- rework the slirp4netns section into a general 'Networking configuration' one
- integrate pasta as the new default tool for rootless networking since v5.0
- touch upon the user-facing differences between the two available backends and provide
links to further documentation, including how to choose between one and the other and
how to install them
Fixes: #24393
Signed-off-by: Bastien Traverse <neitsab@esrevart.net>
The option --network is the more official option as it is
listed in
podman run --help
podman kube play --help
Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
* Document that pasta is now the default network driver
* Document command: podman info -f '{{.Host.RootlessNetworkCmd}}'
* Add note about missing network isolation
Fixes: https://github.com/containers/podman/issues/22748
Co-authored-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
the podman tutorial refers to an old httpd image based on Fedora 29. It
is x86_64 only so Apple Silicon Macs and RPI's cannot follow the
tutorial. Switch to nginx
Fixes: #20916
[NO NEW TESTS NEEDED]
Signed-off-by: Brent Baude <bbaude@redhat.com>
Followup to #20722:
- Fix missing "containers" subdirectory
- Indicate what podman uses as defaults for XDG envariables
- whitespace and quoting fixes (I actually ran pandoc this time)
Signed-off-by: Ed Santiago <santiago@redhat.com>
- We can assume that cgroups v2 and rootless overlayfs are the
default everywhere.
- Remove RHEL7-only instructions
- add clear '$' and '#' prompts to rootless and root commands
- other minor consistency cleanups
Ref: #20669
Signed-off-by: Ed Santiago <santiago@redhat.com>
Remove the use of the "latest" flags because it cannot be used on
windows or mac.
Fixes#17019
[NO NEW TESTS NEEDED]
Signed-off-by: Brent Baude <bbaude@redhat.com>
Motivation
===========
This feature aims to make --uidmap and --gidmap easier to use, especially in rootless podman setups.
(I will focus here on the --gidmap option, although the same applies for --uidmap.)
In rootless podman, the user namespace mapping happens in two steps, through an intermediate mapping.
See https://docs.podman.io/en/latest/markdown/podman-run.1.html#uidmap-container-uid-from-uid-amount
for further detail, here is a summary:
First the user GID is mapped to 0 (root), and all subordinate GIDs (defined at /etc/subgid, and
usually >100000) are mapped starting at 1.
One way to customize the mapping is through the `--gidmap` option, that maps that intermediate mapping
to the final mapping that will be seen by the container.
As an example, let's say we have as main GID the group 1000, and we also belong to the additional GID 2000,
that we want to make accessible inside the container.
We first ask the sysadmin to subordinate the group to us, by adding "$user:2000:1" to /etc/subgid.
Then we need to use --gidmap to specify that we want to map GID 2000 into some GID inside the container.
And here is the first trouble:
Since the --gidmap option operates on the intermediate mapping, we first need to figure out where has
podman placed our GID 2000 in that intermediate mapping using:
podman unshare cat /proc/self/gid_map
Then, we may see that GID 2000 was mapped to intermediate GID 5. So our --gidmap option should include:
--gidmap 20000:5:1
This intermediate mapping may change in the future if further groups are subordinated to us (or we stop
having its subordination), so we are forced to verify the mapping with
`podman unshare cat /proc/self/gid_map` every time, and parse it if we want to script it.
**The first usability improvement** we agreed on #18333 is to be able to use:
--gidmap 20000:@2000:1
so podman does this lookup in the parent user namespace for us.
But this is only part of the problem. We must specify a **full** gidmap and not only what we want:
--gidmap 0:0:5 --gidmap 5:6:15000 --gidmap 20000:5:1
This is becoming complicated. We had to break the gidmap at 5, because the intermediate 5 had to
be mapped to another value (20000), and then we had to keep mapping all other subordinate ids... up to
close to the maximum number of subordinate ids that we have (or some reasonable value). This is hard
to explain to someone who does not understand how the mappings work internally.
To simplify this, **the second usability improvement** is to be able to use:
--gidmap "+20000:@2000:1"
where the plus flag (`+`) states that the given mapping should extend any previous/default mapping,
overriding any previous conflicting assignment.
Podman will set that mapping and fill the rest of mapped gids with all other subordinated gids, leading
to the same (or an equivalent) full gidmap that we were specifying before.
One final usability improvement related to this is the following:
By default, when podman gets a --gidmap argument but not a --uidmap argument, it copies the mapping.
