Hacker News Reader

Comment by zokier | Hacker News Reader

Why on earth would you run services on a server with --user and then fiddle with lingering logins instead of just using the system service manager?

View on HN

I'll answer this for you. You want rootless podman because docker is the defacto standard way of packaging non-legacy software now including autoupdates. I know, sad... Podman still does not offer convenient and mature way for systemd to run it with an unprivileged user. It is the only gripe I've had with this approach...

This is no longer true as of Podman 5 and Quadlet?

You can define rootless containers to run under systemd services as unprivileged users. You can use machinectl to login as said user and interact with systemctl.

Quadlet debuted with Podman 4.4 iirc.

Oh yes, correct!

Can you please link the docs for this?

This is a good intro [0], courtesy of Redhat.

This is a good example [1], cited elsewhere in this post.

Documentation for quadlet systemd units [2].

[0]: https://www.redhat.com/en/blog/quadlet-podman

[1]: https://mo8it.com/blog/quadlet/

[2]: https://docs.podman.io/en/latest/markdown/podman-systemd.uni...

You see, my issue with this is that it suggests using the quadlets with lingering users... Which is the same annoying case as with the article. It is not as with other systemd services that you just instruct systemd to take a temporary uid/gid and run the service with it.

I really like rootless podman, but there is one quirk in that if you want to preserve the original source IP address (e.g. for web server logs), you have to use a workaround which has a performance penalty.

https://github.com/containers/podman/issues/10884

https://github.com/containers/podman/pull/9052

https://github.com/containers/podman/pull/11177

Correct me if I'm wrong but doesn't pasta solve this?

That workaround is not needed if the web server container supports socket activation. Due to the fork-exec architecture of Podman, the socket-activated socket is inherited by the container process. Network traffic sent over this socket-activated socket has native performance. https://github.com/containers/podman/blob/main/docs/tutorial...

It appears that systemd User= and DynamicUser= is incompatible with Podman so --user is being used as a replacement. Looks messy.

https://github.com/containers/podman/discussions/20573

You will have many similar questions with systemd once you start doing a bit more complicated things outside of simple services.

Reply on news.ycombinator.com