I’m looking to migrate all of my containers to rootless podman but need some advice.
All of my services are currently running docker compose. I’ve played arount with podman but I am unsure of best practice: I have the option of installing podman-docker, podman-compose, or docker-compose connected to a podman socket. What’s the recommended way here?
I also can’t seem to find any information on setting up a systemd unit for rootless podman compose. How are you all auto starting podman (compose) files?
I run everything in rootless containers using systemd service files generated with podman generate systemd.
Podman Compose is a “community effort”, and Red Hat seems to be less focused on its development (here is their post about it).
There are ways to get it working but I find it easier to go with podman containers and pods through systemd because the majority of documentation (both official and unofficial) leans in that direction.
I don’t know how much you already know, so here is just a summary of things that worked for me for anyone reading.
Podman uses the concept of “Pods” to link together associated containers and manage name spaces, networking, etc. The high level summary for running podman pods through systemd:
Create an empty pod podman pod create --name=<mypod>.
Start containers using podman run --pod=<mypod> ... and reconfigure until containers are working within the same pod as desired.
Use podman generate systemd to create a set of systemd unit files. Be sure to read through the options in that man page.
– this is more reliable than creating systemd unit files by hand because it creates unit files optimized for the podman workflow.
place the generated systemd unit files in the right place (user vs. system) and then it can be started, enabled, and disabled as with other systemd unit files.
Note: for standalone containers that are not linked or reliant on other containers, you can should skip creating the empty pod and can skip the --pod=<mypod> when starting containers. This should result in a single service file generated and that container will operate independently.
The Red Hat Enterprise Linux docs have a good amount of info, as well as their “sysadmin” series of posts.
Here are some harder to find things I’ve had to hunt down that might help with troubleshooting:
Important: be sure to enable loginctl enable-linger <username> or else rootless pods/containers will stop when you log out of that session.
If you want it to run a container or pod at system startup you will need to specify the right parameters in the [Install] section of the systemd file, see this doc page. Podman generate systemd should take care of this.
If you are using SELinux there is a package called container-selinux that has some useful booleans that can help with specific policies (container-use-devices is a good one if your container needs access to a GPU or similar). Link to repo
Do note that it’s not necessary to generate systemd files for each container separately. Just generate for the pod and podman will handle generating the additional services required.
One of the big selling point is that it runs without a daemon. Docker always has a daemon running as root activated. How big of a deal that is I’m not sure.
The simplicity of docker with much better security.
Honestly the main appeal of having my homelab is to play with technologies and learn new things. The couple times I’ve skimmed the docs for Kubernetes it seemed over complicated for a personal homelab.
Podman’s strong suite is integration with other toolings, such as systemd and ansible.
With ansible I could define a podman pod and containers in a playbook yml file. And Ansible can do much more, like provisioning the configuration files or setting an auto update service for podman
The gotcha with podman is it’s networking is different from docker. So I would at least plan it out before migrating.
Podman-compose is a python script that simply converts a compose file to ‘podman run’. It worked fine enough for me, but the caveat being it doesn’t have full feature parity and the errors aren’t as good. The only thing I couldnt get working was connecting my GPU to jellyfin.
Turning conainers into systemd units is easy:
‘podman generate systems --new --name $container_name › $HOME/.config/systems/user/$container_name.service’
‘systemctl --user enable --now $container_name’
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
I run everything in rootless containers using systemd service files generated with
podman generate systemd.Podman Compose is a “community effort”, and Red Hat seems to be less focused on its development (here is their post about it).
There are ways to get it working but I find it easier to go with podman containers and pods through systemd because the majority of documentation (both official and unofficial) leans in that direction.
I don’t know how much you already know, so here is just a summary of things that worked for me for anyone reading.
Podman uses the concept of “Pods” to link together associated containers and manage name spaces, networking, etc. The high level summary for running podman pods through systemd:
podman pod create --name=<mypod>.podman run --pod=<mypod> ...and reconfigure until containers are working within the same pod as desired.Note: for standalone containers that are not linked or reliant on other containers, you
canshould skip creating the empty pod and can skip the--pod=<mypod>when starting containers. This should result in a single service file generated and that container will operate independently.This post goes over pods as systemd services.
This doc goes over containers as systemd services.
The Red Hat Enterprise Linux docs have a good amount of info, as well as their “sysadmin” series of posts.
Here are some harder to find things I’ve had to hunt down that might help with troubleshooting:
loginctl enable-linger <username>or else rootless pods/containers will stop when you log out of that session.[Install]section of the systemd file, see this doc page. Podman generate systemd should take care of this.container-selinuxthat has some useful booleans that can help with specific policies (container-use-devicesis a good one if your container needs access to a GPU or similar). Link to repoDo note that it’s not necessary to generate systemd files for each container separately. Just generate for the pod and podman will handle generating the additional services required.
This is great info thank you
This is extremely helpful and gives me all the answers I was looking for. Thank you
I’ve no experience with Podman but genuinely interested why would you use this instead of Docker/Kubernetes?
One of the big selling point is that it runs without a daemon. Docker always has a daemon running as root activated. How big of a deal that is I’m not sure.
The simplicity of docker with much better security. Honestly the main appeal of having my homelab is to play with technologies and learn new things. The couple times I’ve skimmed the docs for Kubernetes it seemed over complicated for a personal homelab.
Check out Podlet to convert your existing docker run commands or docker-compose.yaml files to quadlet files https://github.com/k9withabone/podlet
I gave podman a try a few months ago and went with systemd unit files instead of compose files, since it felt like the most native approach.
Also very interested in this.
In my case I just installed podman compose :)
Interesting, and why do you want to switch?
Podman’s strong suite is integration with other toolings, such as
systemdandansible.With
ansibleI could define a podman pod and containers in a playbook yml file. And Ansible can do much more, like provisioning the configuration files or setting an auto update service for podmanThe gotcha with podman is it’s networking is different from docker. So I would at least plan it out before migrating.
Podman compose kinda sucks. Better use the now included Quadlet container files for Systemd integration.
Quadlet looks very interested, I’m reading the docs now. Thanks
Podman-compose is a python script that simply converts a compose file to ‘podman run’. It worked fine enough for me, but the caveat being it doesn’t have full feature parity and the errors aren’t as good. The only thing I couldnt get working was connecting my GPU to jellyfin.
Turning conainers into systemd units is easy: ‘podman generate systems --new --name $container_name › $HOME/.config/systems/user/$container_name.service’ ‘systemctl --user enable --now $container_name’
https://docs.podman.io/en/latest/markdown/podman-generate-systemd.1.html