This is convenient in many scenarios, since usually subordinated uids and gids are assigned in chunks
simultaneously, and the subordinated IDs in /etc/subuid and /etc/subgid for a given user match.
For scenarios with additional subordinated GIDs, this map copying is annoying, since it forces the user
to provide a --uidmap, to prevent the copy from being made. This means, that when the user wants:
--gidmap 0:0:5 --gidmap 5:6:15000 --gidmap 20000:5:1
The user has to include a uidmap as well:
--gidmap 0:0:5 --gidmap 5:6:15000 --gidmap 20000:5:1 --uidmap 0:0:65000
making everything even harder to understand without proper context.
For this reason, besides the "+" flag, we introduce the "u" and "g" flags. Those flags applied to a
mapping tell podman that the mapping should only apply to users or groups, and ignored otherwise.
Therefore we can use:
--gidmap "+g20000:@2000:1"
So the mapping only applies to groups and is ignored for uidmaps. If no "u" nor "g" flag is assigned
podman assumes the mapping applies to both users and groups as before, so we preserve backwards compatibility.
Co-authored-by: Tom Sweeney <tsweeney@redhat.com>
Signed-off-by: Sergio Oller <sergioller@gmail.com>
The default socat timeout is 0.5 seconds.
Make the socket-activate-echo example in socket_activation.md
more robust by increasing the socat timeout.
Fixes: https://github.com/containers/podman/issues/19373
Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
Only use the word "please" in these situations:
- reader is asked to do something inconvenient
- reader is asked for permission
- reader is asked for forgiveness
Remove other uses of the word "please" to
make the language more efficient.
[NO NEW TESTS NEEDED]
Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
Add instructions on how to start the netavark dhcp proxy. Also list
version requirements.
Fixes#17635
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Finishing up the work started by @biergit in #17021
Updates the tutorial to explain the use of `-l/--latest`
and converts many of the examples to use `<container_id>`
as that works locally and remote while `-l` doesn't always.
Thanks for the start on this @biergit !
[NO NEW TESTS NEEDED]
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
As suggested by @edsantiago, the complex script and direct-link in the
docs are adding little value while increasing the CI maintenance burden.
Simply retire the script and strip the direct (versioned) links from the
docs.
Signed-off-by: Chris Evich <cevich@redhat.com>
A conditional in `version-check` bypasses the test for PRs. However,
it appears it was intended to execute during the daily cirrus-cron runs.
However, the cron-job it references (`nightly`) doesn't exist. This is
causing the test to run for every merge into `main`, and never run for
`main` branch cirrus-cron job. Fix the name so the test **ONLY**
runs for the `main` branch cron-job.
Also, since the test is currently failing, update the docs as per the
output instructions.
Signed-off-by: Chris Evich <cevich@redhat.com>
Updated build scripts and installer build scripts to include gvproxy.exe.
Includes tutorial on setting up a Podman VM with QEMU and gvproxy on Windows.
Signed-off-by: Arthur Sengileyev <arthur.sengileyev@gmail.com>
We had a number of references, mostly in docs, to the word master that
can now be changed to main. This PR does that and makes the project a
bit more inclusive.
[NO NEW TESTS NEEDED]
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
mount_program is in storage.options.overlay and not storage.options
(see example in storage.conf)
Signed-off-by: Klaus Frank <agowa338@users.noreply.github.com>
Where the terms CNI and cni are used in documentation like man pages,
readme's, and tutorials, we have begun to add deprecation notices where
applicable. In cases where netavark cannot do what CNI can, those have
been left alone.
[NO NEW TESTS NEEDED]
Signed-off-by: Brent Baude <bbaude@redhat.com>
Intended to be run from nightly Cirrus cron job.
1) Queries github for highest-sorting (not necessarily "latest") tag
2) Checks that the Windows MSI exists, fails if not
3) Cross-checks markdown files to ensure they have up-to-date links
When run interactively, it will auto-update the .md files
to show and link to the latest version. This makes it easy
for anyone to then submit an update PR.
And, it turns out that MSI is obsolete, the new thing is EXE.
Update the tutorials to reflect that.
Signed-off-by: Ed Santiago <santiago@redhat.com>
Podman adds an Error: to every error message. So starting an error
message with "error" ends up being reported to the user as
Error: error ...
This patch removes the stutter.
Also ioutil.ReadFile errors report the Path, so wrapping the err message
with the path causes a stutter.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
