Can minikube pass options to podman?

[chicks-net]

What Happened?

Minikube's podman driver leads to setting a global podman option in a way this isn't great for security.

podman system connection default podman-machine-default-root

If minikube could see fit to let us pass the --connection option to podman then this could be worked around just for minikube and not leave podman's defaults in a less secure state.

Attach the log file

N/A

Operating System

macOS (Default)

Driver

Podman

[afbjorklund]

You can set the CONTAINER_CONNECTION environment variable, if you don't want to change global podman configuration.

export CONTAINER_CONNECTION=podman-machine-default-root

There is also some fancy new flag in Podman 4.0, that will let you choose the regular (not rootless) containers by default.

podman machine set --rootful podman-machine-default

[afbjorklund]

There is also some folks looking for testers of rootless podman:

• Support rootless Podman driver, take 2 (Usage: minikube config set rootless true) #13829

[chicks-net]

This totally addresses my immediate question. I was able to get it to start with:

CONTAINER_CONNECTION=podman-machine-default-root minikube start --driver=podman --container-runtime=cri-o

But then you have to include that for every invocation of the minikube command:

% minikube status
E0324 16:09:26.372335   95330 status.go:258] status error: host: state: unknown state "minikube": podman container inspect minikube --format={{.State.Status}}: exit status 125
stdout:

stderr:
Error: error inspecting object: no such container "minikube"
E0324 16:09:26.372350   95330 status.go:261] The "minikube" host does not exist!
minikube
type: Control Plane
host: Nonexistent
kubelet: Nonexistent
apiserver: Nonexistent
kubeconfig: Nonexistent

% CONTAINER_CONNECTION=podman-machine-default-root minikube status
minikube
type: Control Plane
host: Running
kubelet: Running
apiserver: Running
kubeconfig: Configured

Hopefully #13829 will lead to a cleaner solution.

[afbjorklund]

Minikube only looks for the traditional environment variables, such as DOCKER_HOST and CONTAINER_HOST.

There is no support for these new "context" and "connection", that have a global impact (beyond the current shell)