podman inspect -l
[
{
"Id": "c035037877efeb0523b81865f2b677407fb2f0e6bd174e2b029f1ad9dd834254",
"Created": "2021-08-12T10:44:14.434329075-04:00",
"Path": "httpd-foreground",
"Args": [
"httpd-foreground"
],
"State": {
"OciVersion": "1.0.2-dev",
"Status": "running",
......
[root@host ~]# curl 192.168.11.143:35965
<html><body><h1>It works!</h1></body></html>
podman logs查看容器日志
[root@host ~]# podman logs -l AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.2. Set the 'ServerName' directive globally to suppress this message AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.2. Set the 'ServerName' directive globally to suppress this message [Thu Aug 12 14:44:15.289622 2021] [mpm_event:notice] [pid 1:tid 140190884684928] AH00489: Apache/2.4.48 (Unix) configured -- resuming normal operations [Thu Aug 12 14:44:15.289915 2021] [core:notice] [pid 1:tid 140190884684928] AH00094: Command line: 'httpd -D FOREGROUND' 192.168.11.143 - - [12/Aug/2021:14:46:02 +0000] "GET / HTTP/1.1" 200 45
pod top <container_id>产看容器pid
[root@host ~]# podman top t1
USER PID PPID %CPU ELAPSED TTY TIME COMMAND
root 1 0 0.000 3m5.218706179s ? 0s httpd -DFOREGROUND
daemon 7 1 0.000 3m4.218877391s ? 0s httpd -DFOREGROUND
daemon 8 1 0.000 3m4.219010462s ? 0s httpd -DFOREGROUND
daemon 9 1 0.000 3m4.219060556s ? 0s httpd -DFOREGROUND
镜像上传
[root@host ~]# podman login
Username: h0021
Password:
Login Succeeded!
[root@host ~]# podman tag docker.io/library/nginx:latest h0021/test:nginx
[root@host ~]# podman push h0021/test:nginx
Getting image source signatures
Copying blob e3135447ca3e done
Copying blob 988d9a3509bb done
Copying blob 59b01b87c9e7 done
Copying blob b85734705991 done
Copying blob 7c0b223167b9 done
Copying blob 814bff734324 done
Copying config 08b152afcf done
Writing manifest to image destination
Storing signatures
普通用户使用的配置在允许没有root特权的用户运行Podman之前，管理员必须安装或构建Podman并完成以下配置
cgroup V2Linux内核功能允许用户限制普通用户容器可以使用的资源，如果使用cgroup V2启用了运行Podman的Linux发行版，则可能需要更改默认的OCI运行时。某些较旧的版本runc不适用于cgroup V2，必须切换到备用OCI运行时crun。
[root@host ~]# yum -y install crun
可以使用--runtime选项在命令行中打开对cgroup V2的替代OCI运行时支持
podman --runtime crun
也可以修改containers.conf文件runtime = "runc"到runtime = "crun"
[root@host ~]# vim /usr/share/containers/containers.conf
......
# volume_path = "/var/lib/containers/storage/volumes"
# Default OCI runtime
#
# runtime = "crun"
runtime = "crun"
# List of the OCI runtimes that support --format=json. When json is supported
# engine will use it for reporting nicer errors.
......
[root@host ~]# podman start t1
[root@host ~]# podman inspect t1 | grep runc
"OCIRuntime": "runc",
"runc",
安装slirp4netns slirp4nets包为普通用户提供一种网络模式
[root@host ~]# yum -y install slirp4netns
安装fuse-overlayfs 在普通用户环境中使用Podman时，建议使用fuse-overlayfs而不是VFS文件系统
[root@host ~]# yum -y install fuse-overlayfs
配置storage.conf文件
[root@host ~]# vim /etc/containers/storage.conf
# This file is is the configuration file for all tools
# that use the containers/storage library.
# See man 5 containers-storage.conf for more information
# The "container storage" table contains all of the server options.
[storage]
# Default Storage Driver, Must be set for proper operation.
driver = "overlay" 此处改为overlay #这里好像就是一样的
# Temporary storage location
runroot = "/run/containers/storage"
......
