podman support

[hoshsadiq]

Could we get podman support? I noticed in 2 other issues you mentioned that you're waiting for deb packages to be released. Not sure when they were released, but instructions on installation are available for Debian based distros.

[eine]

Podman is also the default on latest Fedora, and installing docker can be not straightforward.

[mviereck]

I am interested in supporting podman, too.
I could straightforward install it now on Debian testing from the Debian repository. For this I was waiting.

A first test run just typing podman gives an error:

$ podman
cannot clone: Operation not permitted
user namespaces are not enabled in /proc/sys/kernel/unprivileged_userns_clone
Error: could not get runtime: cannot re-exec process

I've included an experimental x11docker option --podman That just runs podman instead of docker.
A first test run with sudo x11docker --podman -d x11docker/fvwm gives me:

$ sudo ~/git/x11docker/x11docker --podman -d x11docker/fvwm
WARN[0000] unable to find /etc/containers/registries.conf. some podman (image shortnames) commands may be limited 
WARN[0000] unable to find /etc/containers/registries.conf. some podman (image shortnames) commands may be limited 
WARN[0000] unable to find /etc/containers/registries.conf. some podman (image shortnames) commands may be limited 
Image x11docker/fvwm not found locally.
Do you want to pull it from docker hub?
(timeout after 60s assuming no) [Y|n]
x11docker note: Pulling image 'x11docker/fvwm' from docker hub

Error: error pulling image "x11docker/fvwm": unable to pull x11docker/fvwm: image name provided is a short name and no search registries are defined in the registries config file.

So it seems podman needs some setup beforehand.

[hoshsadiq]

So I've setup a soft link for docker to become podman (which is apparently a relatively common pattern, as there's a podman-docker package for example), based on this I tried running x11docker (which picked up the link and thus ran it using podman). I tried running kodi, but no success. I will try with --podman changes later.

So it seems podman needs some setup beforehand.

I had some issues running it as well. Can you show me the output of the following commands?:

podman pull x11docker/fvwm
podman unshare cat /proc/self/uid_map

Also, do you have the packages uidmap and slirp4netns installed? If you get some along the lines of there might not be enough IDs available in the namespace or to that effect, simply ensure uidmap and slirp4netns is installed, then run podman system migrate. After running this command the above unshare command should output an additional line compared to before.

[mviereck]

do you have the packages uidmap and slirp4netns installed?

Yes.

$ podman pull x11docker/fvwm
cannot clone: Operation not permitted
user namespaces are not enabled in /proc/sys/kernel/unprivileged_userns_clone
Error: could not get runtime: cannot re-exec process

$ podman unshare cat /proc/self/uid_map
cannot clone: Operation not permitted
user namespaces are not enabled in /proc/sys/kernel/unprivileged_userns_clone
Error: could not get runtime: cannot re-exec process

$ podman system migrate
cannot clone: Operation not permitted
user namespaces are not enabled in /proc/sys/kernel/unprivileged_userns_clone
Error: could not get runtime: cannot re-exec process

$ sudo podman system migrate
$

$ podman unshare cat /proc/self/uid_map
cannot clone: Operation not permitted
user namespaces are not enabled in /proc/sys/kernel/unprivileged_userns_clone
Error: could not get runtime: cannot re-exec process

$ sudo podman unshare cat /proc/self/uid_map
Error: please use unshare with rootless

$ cat /proc/sys/kernel/unprivileged_userns_clone
0

$ sudo podman pull x11docker/fvwm
Error: error pulling image "x11docker/fvwm": unable to pull x11docker/fvwm: image name provided is a short name and no search registries are defined in the registries config file.

[jd666]

This is what I use to get a working container environment:

rel=10;    ## 10, Testing, Unstable
kr=/usr/share/keyrings/libcontainers-deb-${rel}-keyring.gpg
curl -s -o ${kr}-tmp https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_$rel/Release.key
rm -f $kr; gpg --no-default-keyring --keyring=$kr --import ${kr}-tmp && rm ${kr}-tmp
echo "deb [signed-by=${kr}] https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_$rel/ /" > /etc/apt/sources.list.d/libcontainers-deb-$rel.list
apt update && apt install podman buildah crun slirp4netns varlink

The error message indicates that somehow during the setup a kernel parameter wasn't set. You can run sudo sysctl -w kernel.unprivileged_userns_clone=1 to work around it. This disables a bit of "hardening" that Debian patches into their distribution kernel. If you're not running such a kernel, it will fail and not do anything, as such a setting doesn't even exist in the mainline Linux kernel. If you were running such a patched kernel, all it would do is disable the functionality of that patch, and let your kernel work like every other kernel, allowing unprivileged users to use unshare -U. ((Please note that this is weakening the security as it allows non-root users to use kernel namespaces -- but that is exactly what unprivileged containers do..))

