Notes #2
Comments
Troubleshootpodman unshare cat /proc/self/uid_mapRefs.: podman unshare cat /proc/self/uid_map | wc --lines | rg 2Refs.: podman unshare envpodman unshare cat /proc/self/mountinfoTODO: make tests with the podman \
unshare \
strace \
--no-abbrev \
--string-limit=4096 \
--follow-forks \
--output=log-strace.txt \
podman \
run \
--log-level=debug \
--rm=true \
--interactive=true \
--tty=true \
docker.io/busybox \
echo 'Hello World!'From: containers/podman#7004 (comment) nix shell nixpkgs#util-linux
findmnt --submounts /sys/fs/cgroupnix shell nixpkgs#libselinux
getsebool container_manage_cgroupselinuxenabled; echo $?setsebool -P container_manage_cgroup 1From: 4.2. Starting services within a container using systemd TODO: https://github.com/containers/podman/blob/main/contrib/podmanimage/stable/Dockerfile capsh --printFrom: containers/podman#6667 (comment) sh-5.0# echo podman:10000:65536 > /etc/subuid
sh-5.0# echo podman:10000:65536 > /etc/subgidFrom: containers/podman#6667 (comment) About the [engine]
events_logger = "file"From: containers/podman#4325 (comment) We need
The error
if unshare.IsRootless() {
flags = fmt.Sprintf("%s,userxattr", flags)
}containers/storage#863 (comment)
opts = fmt.Sprintf("%s,userxattr", opts)
Adapted and works: containers/buildah#1304 (comment) and containers/podman#2659 (comment) /home/tobwen/podman/usr/local/bin/podman \
--log-level=debug \
--tmpdir /tmp/user/1000/libpod/tmp \
--conmon /home/tobwen/podman/usr/local/bin/conmon \
--network-cmd-path /home/tobwen/podman/usr/local/bin/slirp4netns \
--runtime /home/tobwen/podman/usr/local/bin/runc \
--storage-driver overlay \
--storage-opt "overlay.mount_program=/home/tobwen/podman/usr/local/bin/fuse-overlayfs" \
run \
hello-world |
stat /dev/kvm
file /dev/kvm
groups
sudo su -c 'groups'
podman run alpine ls /dev
podman run --privileged alpine ls /dev
id -u
stat -c "%U" $(tty)
sudo usermod -a -G kvm $(stat -c "%U" $(tty))https://askubuntu.com/a/1187716, https://askubuntu.com/a/136804, https://askubuntu.com/a/739132, https://unix.stackexchange.com/a/145751 nix \
shell \
nixpkgs/84aa23742f6c72501f9cc209f29c438766f5352d#podman \
--command \
podman \
run \
--privileged=true \
--device=/dev/fuse \
--device=/dev/kvm \
--env=DISPLAY=':0.0' \
--interactive=true \
--network=host \
--mount=type=tmpfs,destination=/var/lib/containers \
--tty=true \
--rm=true \
--user=0 \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--volume=/etc/localtime:/etc/localtime:ro \
docker.nix-community.org/nixpkgs/nix-flakes
nix shell nixpkgs#{qemu,binutils,file,shadow,which,ripgrep}
nix build github:ES-Nix/nix-qemu-kvm/dev#qemu.preparesudo chown $(id -u):$(id -g) /dev/kvmReboot https://stackoverflow.com/a/64216394 cat /proc/modules | rg -c kvmsudo chown -R $(id -u):$(id -g) /dev/pts /dev/ptmxrkt/rkt#2152 (comment) nix \
shell \
nixpkgs/84aa23742f6c72501f9cc209f29c438766f5352d#podman \
--command \
podman \
run \
--privileged=true \
--device=/dev/fuse \
--device=/dev/kvm \
--env=DISPLAY=':0.0' \
--interactive=true \
--network=host \
--mount=type=tmpfs,destination=/var/lib/containers \
--tty=true \
--rm=true \
--user=0 \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--volume=/etc/localtime:/etc/localtime:ro \
--volume=/dev:/dev \
docker.nix-community.org/nixpkgs/nix-flakesnix \
shell \
nixpkgs/84aa23742f6c72501f9cc209f29c438766f5352d#podman \
--command \
podman \
run \
--privileged=true \
--env=DISPLAY=':0.0' \
--interactive=true \
--network=host \
--mount=type=tmpfs,destination=/var/lib/containers \
--tty=true \
--rm=true \
--security-opt=seccomp=unconfined \
--user=0 \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--volume=/etc/localtime:/etc/localtime:ro \
