One of the main ideas of containerization is a way to achieve repeatable, hassle-free results. So, when I see headlines that podman gives the same experience and supports docker-compose like deployments (or even provides socket for native docker-compose), I expect that I can grab someone else’s docker-compose file, run $ podman-compose up and enjoy working installation of something. But it’s a trap.
In theory, if you leave service state management out of the equation, it works, but only if the payload doesn’t need access to devices, privileged ports, and you don’t need to organize interpods file sharing or sharing files between the host and pods.
Nevertheless, from time to time when I install a new host with the intention to use containers, I give podman a try as the “new shiny better” alternative to docker. I allocate time (like one evening), and if I’m unable to make it work as I need, I purge it and fall back to docker.
The last time I wanted to run prind in podman, my idea was:
- Create separate user
- Add it to dialout and video groups on the host system
- Run services in user-mode with podman-compose
Looks simple, right? But not in the case of podman.
First of all, device pass-thru doesn’t work in user mode, so if you want to use podman’s --device option, or device: section of compose file, you have to run it under root, which immediately wipes out a major part of podman’s advantages.
Second, podman uses user namespaces, uids:gids which you see in a container not the same as in a host system. Because of that you may have user root in container which started by regular user, but in fact uids:gids will be offset to a host system by values configured in /etc/{subuid,subgid}, which means that even you have video group in the container, it will be different from the video group that the host system user may be a member of.
Because of that, my first two steps of the plan don’t work out of the box.
To counter that, quite recently, podman has an elegant and beautiful solution: you should add a group named keep-groups to the container with the --group-add option. So, here it is? You just add the group keep-groups to the groups section of the compose file? End of the story? Everything works as expected and everyone is happy? Nope!
For some reason it doesn’t work (at least in debian’s podman-compose 1.0.6-1~bpo12+1). But before this masterpiece was born, the same effect may be achieved with --annotation run.oci.keep_original_groups=1 and it works with compose. You need to mount volume /dev and add the next section:
services: klipper: ... volumes: - /dev:/dev annotations: run.oci.keep_original_groups: 1 ... |
It makes groups looks weird and counter-intuitive in containers and forbids you adding new groups with `groups:` section, but it’s better than nothing:
print3d@aurora:~$ id uid=1001(print3d) gid=1001(print3d) groups=1001(print3d),20(dialout),44(video),100(users) print3d@aurora:~$ podman run --group-add keep-groups -v /dev:/dev -it m5p3nc3r/v4l-utils ✔ docker.io/m5p3nc3r/v4l-utils:latest Trying to pull docker.io/m5p3nc3r/v4l-utils:latest... Getting image source signatures Copying blob 366c4c59e228 done Copying blob 5843afab3874 done Copying config 13e86697f5 done Writing manifest to image destination Storing signatures / # id uid=0(root) gid=0(root) groups=65534(nobody),65534(nobody),65534(nobody),0(root) / # ls -l /dev/{ttyUSB1,video0} ls: /dev/{ttyUSB1,video0}: No such file or directory / # ls -ln /dev/ttyUSB1 crw-rw---- 1 65534 65534 188, 1 Dec 26 15:26 /dev/ttyUSB1 / # ls -ln /dev/video0 crw-rw---- 1 65534 65534 81, 0 Dec 17 15:01 /dev/video0 / # v4l2-ctl --list-devices UVC Camera (046d:0825) (usb-0000:04:00.3-5): /dev/video0 /dev/video1 /dev/media0 |