[mviereck]

sudo sysctl -w kernel.unprivileged_userns_clone=1

Thank you! That was a missing key, and thanks for the further explanation of it.

Another missing point was etc/containers/registries.conf (partially taken from https://podman.io/getting-started/installation.html):

$ cat /etc/containers/registries.conf 
[registries.search]
registries = ['docker.io']

But pulling from docker hub fails:

$ podman pull x11docker/fvwm
Trying to pull docker.io/x11docker/fvwm...
Getting image source signatures
Copying blob 77025076aa24 done
Copying blob aad63a933944 done
  read tcp 192.168.178.46:44284->104.18.123.25:443: read: connection reset by peer
Error: error pulling image "x11docker/fvwm": unable to pull x11docker/fvwm: 1 error occurred:
	* Error writing blob: error storing blob to file "/var/tmp/storage448539135/2": read tcp 192.168.178.46:44284->104.18.123.25:443: read: connection reset by peer

It might be an issue due to my low internet bandwith and docker hub just interrupting a slow download.

Using the local docker images failes, too (https://developers.redhat.com/blog/2019/02/21/podman-and-buildah-for-docker-users/):

$ podman pull  docker-daemon:x11docker/fvwm
Error: error pulling image "docker-daemon:x11docker/fvwm": unable to pull docker-daemon:x11docker/fvwm: error getting default registries to try: invalid reference format

Maybe the local docker images need an entry in /etc/containers/registries.conf , too.

[mviereck]

First success!

The podman pull command fails for unknown reasons in podman itself, it's not to blame docker hub (that also sometimes interrupts my downloads). I assume podman tries to store the image in a root-owned folder.

Running everything with sudo fixes those issues for now. To run podman unprivileged, some better setup should be done by the Debian package.

Once I had a podman image x11docker/fvwm, x11docker --podman failed with an apparmor error message. I could fix it with --security-opt apparmor=unconfined. Apparmor is running on my Debian 11/bullseye. Maybe podman does not provide a valid profile.

This one works so far:

sudo x11docker --podman --desktop -- --security-opt apparmor=unconfined -- x11docker/fvwm

Interestingly, this works so far without sudo sysctl -w kernel.unprivileged_userns_clone=1. x11docker sets --userns=host to allow host file sharing; that might be the reason.

Edit:
Currently it makes sense to me to wait some weeks before I try to fix the current issues. The podman package in Debian testing is quite fresh and will likely get some fixes soon.

[adreyer666]

I had x11docker --podman working and then updated today..
Now I am getting errors and it looks like dockeris hardceded somewhere in a dockerrc:

$ x11docker --podman x11docker/check
x11docker note: Option --podman: experimental only.

x11docker note: Using X server option --xpra

x11docker note: Option --xpra: If you encounter issues with xpra, 
  you can try --nxagent instead.

/home/adreyer/.cache/x11docker/x11docker-check-17277368301/dockerrc: line 542: docker: command not found

x11docker ERROR: dockerrc(): Did not receive PID of PID1 in container. 
  Maybe the container immediately stopped forunknown reasons. 
  Output of "docker ps | grep x11docker": 

...

I can send the full verbose log if needed.

[mviereck]

I found the hardcoded docker command, it was part of the error message. Is fixed now.
But this could not cause the startup failure.

Can you please provide the full log at www.pastebin.com?

