forked from linux/documentation
111 lines
4.1 KiB
Markdown
111 lines
4.1 KiB
Markdown
# Container
|
|
|
|
__Docker__ and __Podman__ are different implementations of an OCI container runtime. There are distinct differences (see below) although their usage is more or less the same. The usage is mutual exclusive, i.e. __you cannot use/install both at the same time!__
|
|
|
|
One very confusing fact is, that if you installed _Podman_ you still have a command called `docker` available. Therefore you might experience differences in behaviour by executing the very exact command on different systems (which either have Podman or Docker installed).
|
|
|
|
|
|
!!! warning
|
|
Although we enable you to use both container runtimes Podman and Docker it is important to note that only Podman is supported by RedHat. So if you have a critical application and need/want to also rely on Redhat third level support you'd have to use Podman!
|
|
|
|
Also be aware that _compose_ files and _commands_ can vary between `docker-ce` and `podman`!
|
|
|
|
## Networking
|
|
If you have problems with connectivity this might be due to the default docker network range being used by AIT.
|
|
|
|
!!! Usage
|
|
You can use 10.3.0.0/16 and 10.4.0.0/16 safely. They have been assigned as default docker networks by AIT.
|
|
Podman's default net 10.88.0.0/16 is save to use.
|
|
|
|
### Docker-ce example
|
|
`/etc/docker/daemon.json`
|
|
```json
|
|
{
|
|
"default-address-pools": [
|
|
{
|
|
"base": "10.3.0.0/16",
|
|
"size": 24
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
## Docker
|
|
Docker-CE will have always the latest features in docker engine and docker compose.
|
|
The docker repo is enabled by default and the packages can be installed by using following code in hiera.
|
|
|
|
```yaml
|
|
base::pkg_group::extra:
|
|
- 'docker-ce'
|
|
```
|
|
|
|
## Podman
|
|
Podman engine runs "rootless" without any further configuration and is supported by Redhat Enterprise Support.
|
|
The Hiera configuration to install docker-podman with hiera would look like this:
|
|
|
|
```yaml
|
|
base::pkg_group::extra:
|
|
- 'podman'
|
|
```
|
|
This will install podman from the appstream repository.
|
|
|
|
### Subuids and Subgids
|
|
|
|
To be able to run rootless containers with podman you need to define a subuid/subgid range for each user which should be able to launch containers with `podman` in `/etc/subuid` and `/etc/subgid`.
|
|
|
|
To be able to have these ids consistent PSI wide there is a small central database/API to register and lookup such IDs.
|
|
|
|
#### Automatic Subuid/Subgid Registration
|
|
|
|
By default interactive users are automatically registered by the `subid-registrator` tool.
|
|
Additional (technical) users you may configure in Hiera with the `aaa::subid`:
|
|
|
|
```yaml
|
|
aaa::subid:
|
|
- 'appache'
|
|
- 'svcusr-skfi'
|
|
```
|
|
|
|
Note that this overwrites any existing content of `/etc/subuid` and `/etc/subgid`.
|
|
|
|
The automatic registration can be switched off with
|
|
|
|
```yaml
|
|
aaa::subid::automatic: false
|
|
```
|
|
which will ensure that `/etc/subuid` and `/etc/subgid` are not touched by Puppet or `subid-registrator`.
|
|
|
|
#### Subuid/Subgid Registration via API
|
|
|
|
The API endpoint is `https://sysdb.psi.ch/subid/v1/config` and allows for one or more `user` parameters. Valid are numeric user ids (uid) or any username listed in our AD. It will then return the line(s) you need to add to `/etc/subuid` and `/etc/subgid`.
|
|
|
|
Note that the ID is now reserved for 2 years. With every lookup with the API the reservation gets renewed. After it timed out the ID range will be freed and will be used by someone else.
|
|
|
|
|
|
**Examples:**
|
|
|
|
This will get the ID range (the same for both subuid and subgid) for your user.
|
|
|
|
```bash
|
|
curl "https://sysdb.psi.ch/subid/v1/config?user=$USER"
|
|
```
|
|
This will get the ID range (the same for both subuid and subgid) for your user.
|
|
|
|
And for several users:
|
|
|
|
```bash
|
|
USER1=...
|
|
USER2=...
|
|
USER3=...
|
|
curl "https://sysdb.psi.ch/subid/v1/config?user=$USER1&user=$USER2&user=$USER3"
|
|
```
|
|
|
|
### Rootless Podman Container with own External IP
|
|
|
|
1. add additional IP address to your network interface
|
|
2. make the container use that IP address:
|
|
```bash
|
|
podman run -it --rm --network=pasta:--ipv4-only,--address,192.168.254.254,--outbound,192.168.254.254 rhel9:latest /bin/bash
|
|
```
|
|
3. disable DNS caching in Hiera with `networking::enable_dns_caching: false` because with the outbound IP communication does not work over the `lo` interface which is used by `systemd-resolved` (maybe some hiding NAT rule would help).
|