Podman foobar

Podman foobar

Setup foobar Project

Copy and rename this folder to active/podman_foobar
Find and replace foobar with the name of the service.
Create the rootless user to run the podman containers
Write the compose.yaml spec for your service
Convert the compose.yaml spec to a quadlet
Install the quadlet on the podman server
Expose the quadlet service
Install a backup service and timer

Install foobar

Create the foobar user

useradd foobar

su - foobar
ssh-keygen
exit
cp ~/.ssh/authorized_keys /home/foobar/.ssh/authorized_keys
chown foobar:foobar /home/foobar/.ssh/authorized_keys
loginctl enable-linger $(id -u foobar)

SSH into the server as foobar

systemctl --user enable podman-restart
systemctl --user enable --now podman.socket
mkdir -p ~/.config/containers/systemd

Write the foobar compose spec

Edit the compose.yaml at active/foobar/compose/compose.yaml

Convert foobar compose spec to quadlets

On your local machine:

# Generate the systemd service
podman run \
--security-opt label=disable \
--rm \
-v $(pwd)/active/foobar/:/compose \
-v $(pwd)/active/foobar/quadlets:/quadlets \
quay.io/k9withabone/podlet \
-f /quadlets \
-i \
--overwrite \
compose /compose/compose.yaml

# Copy the files to the server
scp -r active/foobar/quadlets/. foobar:~/.config/containers/systemd/

ssh foobar systemctl --user daemon-reload
ssh foobar systemctl --user restart foobar
# Enables auto-update service which will pull new container images automatically every day
ssh foobar systemctl --user enable --now podman-auto-update.timer

Expose foobar

If you need a domain, follow the DDNS instructions
For a web service, follow the Caddy instructions
Finally, follow your OS's guide for opening ports via its firewall service.

firewalld

# command to get current active zone and default zone
firewall-cmd --get-active-zones
firewall-cmd --get-default-zone

# command to open 443 on tcp
firewall-cmd --permanent --zone=<zone> --add-port=443/tcp

# command to open 80 and 443 on tcp and udp
firewall-cmd --permanent --zone=<zone> --add-port={80,443}/{tcp,udp}

# command to list available services and then open http and https
firewall-cmd --get-services
firewall-cmd --permanent --zone=<zone> --add-service={http,https}

Backup foobar

Follow the Borg Backup instructions

Upgrade foobar

Upgrade Quadlets

Upgrades should be a repeat of writing the compose spec and installing the quadlets

scp -r quadlets/. foobar:~/.config/containers/systemd/
ssh foobar systemctl --user daemon-reload
ssh foobar systemctl --user restart foobar

Notes

SELinux

https://blog.christophersmart.com/2021/01/31/podman-volumes-and-selinux/

:z allows a container to share a mounted volume with all other containers.

:Z allows a container to reserve a mounted volume and prevents any other container from accessing.

3.7 KiB Raw Blame History