--volume=/dev/kvm:/dev/kvm:rw \
docker.nix-community.org/nixpkgs/nix-flakesstat /dev/kvm
nix shell nixpkgs#findutils --command find /dev -gid 65534nix shell nixpkgs#{strace,which,ripgrep}
strace -o strace.out -f nix build github:ES-Nix/nix-qemu-kvm/dev#qemu.prepare
cat strace.out | rg -C 10 'Permission denied'https://stackoverflow.com/questions/32416409/getting-more-info-on-permission-denied mkdir -p ~/.config/containers
cat << 'EOF' >> ~/.config/containers/policy.json
{
"default": [
{
"type": "insecureAcceptAnything"
}
],
"transports":
{
"docker-daemon":
{
"": [{"type":"insecureAcceptAnything"}]
}
}
}
EOF
mkdir -p ~/.config/containers
cat << 'EOF' >> ~/.config/containers/registries.conf
[registries.search]
registries = ['docker.io']
[registries.block]
registries = []
EOFnix build nixpkgs/84aa23742f6c72501f9cc209f29c438766f5352d#podman
sudo su
mkdir -p /etc/containers
cat << 'EOF' >> /etc/containers/policy.json
{
"default": [
{
"type": "insecureAcceptAnything"
}
],
"transports":
{
"docker-daemon":
{
"": [{"type":"insecureAcceptAnything"}]
}
}
}
EOFsudo \
result/bin/podman \
run \
--privileged=true \
--env=DISPLAY=':0.0' \
--interactive=true \
--network=host \
--mount=type=tmpfs,destination=/var/lib/containers \
--tty=true \
--rm=true \
--security-opt=seccomp=unconfined \
--user=0 \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--volume=/etc/localtime:/etc/localtime:ro \
--volume=/dev/kvm:/dev/kvm:rw \
docker.nix-community.org/nixpkgs/nix-flakesRefs
|
Using podman from nix with flakes and test non-ASCII characterspodman \
run \
--interactive=true \
--tty=false \
--rm=true \
--user=0 \
docker.io/nixpkgs/nix-flakes \
<< COMMANDS
echo naïve café
COMMANDSExecuting in interactive modepodman \
run \
--interactive=true \
--tty=true \
--rm=true \
--user=0 \
docker.io/nixpkgs/nix-flakesecho naïve café |
nix \
profile \
install \
github:ES-Nix/podman-rootless/from-nixpkgsnix \
build \
github:ES-Nix/podman-rootless/from-nixpkgs \
&& echo 'Build 1 finished!' \
&& result/bin/podman \
run \
--log-level=debug \
--privileged=true \
--device=/dev/fuse \
--device=/dev/kvm \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--interactive=true \
--network=host \
--mount=type=tmpfs,destination=/var/lib/containers \
--tty=false \
--rm=true \
--user=0 \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--volume=/etc/localtime:/etc/localtime:ro \
docker.nix-community.org/nixpkgs/nix-flakes \
<<COMMANDS
mkdir --parent --mode=0755 ~/.config/nix
echo 'experimental-features = nix-command flakes ca-references ca-derivations' >> ~/.config/nix/nix.conf
nix \
build \
github:ES-Nix/podman-rootless/from-nixpkgs \
&& echo 'Build 2 finished!' \
&& result/bin/podman \
--log-level=debug \
images
COMMANDSnix \
build \
github:ES-Nix/podman-rootless/from-nixpkgs \
&& echo 'Build 1 finished!' \
&& result/bin/podman \
run \
--log-level=debug \
--privileged=true \
--device=/dev/fuse \
--device=/dev/kvm \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--interactive=true \
--network=host \
--mount=type=tmpfs,destination=/var/lib/containers \
--tty=false \
--rm=true \
--user=0 \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--volume=/etc/localtime:/etc/localtime:ro \
docker.nix-community.org/nixpkgs/nix-flakes \
<<COMMANDS
mkdir --parent --mode=755 ~/.config/nix && touch ~/.config/nix/nix.conf
echo 'experimental-features = nix-command flakes ca-references ca-derivations' >> ~/.config/nix/nix.conf
nix \
build \
github:ES-Nix/podman-rootless/from-nixpkgs \
&& echo 'Build 2 finished!' \
&& result/bin/podman \
--log-level=debug \
pull \
