documentation/docs/admin-guide/container.md

Container

Docker and Podman are different implementations of an OCI container runtime. There are distinct differences (see below) although their usage is more or less the same. The usage is mutual exclusive, i.e. you cannot use/install both at the same time!

One very confusing fact is, that if you installed Podman you still have a command called docker available. Therefore you might experience differences in behaviour by executing the very exact command on different systems (which either have Podman or Docker installed).

!!! warning Although we enable you to use both container runtimes Podman and Docker it is important to note that only Podman is supported by RedHat. So if you have a critical application and need/want to also rely on Redhat third level support you'd have to use Podman!

Also be aware that _compose_ files and _commands_ can vary between `docker-ce` and `podman`!

Networking

If you have problems with connectivity this might be due to the default docker network range being used by AIT.

!!! Usage You can use 10.3.0.0/16 and 10.4.0.0/16 safely. They have been assigned as default docker networks by AIT. Podman's default net 10.88.0.0/16 is save to use.

Docker-ce example

/etc/docker/daemon.json

{
  "default-address-pools": [
    {
      "base": "10.3.0.0/16",
      "size": 24
    }
  ]
}

Docker

Docker-CE will have always the latest features in docker engine and docker compose. The docker repo is enabled by default and the packages can be installed by using following code in hiera.

base::pkg_group::extra:
  - 'docker-ce' 

Podman

Podman engine runs "rootless" without any further configuration and is supported by Redhat Enterprise Support. The Hiera configuration to install docker-podman with hiera would look like this:

base::pkg_group::extra:
  - 'podman' 

This will install podman from the appstream repository.

Subuids and Subgids

To be able to run rootless containers with podman you need to define a subuid/subgid range for each user which should be able to launch containers with podman in /etc/subuid and /etc/subgid.

To be able to have these ids consistent PSI wide there is a small central database/API to register and lookup such IDs.

Automatic Subuid/Subgid Registration

By default interactive users are automatically registered by the subid-registrator tool. Additional (technical) users you may configure in Hiera with the aaa::subid:

aaa::subid:
  - 'appache'
  - 'svcusr-skfi'

Note that this overwrites any existing content of /etc/subuid and /etc/subgid.

The automatic registration can be switched off with

aaa::subid::automatic: false

which will ensure that /etc/subuid and /etc/subgid are not touched by Puppet or subid-registrator.

Subuid/Subgid Registration via API

The API endpoint is https://sysdb.psi.ch/subid/v1/config and allows for one or more user parameters. Valid are numeric user ids (uid) or any username listed in our AD. It will then return the line(s) you need to add to /etc/subuid and /etc/subgid.

Note that the ID is now reserved for 2 years. With every lookup with the API the reservation gets renewed. After it timed out the ID range will be freed and will be used by someone else.

Examples:

This will get the ID range (the same for both subuid and subgid) for your user.

curl "https://sysdb.psi.ch/subid/v1/config?user=$USER"

This will get the ID range (the same for both subuid and subgid) for your user.

And for several users:

USER1=...
USER2=...
USER3=...
curl "https://sysdb.psi.ch/subid/v1/config?user=$USER1&user=$USER2&user=$USER3"

Rootless Podman Container with own External IP

1. add additional IP address to your network interface
2. make the container use that IP address:

podman run -it --rm --network=pasta:--ipv4-only,--address,192.168.254.254,--outbound,192.168.254.254 rhel9:latest  /bin/bash

3. disable DNS caching in Hiera with networking::enable_dns_caching: false because with the outbound IP communication does not work over the lo interface which is used by systemd-resolved (maybe some hiding NAT rule would help).