So, I’ve finally gotten a comfortable setup for my beautiful podman quadlets, its a simple debian system, heavily systemd reliant, and I’m curious about how yall admin such a thing, I’ve got a couple of scripts to create users, skel the home directories, and templates for services.
I’m particularly curious about handling subids, I’m pretty careful about them and not using too too many, mostly for being afraid of running out of them lol. But from what I’ve seen, linux allows you to go real stupid with it, like having a shitton of range and entrances.
I personally give my quad users like 500 subids to work with and they generally work fine, it really depends on if I’m gonna have more than one service running on them or not.
I setup custom bash scripts eons ago to handle all my subuid/gid and networking stuff, and I’m on the road now, so getting into the code is harder. If I have time tonight, I’ll reply back with how I did it for rootless.
I run everything in rootless podman with quadlets. Be prepared for the docker die-hard crowd to tell you podman is inferior, but it really isn’t. At least not in my 10ish years using it. Is it harder to get going? Sure, but the extra abstraction layer for security is worth it imo.
I have to get ready to update my scripts for the podman 6.0 changes upcoming, but otherwise they pretty much run themselves. Systemd gets a lot of hate sometimes, but when you get it working, it’s pretty much automated.
Want to have program x run after condition y. Use targets, sockets or a small monitor service. I have encrypted volumes that require me to enter the unlock password before they will unlock, the services will just wait until that is done.
Networking and permission issues? Run a pod. Podman unshare is also your friend.
The biggest thing I found getting everything figured out is the lack of step-by-step instructions on how it all works. The docs help, but can be a bit confusing/ambiguous at times.
Feel free to dm me if you have a specific question and I’d be glad to try and help. Just might be a bit delayed on responses for the next bit while I’m travelling.
So far I’ve circumvented networking with different users by mapping everything through localhost, without stuff going outside the network, how would you connect say; a service running on user A, on network A, to a service running on user B, on network B?
So far I can’t imagine how to connect both, unless im doing some disgusting nftables hackery, which is an option I COULD take, just one I dont want to take.
If I am following, there are a few ways, which shouldn’t involve hacks in nft, but you would need it allowing at least localhost traffic, which I assume you do already.
The keyword “localhost” usually will only work within a network or pod on rootless, however there is a separate address that can work.
host.containers.internal
I use it quite often for extra-user and pod communication. Hopefully this helps.