Correct posture for running Podman containers: Use Sudo commands to manage containers under Linux systems

Under Linux systems, Podman is a popular lightweight container engine, but you need to pay attention to some details when operating containers. One of the important issues is how to correctly use the sudo command to manage containers to ensure security and reliability. This article explains how to use sudo commands to properly manage Podman containers.

Containers are an important part of modern computing, and as the infrastructure around containers evolves, new and better tools are beginning to surface. In the past, you could just use LXC to run containers, but as Docker gained popularity, it started to become more and more complicated. Finally, in Podman we get what we expected from a container management system: a daemon-less container engine that makes containers and pods easy to build, run, and manage.

Containers interact directly with Linux kernel capabilities such as control groups and namespaces, and they spawn large numbers of new processes in these namespaces. In short, running a container is actually running a Linux system inside a Linux system. From the operating system's perspective, it looks very much like an administrative and privileged activity. Ordinary users usually do not have the same free control over system resources as containers, so by default, running Podman requires root or sudo privileges. However, this is only the default setting, and it is by no means the only setting available. This article demonstrates how to configure your Linux system so that ordinary users can run Podman without sudo ("rootless").

Namespace user ID

Kernel namespace is essentially a fictitious structure that helps Linux keep track of which processes belong to the same class. This is the "queue guardrail" in Linux. There is really no difference between processes in one queue and processes in another queue, but they can be "cordoned" away from each other. To declare one set of processes as a "container" and another set of processes as your operating system, keeping them separate is key.

Linux uses user ID (UID) and group ID (GID) to track which user or group owns a process. Typically, a user has access to a thousand or so slave UIDs assigned to child processes in a namespace. Since Podman runs the entire slave operating system assigned to the user who launched the container, you need more than the default assigned slave UID and slave GID.

You can use the usermod command to grant more subordinate UIDs and subordinate GIDs to a user. For example, to grant user tux more subordinate UIDs and subordinate GIDs, choose an appropriately high UID (such as 200000) for users not yet assigned to it, and then increase it by a few thousand:

$ sudo usermod \
--add-subuids 200000-265536 \
--add-subgids 200000-265536 \
tux

Namespace access

There is also a limit on the number of namespaces. This is usually set very high. You can use systctl, the kernel parameter tool, to verify user namespace allocations:

$ sysctl --all --pattern user_namespaces
user.max_user_namespaces = 28633

This is plenty of namespace, and may be the default for your distribution. If your distribution does not have this property or is set very low, then you can create it by entering text like this in the file /etc/sysctl.d/userns.conf:

user.max_user_namespaces=28633

Load this setting:

$ sudo sysctl -p /etc/sysctl.d/userns.conf

Running a container without root privileges

When you have set up your configuration, restart your computer to ensure that your user and kernel parameter changes are loaded and activated.

After restarting, try to run a container image:

$ podman run -it busybox echo "hello"
hello

Containers are like commands

This article details the correct posture for using sudo to maintain Podman containers under Linux systems, including sudoers file configuration, security configuration, and starting containers. By properly configuring and using sudo, we can better protect the security and reliability of the container and better meet business needs. It should be noted that in actual operations, sensitive information must be handled with caution to ensure that unnecessary losses are not caused. I hope this article can help you better master the skills of using sudo command to manage Podman containers.

The above is the detailed content of Correct posture for running Podman containers: Use Sudo commands to manage containers under Linux systems. For more information, please follow other related articles on the PHP Chinese website!