docker.io/library/alpine:3.13.5
COMMANDSnix \
build \
github:ES-Nix/podman-rootless/from-nixpkgs \
&& echo 'Build 1 finished!' \
&& result/bin/podman \
run \
--log-level=debug \
--privileged=true \
--device=/dev/fuse \
--device=/dev/kvm \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--interactive=true \
--network=host \
--mount=type=tmpfs,destination=/var/lib/containers \
--tty=false \
--rm=true \
--user=0 \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--volume=/etc/localtime:/etc/localtime:ro \
docker.nix-community.org/nixpkgs/nix-flakes \
<<COMMANDS
mkdir --parent --mode=755 ~/.config/nix && touch ~/.config/nix/nix.conf
echo 'experimental-features = nix-command flakes ca-references ca-derivations' >> ~/.config/nix/nix.conf
nix \
build \
github:ES-Nix/podman-rootless/from-nixpkgs \
&& echo 'Build 2 finished!' \
&& result/bin/podman \
--log-level=debug \
run \
--log-level=debug \
--interactive=true \
--tty=true \
--rm=true \
docker.io/library/alpine:3.13.5 \
sh \
-c \
'id'
COMMANDS |
podman \
run \
--env=PATH=/root/.nix-profile/bin:/usr/bin:/bin \
--device=/dev/kvm \
--device=/dev/fuse \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--interactive=true \
--log-level=error \
--network=host \
--mount=type=tmpfs,destination=/var/lib/containers \
--privileged=true \
--tty=true \
--rm=true \
--userns=host \
--user=0 \
--volume=/etc/localtime:/etc/localtime:ro \
--volume=/sys/fs/cgroup:/sys/fs/cgroup:ro \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
docker.nix-community.org/nixpkgs/nix-flakesmkdir --parent --mode=0755 ~/.config/nix
echo 'experimental-features = nix-command flakes ca-references ca-derivations' >> ~/.config/nix/nix.conf
mkdir --parent --mode=1777 /var/tmpnix store gc
du -s /nix/store/
nix profile install nixpkgs#hello
hello
du -s /nix/store/
nix store gc
du -s /nix/store/
nix profile install nixpkgs#hello
hello
du -s /nix/store/
nix store gc
du -s /nix/store/podman \
run \
--env=PATH=/root/.nix-profile/bin:/usr/bin:/bin \
--device=/dev/kvm \
--device=/dev/fuse \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--interactive=true \
--log-level=error \
--network=host \
--mount=type=tmpfs,destination=/var/lib/containers \
--privileged=true \
--tty=false \
--rm=true \
--userns=host \
--user=0 \
--volume=/etc/localtime:/etc/localtime:ro \
--volume=/sys/fs/cgroup:/sys/fs/cgroup:ro \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
docker.nix-community.org/nixpkgs/nix-flakes \
<<COMMANDS
mkdir --parent --mode=0755 ~/.config/nix
echo 'experimental-features = nix-command flakes ca-references ca-derivations' >> ~/.config/nix/nix.conf
mkdir --parent --mode=1777 /var/tmp
nix \
profile \
install \
github:ES-Nix/podman-rootless/from-nixpkgs \
&& podman \
run \
--storage-driver="vfs" \
--cgroups=disabled \
--log-level=error \
--interactive=true \
--network=host \
--tty=true \
alpine \
sh \
-c 'apk add --no-cache curl && echo PinP'
COMMANDS |
3 Levels of nesting podman PinPinPpodman \
run \
--env=PATH=/root/.nix-profile/bin:/usr/bin:/bin \
--events-backend=file \
--device=/dev/kvm \
--device=/dev/fuse \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--interactive=true \
--log-level=error \
--network=host \
--mount=type=tmpfs,destination=/var/lib/containers \
--privileged=true \
--tty=false \
--rm=true \
--user=0 \
--volume=/etc/localtime:/etc/localtime:ro \
--volume=/sys/fs/cgroup:/sys/fs/cgroup:ro \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
docker.nix-community.org/nixpkgs/nix-flakes \
<<COMMANDS
mkdir --parent --mode=755 ~/.config/nix
echo 'experimental-features = nix-command flakes ca-references ca-derivations' >> ~/.config/nix/nix.conf