[adreyer666]

https://pastebin.com/e9y1738u

[mviereck]

I found the messages of interest:

==> /home/adreyer/.cache/x11docker/x11docker-check-16958756445/message.log <==
DEBUGNOTE[09:29:27,238]: storeinfo(): containerid=b06a56814aabdb715e903d1babd06255a1dfb4973200ac84f52b9070230946ad
 
==> /home/adreyer/.cache/x11docker/x11docker-check-16958756445/share/container.log <==
Error: container b06a56814aabdb715e903d1babd06255a1dfb4973200ac84f52b9070230946ad does not exist in database: no such container
 
==> /home/adreyer/.cache/x11docker/x11docker-check-16958756445/message.log <==
DEBUGNOTE[09:29:27,805]: dockerrc: Container is up and running.
DEBUGNOTE[09:29:27,823]: storepid(): Stored pid '1090534' of 'dockerlogs': 1090534 pts/13   00:00:00 podman
 
==> /home/adreyer/.cache/x11docker/x11docker-check-16958756445/share/stderr <==
Error: no container with name or ID b06a56814aabdb715e903d1babd06255a1dfb4973200ac84f52b9070230946ad found: no such container
 
==> /home/adreyer/.cache/x11docker/x11docker-check-16958756445/share/container.log <==
Error: error inspecting object: no such object: "x11docker_X113_x11docker-check_16958756445"
 
==> /home/adreyer/.cache/x11docker/x11docker-check-16958756445/message.log <==
DEBUGNOTE[09:29:27,858]: dockerrc: 1. check for PID 1: 
 
==> /home/adreyer/.cache/x11docker/x11docker-check-16958756445/share/container.log <==
Error: error inspecting object: no such object: "x11docker_X113_x11docker-check_16958756445"

x11docker receives a container id from podman. But asking podman for the container with this id results in

Error: container b06a56814aabdb715e903d1babd06255a1dfb4973200ac84f52b9070230946ad does not exist in database: no such container

The related code in dockerrc:

   509	[ "$Containerid" ] || {
   510	    error "Startup of docker failed. Did not receive a container ID.
   511	    
   512	  Last lines of container log:
   513	$(rmcr < /home/adreyer/.cache/x11docker/x11docker-check-16958756445/share/container.log | tail)"
   514	}
   515	storeinfo containerid="$Containerid"
   516	# Wait for container to be ready
   517	for ((Count=1 ; Count<=40 ; Count++)); do
   518	  podman exec x11docker_X113_x11docker-check_16958756445 sh -c : 2>&1 | rmcr >>/home/adreyer/.cache/x11docker/x11docker-check-16958756445/share/container.log && { debugnote 'dockerrc: Container is up and running.' ; break ; } || debugnote "dockerrc: Container not ready on $Count. attempt, trying again."
   519	  rocknroll || exit 64
   520	  mysleep 0.1
   521	done
   522	
   523	# Store container output separated for stdout and stderr
   524	podman logs -f $Containerid 1>>/home/adreyer/.cache/x11docker/x11docker-check-16958756445/share/stdout 2>>/home/adreyer/.cache/x11docker/x11docker-check-16958756445/share/stderr &
   525	Dockerlogspid=$!
   526	storepid $Dockerlogspid dockerlogs
   527	
   528	# Wait for pid 1 in container
   529	for ((Count=1 ; Count<=40 ; Count++)); do
   530	  Pid1pid="$(podman inspect --format '{{.State.Pid}}' x11docker_X113_x11docker-check_16958756445 2>>/home/adreyer/.cache/x11docker/x11docker-check-16958756445/share/container.log | rmcr)"
   531	  debugnote "dockerrc: $Count. check for PID 1: $Pid1pid"
   532	  checkpid "$Pid1pid" && break
   533	  rocknroll || exit 64
   534	  mysleep 0.1
   535	done
   536	[ -z "$Pid1pid" ] && error "dockerrc(): Did not receive PID of PID1 in container.
   537	  Maybe the container immediately stopped forunknown reasons.
   538	  Output of \"docker ps | grep x11docker\":
   539	$(docker ps | grep x11docker)

It seems that podman exec x11docker_X113_x11docker-check_16958756445 sh -c : succeeds.
But after that, podman logs -f $Containerid fails.
and podman inspect --format '{{.State.Pid}}' x11docker_X113_x11docker-check_16958756445 fails, too.

I am not sure yet what is going on. Currently I suspect a podman issue, not an x11docker issue.

[mviereck]

I had x11docker --podman working and then updated today..

Did you update x11docker or podman?

Edit:
I just want to note that I don't want to fix bugs caused by podman itself.
podman is said to be an in-place replacement for docker on cli, but does not need root privileges.
If podman fails here, either needing root privileges or behaving different than docker, I don't want to fix or workaround this in x11docker.
The podman debian package is still new and in testing stage, its bugs/issues might be fixed after some time.