# Path to an helper program to use for mounting the file system instead of mounting it
# directly.
mount_program = "/usr/bin/fuse-overlayfs" 这里取消注释
/ etc / subuid和/ etc / subgid配置 Podman要求运行它的用户在/ etc / subuid和/ etc / subgid文件中列出一系列UID,shadow-utils或newuid包提供这些文件
[root@host ~]# yum -y install shadow-utils
可以在/ etc / subuid和/ etc / subgid查看，每个用户的值必须唯一且没有任何重叠。
[root@host ~]# useradd xx
[root@host ~]# cat /etc/subuid
xx:100000:65536
[root@host ~]# cat /etc/subgid
xx:100000:65536
该文件的格式为USERNAME：UID：RANGE
在/ etc / passwd或getpwent中列出的用户名。 为用户分配的初始uid。 为用户分配的UID范围的大小 普通用户是无法看见root用户的镜像的
[root@host ~]# podman images
REPOSITORY TAG IMAGE ID CREATED SIZE
docker.io/library/httpd latest bde40dcb22a7 6 days ago 142 MB
docker.io/library/nginx latest 08b152afcfae 3 weeks ago 137 MB
[root@host ~]# su - xx
[xx@host ~]$ podman images
REPOSITORY TAG IMAGE ID CREATED SIZE
不同用户可以创建相同名字的容器，互不相干
[root@host ~]# podman run -d --name web nginx
6d30f187cef38d858382f66330425c7486e6c12fe50c4484633b5ae6a9a14396
[root@host ~]# podman ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
c035037877ef docker.io/library/httpd:latest httpd-foreground 27 minutes ago Up 27 minutes ago 0.0.0.0:35965->80/tcp t1
6d30f187cef3 docker.io/library/nginx:latest nginx -g daemon o... 9 seconds ago Up 10 seconds ago web
[xx@host ~]$ podman run -d --name web nginx
05a0373053548f83e15b1719ee535ab1d0f448b655ffb033867eeeb06c273cb6
[xx@host ~]$ podman ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
05a037305354 docker.io/library/nginx:latest nginx -g daemon o... 40 seconds ago Up 39 seconds ago web
** 使用卷** 容器与root用户一起运行，则root容器中的用户实际上就是主机上的用户。UID / GID 1是在/etc/subuid和/etc/subgid等中用户映射中指定的第一个UID / GID 。如果普通用户的身份从主机目录挂载到容器中，并在该目录中以根用户身份创建文件，则会看到它实际上是你的用户在主机上拥有的。
[xx@host ~]$ pwd
/home/xx
[xx@host ~]$ podman run -it --name web1 -v /home/xx/dd:/data:Z docker.io/library/nginx /bin/sh
# ls
bin data docker-entrypoint.d etc lib media opt root sbin sys usr
boot dev docker-entrypoint.sh home lib64 mnt proc run srv tmp var
# cd data
# ls
# touch 123
# ls
123
# pwd
/data
# exit
[xx@host ~]$ ls
dd
[xx@host ~]$ ls dd
123
--userns=keep-id标志，以确保用户被映射到容器内自己的UID和GID。
[xx@host ~]$ podman run -it --name t10086 -v "$(pwd)"/dd:/aa --userns=keep-id busybox /bin/sh
~ $ touch aa/abc
~ $ ls -l aa/
total 0
-rw-r--r-- 1 xx xx 0 Aug 13 04:43 123
-rw-r--r-- 1 xx xx 0 Aug 13 04:45 abc
~ $ exit
[xx@host ~]$ ll dd/
总用量 0
-rw-r--r--. 1 xx xx 0 8月 13 00:43 123
-rw-r--r--. 1 xx xx 0 8月 13 00:45 abc
1
使用普通用户映射容器端口时会报“ permission denied”的错误
[xx@host ~]$ podman run --name nginx -d -p 80:80 nginx
Error: rootlessport cannot expose privileged port 80, you can add 'net.ipv4.ip_unprivileged_port_start=80' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen tcp 0.0.0.0:80: bind: permission denied
可以映射>= 1024的端口
[xx@host ~]$ podman run --name t0 -d -p 1024:80 nginx
da9ae693f1e10958f7a870de56144f650de732b16356a81babb09fca0c4fbb91
[xx@host ~]$ podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
da9ae693f1e1 docker.io/library/nginx:latest nginx -g daemon o... 3 seconds ago Up 3 seconds ago 0.0.0.0:1024->80/tcp t0
配置echo 'net.ipv4.ip_unprivileged_port_start=80' >> /etc/sysctl.conf
[root@host ~]# echo 'net.ipv4.ip_unprivileged_port_start=80' >> /etc/sysctl.conf
[root@host ~]# sysctl -p
net.ipv4.ip_unprivileged_port_start = 80
[xx@host ~]$ podman run --name nginx -d -p 80:80 nginx
aaad33c415081dec0a491dcd7d755699a7f808310b1419a8f247ee40215d163f
[xx@host ~]$ podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
da9ae693f1e1 docker.io/library/nginx:latest nginx -g daemon o... About a minute ago Up About a minute ago 0.0.0.0:1024->80/tcp t0
aaad33c41508 docker.io/library/nginx:latest nginx -g daemon o... 5 seconds a