nix \
profile \
install \
github:ES-Nix/podman-rootless/from-nixpkgs \
&& mkdir -p -m 0755 /var/tmp \
&& podman \
run \
--cgroups=disabled \
--env=PATH=/root/.nix-profile/bin:/usr/bin:/bin \
--events-backend=file \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--interactive=true \
--log-level=error \
--network=host \
--privileged=true \
--tty=false \
--rm=true \
--user=0 \
--volume=/sys/fs/cgroup:/sys/fs/cgroup:rw \
docker.nix-community.org/nixpkgs/nix-flakes \
<<COMMANDSNESTED
mkdir --parent --mode=0755 ~/.config/nix
echo 'experimental-features = nix-command flakes ca-references ca-derivations' >> ~/.config/nix/nix.conf
nix \
profile \
install \
github:ES-Nix/podman-rootless/from-nixpkgs \
&& mkdir --parent --mode=0755 /var/tmp \
&& podman \
run \
--events-backend=file \
--storage-driver="vfs" \
--cgroups=disabled \
--log-level=error \
--interactive=true \
--network=host \
--tty=true \
docker.io/library/alpine:3.14.0 \
sh \
-c 'apk add --no-cache curl && echo PinPinP'
COMMANDSNESTED
COMMANDSpodman \
run \
--env=PATH=/root/.nix-profile/bin:/usr/bin:/bin \
--events-backend=file \
--device=/dev/kvm \
--device=/dev/fuse \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--interactive=true \
--log-level=error \
--network=host \
--mount=type=tmpfs,destination=/var/lib/containers \
--privileged=true \
--tty=false \
--rm=true \
--user=0 \
--volume=/etc/localtime:/etc/localtime:ro \
--volume=/sys/fs/cgroup:/sys/fs/cgroup:ro \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
docker.nix-community.org/nixpkgs/nix-flakes \
<<COMMANDS
mkdir --parent --mode=755 ~/.config/nix
echo 'experimental-features = nix-command flakes ca-references ca-derivations' >> ~/.config/nix/nix.conf
nix \
profile \
install \
github:ES-Nix/podman-rootless/from-nixpkgs \
&& mkdir -p -m 0755 /var/tmp \
&& podman \
--privileged=true \
run \
quay.io/podman/stable \
podman \
run \
--storage-driver="vfs" \
--cgroups=disabled \
ubi8 \
echo \
hello
COMMANDS |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Some notes
Jessie Frazelle:
List:
Cuts:
Texts:
https://jupyter-docker-stacks.readthedocs.io/en/latest/using/selecting.html#image-relationships
Texts:
The distroless thing
List:
TODO:
export TMP=/tmpto solve the file system size problem? Ifexport TMPDIR=/tmpis used, does the file system size problem still happening?TODO: Podman in Podman, similar to Docker in Docker?. Related: Daniel Walsh in Is there any chance to run rootless podman container inside another one? "Rootless podman inside of rootless podman, would be very difficult to make work,because of the multiple user namespaces." Related: Red Hat YouTube official channel video, Podman in Podman (Running a Container Within a Container)
TODO: add transcript and explain that for me it is valid to development environments/reproducible environments.
Object Oriented Programming vs Functional Programming
How to wrap setcap/setuid?
From: https://github.com/NixOS/nixpkgs/blob/nixos-20.09/pkgs/os-specific/linux/libcap-ng/default.nix#L34 and https://people.redhat.com/sgrubb/libcap-ng/
💡 reproduce CVEs using this.
Minimum required kernel version
May 21, 2011: 1 of 5 Dan Walsh, Red Hat, on SELinux security at the RHTUGNL, about history
Nix Cookbook
TODO: podman has this roles somewhere, find it and maybe make a PR correcting it
https://github.com/NixOS/nixpkgs/blob/2553aee74fed8c2205a4aeb3ffd206ca14ede60f/nixos/modules/services/cluster/kubernetes/default.nix#L281-L285
podman run docker.io/library/alpine:3.18.3 sh -c "cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 20 | head -n 9999"The text was updated successfully, but these errors were encountered: