From 8776475bd2059f72865f745dbd576d8b62ad4cd1 Mon Sep 17 00:00:00 2001 From: cyril constantin Date: Sun, 20 Sep 2026 11:06:45 +0200 Subject: [PATCH] up --- README.md | 183 ++++++++- check_status.sh | 41 ++ containers.conf | 937 ++++++++++++++++++++++++++++++++++++++++++++++ create_cluster.sh | 56 +++ env.sh | 21 ++ kind-config.yaml | 23 ++ registries.conf | 7 + storage.conf | 178 +++++++++ 8 files changed, 1445 insertions(+), 1 deletion(-) create mode 100755 check_status.sh create mode 100644 containers.conf create mode 100755 create_cluster.sh create mode 100644 env.sh create mode 100644 kind-config.yaml create mode 100644 registries.conf create mode 100644 storage.conf diff --git a/README.md b/README.md index bf009e0..338daf5 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,184 @@ # kubosm -Kubernetes on podman wih kind without terraform. \ No newline at end of file +Kubernetes on podman wih kind. + +## local storage + +```bash +$ sudo lvcreate --size 64G --name kubernetes blue +ok +$ sudo mkfs.ext4 /dev/blue/kubernetes +$ sudo mount /dev/blue/kubernetes /datas/kubernetes # fstab +$ sudo chown $(whoami):$(whoami) /datas/kubernetes +``` + +## install and configure programs + +```bash +$ sudo apt install kubectl kind podman +$ podman info | grep "^ cgroupVersion: v2$" +$ systemctl --version +systemd 257 (257.13-1~deb13u1) # systemd > 252 : OK ++PAM +AUDIT +SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF -XKBCOMMON -UTMP +SYSVINIT +LIBARCHIVE +$ sudo mkdir /etc/systemd/system/user@.service.d +$ cat > /etc/systemd/system/user@.service.d/delegate.conf <6443/tcp, 127.0.0.1:8080->8080/tcp kubosm-control-plane +$ kubectl cluster-info --context kind-kubosm +Kubernetes control plane is running at https://127.0.0.1:6443 +CoreDNS is running at https://127.0.0.1:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy +To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. +$ kind load docker-image debian:stable-slim --name kubosm +using podman due to KIND_EXPERIMENTAL_PROVIDER +enabling experimental podman provider +Image: "debian:stable-slim" with ID "sha256:a46b31c2389d51329eea0637614ad105716df53be6b623379b7a2a94e03abc54" not yet present on node "kubosm-control-plane", loading... +$ kubectl get namespaces +NAME STATUS AGE +default Active 15m +kube-node-lease Active 15m +kube-public Active 15m +kube-system Active 16m +local-path-storage Active 15m +$ kubectl get nodes +NAME STATUS ROLES AGE VERSION +kubosm-control-plane Ready control-plane 16m v1.32.2 + +``` + +### check + +```bash + $ docker ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +e7fbc32b2ed5 kindest/node:v1.27.1 "/usr/local/bin/entr…" 15 hours ago Up 19 minutes 0.0.0.0:8080->8080/tcp, 127.0.0.1:41823->6443/tcp kubosm-control-plane +f7c98a3a3a2a kindest/node:v1.27.1 "/usr/local/bin/entr…" 15 hours ago Up 19 minutes kubosm-worker +$ kind get clusters +kubosm +$ source env.sh +$ kubectl cluster-info --context kind-kubosm +Kubernetes control plane is running at https://127.0.0.1:41823 +CoreDNS is running at https://127.0.0.1:41823/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy +$ kubectl get deployments +NAME READY UP-TO-DATE AVAILABLE AGE +nginx 1/1 1 1 4m1s +$ kubectl get services +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +kubernetes ClusterIP 10.96.0.1 443/TCP 18h +nginx NodePort 10.96.85.96 8080:30201/TCP 21s + +``` + +## Load and save images + +```bash +$ podman save docker.io/library/registry:3 | xz > /datas/kubernetes/backups/registry.tar.xz +$ podman save docker.io/kindest/node@sha256:f226345927d7e348497136874b6d207e0b32cc52154ad8323129352923a3142f | xz > /datas/kubernetes/backups/kindest.tar.xz +$ podman pull docker.io/debian:sid +Trying to pull docker.io/library/debian:sid... +Getting image source signatures +Copying blob 02991db6507c done | +Copying config ee36d5c9a7 done | +Writing manifest to image destination +ee36d5c9a7c2d8d4edf03c44e7a90f050e0980131b584002ed4100208494cd40 +$ podman tag docker.io/debian:sid localhost:5001/debian:sid +$ docker push localhost:5001/debian:sid +The push refers to repository [localhost:5001/debian] +An image does not exist locally with the tag: localhost:5001/debian +$ kubectl create deployment debian --image=localhost:5001/debian:sid +deployment.apps/debian created +$ podman build -t bash https://git.ccyr.eu/constcyr/debian_podman.git +STEP 1/4: FROM docker.io/library/debian:sid +STEP 2/4: LABEL maintainer="Cyril CONSTANTIN" +--> 002453ba3ffb +STEP 3/4: LABEL io.containers.capabilities="sys_chroot" +--> 4b6cff2dd7f8 +STEP 4/4: CMD ["/usr/bin/bash"] +COMMIT bash +--> cdeda6a6472a +Successfully tagged localhost/bash:latest +cdeda6a6472aeacdfc2de36c1de3d3c9868342ea1cc48f7ff61970ab069ed016 +$ kubectl create deployment bash --image=localhost:5001/bash:latest +deployment.apps/bash created +``` + +## DEPRECATED TESTS + +```bash +$ systemd-run --scope -p "Delegate=yes" --user kind create cluster --config=./kind-config.yaml +$ systemd-run --scope -p "Delegate=yes" --user kind create cluster --name osmkub +$ kind get clusters +osmkub +$ kubectl config get-contexts +CURRENT NAME CLUSTER AUTHINFO NAMESPACE +* kind-osmkub kind-osmkub kind-osmkub +$ podman ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +$ podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +60c8ec5cd33a docker.io/kindest/node@sha256:f226345927d7e348497136874b6d207e0b32cc52154ad8323129352923a3142f 45 hours ago Exited (137) 42 hours ago 127.0.0.1:6443->6443/tcp, 127.0.0.1:8080->8080/tcp osmkub-control-plane +$ podman start 60c8ec5cd33a +60c8ec5cd33a +$ podman ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +60c8ec5cd33a docker.io/kindest/node@sha256:f226345927d7e348497136874b6d207e0b32cc52154ad8323129352923a3142f 45 hours ago Up 36 seconds 127.0.0.1:6443->6443/tcp, 127.0.0.1:8080->8080/tcp osmkub-control-plane +$ kubectl cluster-info --context kind-osmkub +Kubernetes control plane is running at https://127.0.0.1:6443 +CoreDNS is running at https://127.0.0.1:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy +To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. +$ ss -l --tcp |grep 6443 +LISTEN 0 4096 127.0.0.1:6443 0.0.0.0:* +``` + +Copy containers.conf and storage.conf from /usr/share +Modify them with /data/kubernetes + +### offline + +```bash +docker pull kindest/node:v1.17.0@sha256:9512edae126da271b66b990b6fff768fbb7cd786c7d39e86bdf55906352fdf62 +docker save kindest/node:v1.17.0@sha256:9512edae126da271b66b990b6fff768fbb7cd786c7d39e86bdf55906352fdf62 | gzip > /datas/kubernetes/kind.v1.17.0.tar.gz +docker load -i kind.v1.17.0.tar.gz +docker image tag kindest/node:v1.17.0@sha256:9512edae126da271b66b990b6fff768fbb7cd786c7d39e86bdf55906352fdf62 kindest/node:v1.17.0 +docker image ls kindest/node +``` + +### rootless diff --git a/check_status.sh b/check_status.sh new file mode 100755 index 0000000..ebb6458 --- /dev/null +++ b/check_status.sh @@ -0,0 +1,41 @@ +#!/usr/bin/env bash + +ask() +{ + argument=$* + USER_ANSWER="?"; + while [ "${USER_ANSWER}" != "n" ] && [ "${USER_ANSWER}" != "y" ] && [ "${USER_ANSWER}" != "q" ] + do + echo -ne "\E[31;40m\033[1mExecute $* ?\033[0m [y/n/q]" + read -r -n 1 USER_ANSWER + echo ""; + done + if [ "$USER_ANSWER" == "y" ] + then + eval "${argument}" + elif [ "$USER_ANSWER" == "n" ] + then + echo "disabled" + elif [ "$USER_ANSWER" == "q" ] + then + exit 0 + else + echo "Response error" + exit 1 + fi +} + +# shellcheck source=/dev/null +source ./env.sh + +ask systemctl --user status podman.service +ask podman ps +ask podman ps -a +ask podman images +ask podman network ls +ask kind get clusters +ask kubectl cluster-info --context kind-kubosm +ask kubectl get namespaces +ask kubectl get nodes +ask kubectl get deployments +ask kubectl get services diff --git a/containers.conf b/containers.conf new file mode 100644 index 0000000..4b4a001 --- /dev/null +++ b/containers.conf @@ -0,0 +1,937 @@ +# The containers configuration file specifies all of the available configuration +# command-line options/flags for container engine tools like Podman & Buildah, +# but in a TOML format that can be easily modified and versioned. + +# Please refer to containers.conf(5) for details of all configuration options. +# Not all container engines implement all of the options. +# All of the options have hard coded defaults and these options will override +# the built in defaults. Users can then override these options via the command +# line. Container engines will read containers.conf files in up to three +# locations in the following order: +# 1. /usr/share/containers/containers.conf +# 2. /etc/containers/containers.conf +# 3. $XDG_CONFIG_HOME/containers/containers.conf or +# $HOME/.config/containers/containers.conf if $XDG_CONFIG_HOME is not set +# Items specified in the latter containers.conf, if they exist, override the +# previous containers.conf settings, or the default settings. + +[containers] + +# List of annotation. Specified as +# "key = value" +# If it is empty or commented out, no annotations will be added +# +#annotations = [] + +# Used to change the name of the default AppArmor profile of container engine. +# +#apparmor_profile = "container-default" + +# Base file to create the `/etc/hosts` file inside the container. This must either +# be an absolute path to a file on the host system, or one of the following +# special flags: +# "" Use the host's `/etc/hosts` file (the default) +# `none` Do not use a base file (i.e. start with an empty file) +# `image` Use the container image's `/etc/hosts` file as base file +# +#base_hosts_file = "" + +# List of cgroup_conf entries specifying a list of cgroup files to write to and +# their values. For example `memory.high=1073741824` sets the +# memory.high limit to 1GB. +# +# cgroup_conf = [] + +# Default way to to create a cgroup namespace for the container +# Options are: +# `private` Create private Cgroup Namespace for the container. +# `host` Share host Cgroup Namespace with the container. +# +#cgroupns = "private" + +# Control container cgroup configuration +# Determines whether the container will create CGroups. +# Options are: +# `enabled` Enable cgroup support within container +# `disabled` Disable cgroup support, will inherit cgroups from parent +# `no-conmon` Do not create a cgroup dedicated to conmon. +# +#cgroups = "enabled" + +# When no hostname is set for a container, use the container's name, with +# characters not valid for a hostname removed, as the hostname instead of +# the first 12 characters of the container's ID. Containers not running +# in a private UTS namespace will have their hostname set to the host's +# hostname regardless of this setting. +# +#container_name_as_hostname = false + +# List of default capabilities for containers. If it is empty or commented out, +# the default capabilities defined in the container engine will be added. +# +#default_capabilities = [ +# "CHOWN", +# "DAC_OVERRIDE", +# "FOWNER", +# "FSETID", +# "KILL", +# "NET_BIND_SERVICE", +# "SETFCAP", +# "SETGID", +# "SETPCAP", +# "SETUID", +# "SYS_CHROOT", +#] + +# A list of sysctls to be set in containers by default, +# specified as "name=value", +# for example:"net.ipv4.ping_group_range=0 0". +# +default_sysctls = [ + "net.ipv4.ping_group_range=0 0", +] + +# A list of ulimits to be set in containers by default, specified as +# "=:", for example: +# "nofile=1024:2048" +# See setrlimit(2) for a list of resource names. +# Any limit not specified here will be inherited from the process launching the +# container engine. +# Ulimits has limits for non privileged container engines. +# +#default_ulimits = [ +# "nofile=1280:2560", +#] + +# List of devices. Specified as +# "::", for example: +# "/dev/sdc:/dev/xvdc:rwm". +# If it is empty or commented out, only the default devices will be used +# +#devices = [] + +# List of default DNS options to be added to /etc/resolv.conf inside of the container. +# +#dns_options = [] + +# List of default DNS search domains to be added to /etc/resolv.conf inside of the container. +# +#dns_searches = [] + +# Set default DNS servers. +# This option can be used to override the DNS configuration passed to the +# container. The special value "none" can be specified to disable creation of +# /etc/resolv.conf in the container. +# The /etc/resolv.conf file in the image will be used without changes. +# +#dns_servers = [] + +# Environment variable list for the conmon process; used for passing necessary +# environment variables to conmon or the runtime. +# +#env = [ +# "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", +#] + +# Pass all host environment variables into the container. +# +#env_host = false + +# Set the IP address the container should expect to connect to the host. The IP +# address is used by Podman to automatically add the `host.containers.internal` +# and `host.docker.internal` hostnames to the container's `/etc/hosts` file. It +# is also used for the *host-gateway* flag of Podman's `--add-host` CLI option. +# If no IP address is configured (the default), Podman will try to determine it +# automatically, but might fail to do so depending on the container's network +# setup. Adding these internal hostnames to `/etc/hosts` is silently skipped then. +# Set this config to `none` to never add the internal hostnames to `/etc/hosts`. +# +# Note: If Podman is running in a virtual machine using `podman machine` (this +# includes Mac and Windows hosts), Podman will silently skip adding the internal +# hostnames to `/etc/hosts`, unless an IP address was configured manually. The +# internal hostnames are resolved by the gvproxy DNS resolver instead. This config +# has no effect on gvproxy. However, since `/etc/hosts` bypasses the DNS resolver, +# a manually configured IP address still takes precedence. +# +# Note: This config doesn't affect the actual network setup, it just tells Podman +# the IP address it should expect. Configuring an IP address here doesn't ensure +# that the container can actually reach the host using this IP address. +# +#host_containers_internal_ip = "" + +# Default proxy environment variables passed into the container. +# The environment variables passed in include: +# http_proxy, https_proxy, ftp_proxy, no_proxy, and the upper case versions of +# these. This option is needed when host system uses a proxy but container +# should not use proxy. Proxy environment variables specified for the container +# in any other way will override the values passed from the host. +# +#http_proxy = true + +# Run an init inside the container that forwards signals and reaps processes. +# +#init = false + +# Container init binary, if init=true, this is the init binary to be used for containers. +# If this option is not set catatonit is searched in the directories listed under +# the helper_binaries_dir option. It is recommended to just install catatonit +# there instead of configuring this option here. +# +#init_path = "/usr/libexec/podman/catatonit" + +# Default way to to create an IPC namespace (POSIX SysV IPC) for the container +# Options are: +# "host" Share host IPC Namespace with the container. +# "none" Create shareable IPC Namespace for the container without a private /dev/shm. +# "private" Create private IPC Namespace for the container, other containers are not allowed to share it. +# "shareable" Create shareable IPC Namespace for the container. +# +#ipcns = "shareable" + +# Default way to set an interface name inside container. Defaults to legacy +# pattern of ethX, where X is a integer, when left undefined. +# Options are: +# "device" Uses the network_interface name from the network config as interface name. +# Falls back to the ethX pattern if the network_interface is not set. +#interface_name = "" + +# keyring tells the container engine whether to create +# a kernel keyring for use within the container. +# +#keyring = true + +# label tells the container engine whether to use container separation using +# MAC(SELinux) labeling or not. +# The label flag is ignored on label disabled systems. +# +#label = true + +# label_users indicates whether to enforce confined users in containers on +# SELinux systems. This option causes containers to maintain the current user +# and role field of the calling process. By default SELinux containers run with +# the user system_u, and the role system_r. +#label_users = false + +# Logging driver for the container. Available options: k8s-file and journald. +# +#log_driver = "k8s-file" + +# Maximum size allowed for the container log file. Negative numbers indicate +# that no size limit is imposed. If positive, it must be >= 8192 to match or +# exceed conmon's read buffer. The file is truncated and re-opened so the +# limit is never exceeded. +# +#log_size_max = -1 + +# Specifies default format tag for container log messages. +# This is useful for creating a specific tag for container log messages. +# Containers logs default to truncated container ID as a tag. +# +#log_tag = "" + +# List of mounts. Specified as +# "type=TYPE,source=,destination=,", for example: +# "type=bind,source=/var/lib/foobar,destination=/var/lib/foobar,ro". +# If it is empty or commented out, no mounts will be added +# +#mounts = [] + +# Default way to to create a Network namespace for the container +# Options are: +# `private` Create private Network Namespace for the container. +# `host` Share host Network Namespace with the container. +# `none` Containers do not use the network +# +#netns = "private" + +# Do not modify the `/etc/hosts` file in the container. Podman assumes control +# over the container's `/etc/hosts` file by default; refer to the `--add-host` +# CLI option for details. To disable this, either set this config to `true`, or +# use the functionally identical `--no-hosts` CLI option. +# +#no_hosts = false + +# Tune the host's OOM preferences for containers +# (accepts values from -1000 to 1000). +#oom_score_adj = 0 + +# Default way to to create a PID namespace for the container +# Options are: +# `private` Create private PID Namespace for the container. +# `host` Share host PID Namespace with the container. +# +#pidns = "private" + +# Maximum number of processes allowed in a container. +# +#pids_limit = 2048 +pids_limit = 65536 + +# Copy the content from the underlying image into the newly created volume +# when the container is created instead of when it is started. If false, +# the container engine will not copy the content until the container is started. +# Setting it to true may have negative performance implications. +# +#prepare_volume_on_create = false + +# Give extended privileges to all containers. A privileged container turns off +# the security features that isolate the container from the host. Dropped +# Capabilities, limited devices, read-only mount points, Apparmor/SELinux +# separation, and Seccomp filters are all disabled. Due to the disabled +# security features the privileged field should almost never be set as +# containers can easily break out of confinment. +# +# Containers running in a user namespace (e.g., rootless containers) cannot +# have more privileges than the user that launched them. +# +#privileged = false + +# Run all containers with root file system mounted read-only +# +# read_only = false + +# Path to the seccomp.json profile which is used as the default seccomp profile +# for the runtime. +# +#seccomp_profile = "/usr/share/containers/seccomp.json" + +# Size of /dev/shm. Specified as . +# Unit is optional, values: +# b (bytes), k (kilobytes), m (megabytes), or g (gigabytes). +# If the unit is omitted, the system uses bytes. +# +#shm_size = "65536k" + +# Set timezone in container. Takes IANA timezones as well as "local", +# which sets the timezone in the container to match the host machine. +# +#tz = "" + +# Set umask inside the container +# +#umask = "0022" + +# Default way to to create a User namespace for the container +# Options are: +# `auto` Create unique User Namespace for the container. +# `host` Share host User Namespace with the container. +# +#userns = "host" + +# Default way to to create a UTS namespace for the container +# Options are: +# `private` Create private UTS Namespace for the container. +# `host` Share host UTS Namespace with the container. +# +#utsns = "private" + +# List of volumes. Specified as +# "::", for example: +# "/db:/var/lib/db:ro". +# If it is empty or commented out, no volumes will be added +# +#volumes = [] + +#[engine.platform_to_oci_runtime] +#"wasi/wasm" = ["crun-wasm"] +#"wasi/wasm32" = ["crun-wasm"] +#"wasi/wasm64" = ["crun-wasm"] + +[secrets] +#driver = "file" + +[secrets.opts] +#root = "/example/directory" + +[network] + +# Network backend determines what network driver will be used to set up and tear down container networks. +# Valid values are "cni" and "netavark". +# The default value is empty which means that it will automatically choose CNI or netavark. If there are +# already containers/images or CNI networks preset it will choose CNI. +# +# Before changing this value all containers must be stopped otherwise it is likely that +# iptables rules and network interfaces might leak on the host. A reboot will fix this. +# +#network_backend = "" + +# Path to directory where CNI plugin binaries are located. +# +#cni_plugin_dirs = [ +# "/usr/local/libexec/cni", +# "/usr/libexec/cni", +# "/usr/local/lib/cni", +# "/usr/lib/cni", +# "/opt/cni/bin", +#] + +# List of directories that will be searched for netavark plugins. +# +#netavark_plugin_dirs = [ +# "/usr/local/libexec/netavark", +# "/usr/libexec/netavark", +# "/usr/local/lib/netavark", +# "/usr/lib/netavark", +#] + +# The firewall driver to be used by netavark. +# The default is empty which means netavark will pick one accordingly. Current supported +# drivers are "iptables", "nftables", "none" (no firewall rules will be created) and "firewalld" (firewalld is +# experimental at the moment and not recommend outside of testing). +# +#firewall_driver = "" + + +# The network name of the default network to attach pods to. +# +#default_network = "podman" + +# The default subnet for the default network given in default_network. +# If a network with that name does not exist, a new network using that name and +# this subnet will be created. +# Must be a valid IPv4 CIDR prefix. +# +#default_subnet = "10.88.0.0/16" + +# DefaultSubnetPools is a list of subnets and size which are used to +# allocate subnets automatically for podman network create. +# It will iterate through the list and will pick the first free subnet +# with the given size. This is only used for ipv4 subnets, ipv6 subnets +# are always assigned randomly. +# +#default_subnet_pools = [ +# {"base" = "10.89.0.0/16", "size" = 24}, +# {"base" = "10.90.0.0/15", "size" = 24}, +# {"base" = "10.92.0.0/14", "size" = 24}, +# {"base" = "10.96.0.0/11", "size" = 24}, +# {"base" = "10.128.0.0/9", "size" = 24}, +#] + + + +# Configure which rootless network program to use by default. Valid options are +# `slirp4netns` and `pasta` (default). +# +#default_rootless_network_cmd = "pasta" + +# Path to the directory where network configuration files are located. +# For the CNI backend the default is "/etc/cni/net.d" as root +# and "$HOME/.config/cni/net.d" as rootless. +# For the netavark backend "/etc/containers/networks" is used as root +# and "$graphroot/networks" as rootless. +# +#network_config_dir = "/etc/cni/net.d/" + +# Port to use for dns forwarding daemon with netavark in rootful bridge +# mode and dns enabled. +# Using an alternate port might be useful if other dns services should +# run on the machine. +# +#dns_bind_port = 53 + +# A list of default pasta options that should be used running pasta. +# It accepts the pasta cli options, see pasta(1) for the full list of options. +# +#pasta_options = [] + +[engine] +# Index to the active service +# +#active_service = "production" + +#List of compression algorithms. If set makes sure that requested compression variant +#for each platform is added to the manifest list keeping original instance intact in +#the same manifest list on every `manifest push`. Supported values are (`gzip`, `zstd` and `zstd:chunked`). +#`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning +#in that case. +# +#add_compression = ["gzip", "zstd", "zstd:chunked"] + +# Enforces using docker.io for completing short names in Podman's compatibility +# REST API. Note that this will ignore unqualified-search-registries and +# short-name aliases defined in containers-registries.conf(5). +#compat_api_enforce_docker_hub = true + +# Specify one or more external providers for the compose command. The first +# found provider is used for execution. Can be an absolute and relative path +# or a (file) name. +#compose_providers=[] + +# Emit logs on each invocation of the compose command indicating that an +# external compose provider is being executed. +#compose_warning_logs = true + +# The compression format to use when pushing an image. +# Valid options are: `gzip`, `zstd` and `zstd:chunked`. +# This field is ignored when pushing images to the docker-daemon and +# docker-archive formats. It is also ignored when the manifest format is set +# to v2s2. +# `zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning +# in that case. +# +#compression_format = "gzip" + +# The compression level to use when pushing an image. +# Valid options depend on the compression format used. +# For gzip, valid options are 1-9, with a default of 5. +# For zstd, valid options are 1-20, with a default of 3. +# +#compression_level = 5 + +# Cgroup management implementation used for the runtime. +# Valid options "systemd" or "cgroupfs" +# +#cgroup_manager = "systemd" + +# Environment variables to pass into conmon +# +#conmon_env_vars = [ +# "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" +#] + +# Paths to look for the conmon container manager binary +# +#conmon_path = [ +# "/usr/libexec/podman/conmon", +# "/usr/local/libexec/podman/conmon", +# "/usr/local/lib/podman/conmon", +# "/usr/bin/conmon", +# "/usr/sbin/conmon", +# "/usr/local/bin/conmon", +# "/usr/local/sbin/conmon" +#] + +# Enforces using docker.io for completing short names in Podman's compatibility +# REST API. Note that this will ignore unqualified-search-registries and +# short-name aliases defined in containers-registries.conf(5). +#compat_api_enforce_docker_hub = true + +# The database backend of Podman. Supported values are "" (default), "boltdb" +# and "sqlite". An empty value means it will check whenever a boltdb already +# exists and use it when it does, otherwise it will use sqlite as default +# (e.g. new installs). This allows for backwards compatibility with older versions. +# Please run `podman-system-reset` prior to changing the database +# backend of an existing deployment, to make sure Podman can operate correctly. +# +#database_backend = "" + +# Specify the keys sequence used to detach a container. +# Format is a single character [a-Z] or a comma separated sequence of +# `ctrl-`, where `` is one of: +# `a-z`, `@`, `^`, `[`, `\`, `]`, `^` or `_` +# Specifying "" disables this feature. +#detach_keys = "ctrl-p,ctrl-q" + +# Determines whether engine will reserve ports on the host when they are +# forwarded to containers. When enabled, when ports are forwarded to containers, +# ports are held open by as long as the container is running, ensuring that +# they cannot be reused by other programs on the host. However, this can cause +# significant memory usage if a container has many ports forwarded to it. +# Disabling this can save memory. +# +#enable_port_reservation = true + +# Environment variables to be used when running the container engine (e.g., Podman, Buildah). +# For example "http_proxy=internal.proxy.company.com". +# Note these environment variables will not be used within the container. +# Set the env section under [containers] table, if you want to set environment variables for the container. +# +#env = [] + +# Define where event logs will be stored, when events_logger is "file". +#events_logfile_path="" + +# Sets the maximum size for events_logfile_path. +# The size can be b (bytes), k (kilobytes), m (megabytes), or g (gigabytes). +# The format for the size is ``, e.g., `1b` or `3g`. +# If no unit is included then the size will be read in bytes. +# When the limit is exceeded, the logfile will be rotated and the old one will be deleted. +# If the maximum size is set to 0, then no limit will be applied, +# and the logfile will not be rotated. +#events_logfile_max_size = "1m" + +# Selects which logging mechanism to use for container engine events. +# Valid values are `journald`, `file` and `none`. +# +#events_logger = "journald" + +# Creates a more verbose container-create event which includes a JSON payload +# with detailed information about the container. +#events_container_create_inspect_data = false + +# Whenever Podman should log healthcheck events. +# With many running healthcheck on short interval Podman will spam the event +# log a lot as it generates a event for each single healthcheck run. Because +# this event is optional and only useful to external consumers that may want +# to know when a healthcheck is run or failed allow users to turn it off by +# setting it to false. The default is true. +# +#healthcheck_events = true + +# A is a list of directories which are used to search for helper binaries. +# +#helper_binaries_dir = [ +# "/usr/local/libexec/podman", +# "/usr/local/lib/podman", +# "/usr/libexec/podman", +# "/usr/lib/podman", +#] + +# Path to OCI hooks directories for automatically executed hooks. +# +#hooks_dir = [ +# "/usr/share/containers/oci/hooks.d", +#] + +# Directories to scan for CDI Spec files. +# +#cdi_spec_dirs = [ +# "/etc/cdi", +#] + +# Manifest Type (oci, v2s2, or v2s1) to use when pulling, pushing, building +# container images. By default image pulled and pushed match the format of the +# source image. Building/committing defaults to OCI. +# +#image_default_format = "" + +# Default transport method for pulling and pushing for images +# +#image_default_transport = "docker://" + +# Maximum number of image layers to be copied (pulled/pushed) simultaneously. +# Not setting this field, or setting it to zero, will fall back to containers/image defaults. +# +#image_parallel_copies = 0 + +# Tells container engines how to handle the built-in image volumes. +# * anonymous: An anonymous named volume will be created and mounted +# into the container. +# * tmpfs: The volume is mounted onto the container as a tmpfs, +# which allows users to create content that disappears when +# the container is stopped. +# * ignore: All volumes are just ignored and no action is taken. +# +#image_volume_mode = "" + +# Default command to run the infra container +# +#infra_command = "/pause" + +# Infra (pause) container image name for pod infra containers. When running a +# pod, we start a `pause` process in a container to hold open the namespaces +# associated with the pod. This container does nothing other than sleep, +# reserving the pod's resources for the lifetime of the pod. By default container +# engines run a built-in container using the pause executable. If you want override +# specify an image to pull. +# +#infra_image = "" + +# Default Kubernetes kind/specification of the kubernetes yaml generated with the `podman kube generate` command. +# The possible options are `pod` and `deployment`. +#kube_generate_type = "pod" + +# Specify the locking mechanism to use; valid values are "shm" and "file". +# Change the default only if you are sure of what you are doing, in general +# "file" is useful only on platforms where cgo is not available for using the +# faster "shm" lock type. You may need to run "podman system renumber" after +# you change the lock type. +# +#lock_type = "shm" + +# MultiImageArchive - if true, the container engine allows for storing archives +# (e.g., of the docker-archive transport) with multiple images. By default, +# Podman creates single-image archives. +# +#multi_image_archive = false + +# Default engine namespace +# If engine is joined to a namespace, it will see only containers and pods +# that were created in the same namespace, and will create new containers and +# pods in that namespace. +# The default namespace is "", which corresponds to no namespace. When no +# namespace is set, all containers and pods are visible. +# +#namespace = "" + +# Path to the slirp4netns binary +# +#network_cmd_path = "" + +# Default options to pass to the slirp4netns binary. +# Valid options values are: +# +# - allow_host_loopback=true|false: Allow the slirp4netns to reach the host loopback IP (`10.0.2.2`). +# Default is false. +# - mtu=MTU: Specify the MTU to use for this network. (Default is `65520`). +# - cidr=CIDR: Specify ip range to use for this network. (Default is `10.0.2.0/24`). +# - enable_ipv6=true|false: Enable IPv6. Default is true. (Required for `outbound_addr6`). +# - outbound_addr=INTERFACE: Specify the outbound interface slirp should bind to (ipv4 traffic only). +# - outbound_addr=IPv4: Specify the outbound ipv4 address slirp should bind to. +# - outbound_addr6=INTERFACE: Specify the outbound interface slirp should bind to (ipv6 traffic only). +# - outbound_addr6=IPv6: Specify the outbound ipv6 address slirp should bind to. +# - port_handler=rootlesskit: Use rootlesskit for port forwarding. Default. +# Note: Rootlesskit changes the source IP address of incoming packets to a IP address in the container +# network namespace, usually `10.0.2.100`. If your application requires the real source IP address, +# e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for +# rootless containers when connected to user-defined networks. +# - port_handler=slirp4netns: Use the slirp4netns port forwarding, it is slower than rootlesskit but +# preserves the correct source IP address. This port handler cannot be used for user-defined networks. +# +#network_cmd_options = [] + +# Whether to use chroot instead of pivot_root in the runtime +# +#no_pivot_root = false + +# Number of locks available for containers, pods, and volumes. Each container, +# pod, and volume consumes 1 lock for as long as it exists. +# If this is changed, a lock renumber must be performed (e.g. with the +# 'podman system renumber' command). +# +#num_locks = 2048 + +# Set the exit policy of the pod when the last container exits. +#pod_exit_policy = "continue" + +# Whether to pull new image before running a container +# +#pull_policy = "missing" + +# Indicates whether the application should be running in remote mode. This flag modifies the +# --remote option on container engines. Setting the flag to true will default +# `podman --remote=true` for access to the remote Podman service. +# +#remote = false + +# Number of times to retry pulling/pushing images in case of failure +# +#retry = 3 + +# Delay between retries in case pulling/pushing image fails. +# If set, container engines will retry at the set interval, +# otherwise they delay 2 seconds and then exponentially back off. +# +#retry_delay = "2s" + +# Default OCI runtime +# +#runtime = "crun" + +# List of the OCI runtimes that support --format=json. When json is supported +# engine will use it for reporting nicer errors. +# +#runtime_supports_json = ["crun", "runc", "kata", "runsc", "youki", "krun"] + +# List of the OCI runtimes that supports running containers with KVM Separation. +# +#runtime_supports_kvm = ["kata", "krun"] + +# List of the OCI runtimes that supports running containers without cgroups. +# +#runtime_supports_nocgroups = ["crun", "krun"] + +# Default location for storing temporary container image content. Can be overridden with the TMPDIR environment +# variable. If you specify "storage", then the location of the +# container/storage tmp directory will be used. +# image_copy_tmp_dir="/var/tmp" + +# Number of seconds to wait without a connection +# before the `podman system service` times out and exits +# +#service_timeout = 5 + +# Directory for persistent engine files (database, etc) +# By default, this will be configured relative to where the containers/storage +# stores containers +# Uncomment to change location from this default +# +#static_dir = "/var/lib/containers/storage/libpod" + +# Number of seconds to wait for container to exit before sending kill signal. +# +#stop_timeout = 10 + +# Number of seconds to wait before exit command in API process is given to. +# This mimics Docker's exec cleanup behaviour, where the default is 5 minutes (value is in seconds). +# +#exit_command_delay = 300 + +# map of service destinations +# +# [engine.service_destinations] +# [engine.service_destinations.production] +# URI to access the Podman service +# Examples: +# rootless "unix:///run/user/$UID/podman/podman.sock" (Default) +# rootful "unix:///run/podman/podman.sock (Default) +# remote rootless ssh://engineering.lab.company.com/run/user/1000/podman/podman.sock +# remote rootful ssh://root@10.10.1.136:22/run/podman/podman.sock +# +# uri = "ssh://user@production.example.com/run/user/1001/podman/podman.sock" +# Path to file containing ssh identity key +# identity = "~/.ssh/id_rsa" + +# Directory for temporary files. Must be tmpfs (wiped after reboot) +# +#tmp_dir = "/run/libpod" + +# Directory for libpod named volumes. +# By default, this will be configured relative to where containers/storage +# stores containers. +# Uncomment to change location from this default. +# +volume_path = "/datas/kubernetes/kubosm/storage/volumes" + +# Default timeout (in seconds) for volume plugin operations. +# Plugins are external programs accessed via a REST API; this sets a timeout +# for requests to that API. +# A value of 0 is treated as no timeout. +#volume_plugin_timeout = 5 + +# Paths to look for a valid OCI runtime (crun, runc, kata, runsc, krun, etc) +[engine.runtimes] +#crun = [ +# "/usr/bin/crun", +# "/usr/sbin/crun", +# "/usr/local/bin/crun", +# "/usr/local/sbin/crun", +# "/sbin/crun", +# "/bin/crun", +# "/run/current-system/sw/bin/crun", +#] + +#crun-vm = [ +# "/usr/bin/crun-vm", +# "/usr/local/bin/crun-vm", +# "/usr/local/sbin/crun-vm", +# "/sbin/crun-vm", +# "/bin/crun-vm", +# "/run/current-system/sw/bin/crun-vm", +#] + +#kata = [ +# "/usr/bin/kata-runtime", +# "/usr/sbin/kata-runtime", +# "/usr/local/bin/kata-runtime", +# "/usr/local/sbin/kata-runtime", +# "/sbin/kata-runtime", +# "/bin/kata-runtime", +# "/usr/bin/kata-qemu", +# "/usr/bin/kata-fc", +#] + +#runc = [ +# "/usr/bin/runc", +# "/usr/sbin/runc", +# "/usr/local/bin/runc", +# "/usr/local/sbin/runc", +# "/sbin/runc", +# "/bin/runc", +# "/usr/lib/cri-o-runc/sbin/runc", +#] + +#runsc = [ +# "/usr/bin/runsc", +# "/usr/sbin/runsc", +# "/usr/local/bin/runsc", +# "/usr/local/sbin/runsc", +# "/bin/runsc", +# "/sbin/runsc", +# "/run/current-system/sw/bin/runsc", +#] + +#youki = [ +# "/usr/local/bin/youki", +# "/usr/bin/youki", +# "/bin/youki", +# "/run/current-system/sw/bin/youki", +#] + +#krun = [ +# "/usr/bin/krun", +# "/usr/local/bin/krun", +#] + +[engine.volume_plugins] +#testplugin = "/run/podman/plugins/test.sock" + +[machine] +# Number of CPU's a machine is created with. +# +#cpus=1 + +# The size of the disk in GB created when init-ing a podman-machine VM. +# +#disk_size=10 + +# Default Image used when creating a new VM using `podman machine init`. +# Can be specified as registry with a bootable OCI artifact, download URL, or a local path. +# Registry target must be in the form of `docker://registry/repo/image:version`. +# Container engines translate URIs $OS and $ARCH to the native OS and ARCH. +# URI "https://example.com/$OS/$ARCH/foobar.ami" would become +# "https://example.com/linux/amd64/foobar.ami" on a Linux AMD machine. +# If unspecified, the default Podman machine image will be used. +# +#image = "" + +# Memory in MB a machine is created with. +# +#memory=2048 + +# The username to use and create on the podman machine OS for rootless +# container access. +# +#user = "core" + +# Host directories to be mounted as volumes into the VM by default. +# Environment variables like $HOME as well as complete paths are supported for +# the source and destination. An optional third field `:ro` can be used to +# tell the container engines to mount the volume readonly. +# +#volumes = [ +# "$HOME:$HOME", +#] + +# Virtualization provider used to run Podman machine. +# If it is empty or commented out, the default provider will be used. +# Linux: +# qemu - Open source machine emulator and virtualizer. (Default) +# Windows: there are currently two options: +# wsl - Windows Subsystem for Linux (Default) +# hyperv - Windows Server Virtualization +# Mac: there are currently two options: +# applehv - Default Apple Hypervisor (Default) +# libkrun - Launch virtual machines using the libkrun platform, optimized +# for sharing GPU with the machine. +#provider = "" + +# Rosetta supports running x86_64 Linux binaries on a Podman machine on Apple silicon. +# The default value is `true`. Supported on AppleHV(arm64) machines only. +# +#rosetta=true + +# The [machine] table MUST be the last entry in this file. +# (Unless another table is added) +# TOML does not provide a way to end a table other than a further table being +# defined, so every key hereafter will be part of [machine] and not the +# main config. + +[farms] +# +# the default farm to use when farming out builds +# default = "" +# +# map of existing farms +#[farms.list] + +[podmansh] +# Shell to spawn in container. Default: /bin/sh. +#shell = "/bin/sh" +# +# Name of the container the podmansh user should join. +#container = "podmansh" +# +# Default timeout in seconds for podmansh logins. +# Favored over the deprecated "podmansh_timeout" field. +#timeout = 30 diff --git a/create_cluster.sh b/create_cluster.sh new file mode 100755 index 0000000..0bf9dd6 --- /dev/null +++ b/create_cluster.sh @@ -0,0 +1,56 @@ +#!/usr/bin/env bash + +# shellcheck source=/dev/null +source ./env.sh + +logfile=/tmp/kind-get-clusters + +kind get clusters | tee "${logfile}" + +if grep "${CLUSTERNAME}" ${logfile} +then + echo "--- kind delete cluster --name \"${CLUSTERNAME}\"" + kind delete cluster --name "${CLUSTERNAME}" + sleep 30 +fi + +echo "--- podman inspect -f '{{.State.Running}}' \"${REGISTRY_NAME}\"" +podman inspect -f '{{.State.Running}}' "${REGISTRY_NAME}" +if [ "$(podman inspect -f '{{.State.Running}}' "${REGISTRY_NAME}" 2>/dev/null || true)" != 'true' ]; then + podman run \ + -d --restart=always -p "127.0.0.1:${REGISTRY_PORT}:5000" --network bridge --name "${REGISTRY_NAME}" \ + registry:3 +fi + +systemd-run --scope -p "Delegate=yes" --user kind create cluster --config=kind-config.yaml + +for node in $(kind get nodes); do + podman exec "${node}" mkdir -p "${REGISTRY_DIR}" + cat < /datas/kubernetes/backups/registry.tar.xz +# podman save docker.io/kindest/node@sha256:f226345927d7e348497136874b6d207e0b32cc52154ad8323129352923a3142f | xz > /datas/kubernetes/backups/kindest.tar.xz +# podman pull docker.io/debian:sid \ No newline at end of file diff --git a/env.sh b/env.sh new file mode 100644 index 0000000..7da336d --- /dev/null +++ b/env.sh @@ -0,0 +1,21 @@ +#!/usr/bin/env bash + +export CLUSTERNAME=kubosm +export KUBOSM=/git/kubosm +export KIND_EXPERIMENTAL_PROVIDER=podman +export CONTAINERS_CONF=$KUBOSM/containers.conf +export CONTAINERS_REGISTRIES_CONF=$KUBOSM/registries.conf +export CONTAINER_STORAGE_CONF=$KUBOSM/storage.conf +export TMPDIR=/datas/kubernetes/tmpstorage +export XDG_CONFIG_HOME=/datas/git/kubosm +export XDG_DATA_HOME=/datas/kubernetes/kubosm/ +# export XDG_RUNTIME_DIR=/run/user/1000 +# export XDG_RUNTIME_DIR=/datas/kubernetes/containers +export KUBECONFIG=$XDG_DATA_HOME/kube/config +export KUBE_CONFIG_PATH=$XDG_DATA_HOME/kube/config +export KUBE_CTX=kind-kubosm +export KUBE_CTX_CLUSTER=kind-kubosm +export KUBE_HOST=http://127.0.0.1:6443/ +export REGISTRY_NAME="kind-registry" +export REGISTRY_PORT="5001" +export REGISTRY_DIR="/etc/containerd/certs.d/localhost:${REGISTRY_PORT}" diff --git a/kind-config.yaml b/kind-config.yaml new file mode 100644 index 0000000..8310599 --- /dev/null +++ b/kind-config.yaml @@ -0,0 +1,23 @@ +kind: Cluster +apiVersion: kind.x-k8s.io/v1alpha4 +name: kubosm +networking: + # WARNING: It is _strongly_ recommended that you keep this the default + # (127.0.0.1) for security reasons. However it is possible to change this. + apiServerAddress: "127.0.0.1" + # By default the API server listens on a random open port. + # You may choose a specific port but probably don't need to in most cases. + # Using a random port makes it easier to spin up multiple clusters. + apiServerPort: 6443 +nodes: +- role: control-plane + # port forward 8080 on the host to 8080 on this node + extraPortMappings: + - containerPort: 8080 + hostPort: 8080 + # optional: set the bind address on the host + # 0.0.0.0 is the current default + listenAddress: "127.0.0.1" + # optional: set the protocol to one of TCP, UDP, SCTP. + # TCP is the default + protocol: TCP \ No newline at end of file diff --git a/registries.conf b/registries.conf new file mode 100644 index 0000000..e3b8ba8 --- /dev/null +++ b/registries.conf @@ -0,0 +1,7 @@ +# /etc/containers/registries.conf + +# Define a registry that uses HTTP instead of HTTPS + +[[registry]] +location = "my-registry.local:5000" +insecure = true \ No newline at end of file diff --git a/storage.conf b/storage.conf new file mode 100644 index 0000000..9582550 --- /dev/null +++ b/storage.conf @@ -0,0 +1,178 @@ +# This file is the configuration file for all tools +# that use the containers/storage library. The storage.conf file +# overrides all other storage.conf files. Container engines using the +# container/storage library do not inherit fields from other storage.conf +# files. +# +# Note: The storage.conf file overrides other storage.conf files based on this precedence: +# /usr/containers/storage.conf +# /etc/containers/storage.conf +# $HOME/.config/containers/storage.conf +# $XDG_CONFIG_HOME/containers/storage.conf (if XDG_CONFIG_HOME is set) +# See man 5 containers-storage.conf for more information +# The "storage" table contains all of the server options. +[storage] + +# Default storage driver, must be set for proper operation. +driver = "overlay" + +# Temporary storage location +runroot = "/datas/kubernetes/tmpstorage" + +# Priority list for the storage drivers that will be tested one +# after the other to pick the storage driver if it is not defined. +# driver_priority = ["overlay", "btrfs"] + +# Primary Read/Write location of container storage +# When changing the graphroot location on an SELinux system, you must +# ensure the labeling matches the default location's labels with the +# following commands: +# semanage fcontext -a -e /var/lib/containers/storage /NEWSTORAGEPATH +# restorecon -R -v /NEWSTORAGEPATH +graphroot = "/datas/kubernetes/kubosm/storage" + +# Optional alternate location of image store if a location separate from the +# container store is required. If set, it must be different than graphroot. +# imagestore = "" + + +# Storage path for rootless users +# +rootless_storage_path = "/datas/kubernetes/kubosm/storage" + +# Transient store mode makes all container metadata be saved in temporary storage +# (i.e. runroot above). This is faster, but doesn't persist across reboots. +# Additional garbage collection must also be performed at boot-time, so this +# option should remain disabled in most configurations. +# transient_store = true + +[storage.options] +# Storage options to be passed to underlying storage drivers + +# AdditionalImageStores is used to pass paths to additional Read/Only image stores +# Must be comma separated list. +additionalimagestores = [ +] + +# Options controlling how storage is populated when pulling images. +[storage.options.pull_options] +# Enable the "zstd:chunked" feature, which allows partial pulls, reusing +# content that already exists on the system. This is disabled by default, +# and must be explicitly enabled to be used. For more on zstd:chunked, see +# https://github.com/containers/storage/blob/main/docs/containers-storage-zstd-chunked.md +# This is a "string bool": "false" | "true" (cannot be native TOML boolean) +# enable_partial_images = "false" + +# Tells containers/storage to use hard links rather then create new files in +# the image, if an identical file already existed in storage. +# This is a "string bool": "false" | "true" (cannot be native TOML boolean) +# use_hard_links = "false" + +# Path to an ostree repository that might have +# previously pulled content which can be used when attempting to avoid +# pulling content from the container registry. +# ostree_repos="" + +# If set to "true", containers/storage will convert images that are +# not already in zstd:chunked format to that format before processing +# in order to take advantage of local deduplication and hard linking. +# It is an expensive operation so it is not enabled by default. +# This is a "string bool": "false" | "true" (cannot be native TOML boolean) +# convert_images = "false" + +# This should ALMOST NEVER be set. +# It allows partial pulls of images without guaranteeing that "partial +# pulls" and non-partial pulls both result in consistent image contents. +# This allows pulling estargz images and early versions of zstd:chunked images; +# otherwise, these layers always use the traditional non-partial pull path. +# +# This option should be enabled EXTREMELY rarely, only if ALL images that could +# EVER be conceivably pulled on this system are GUARANTEED (e.g. using a signature policy) +# to come from a build system trusted to never attack image integrity. +# +# If this consistency enforcement were disabled, malicious images could be built +# in a way designed to evade other audit mechanisms, so presence of most other audit +# mechanisms is not a replacement for the above-mentioned need for all images to come +# from a trusted build system. +# +# As a side effect, enabling this option will also make image IDs unpredictable +# (usually not equal to the traditional value matching the config digest). +# insecure_allow_unpredictable_image_contents = "false" + +# Root-auto-userns-user is a user name which can be used to look up one or more UID/GID +# ranges in the /etc/subuid and /etc/subgid file. These ranges will be partitioned +# to containers configured to create automatically a user namespace. Containers +# configured to automatically create a user namespace can still overlap with containers +# having an explicit mapping set. +# This setting is ignored when running as rootless. +# root-auto-userns-user = "storage" +# +# Auto-userns-min-size is the minimum size for a user namespace created automatically. +# auto-userns-min-size=1024 +# +# Auto-userns-max-size is the maximum size for a user namespace created automatically. +# auto-userns-max-size=65536 + +[storage.options.overlay] +# ignore_chown_errors can be set to allow a non privileged user running with +# a single UID within a user namespace to run containers. The user can pull +# and use any image even those with multiple uids. Note multiple UIDs will be +# squashed down to the default uid in the container. These images will have no +# separation between the users in the container. Only supported for the overlay +# and vfs drivers. +# This is a "string bool": "false" | "true" (cannot be native TOML boolean) +#ignore_chown_errors = "false" + +# Inodes is used to set a maximum inodes of the container image. +# inodes = "" + +# Path to an helper program to use for mounting the file system instead of mounting it +# directly. +#mount_program = "/usr/bin/fuse-overlayfs" + +# mountopt specifies comma separated list of extra mount options +mountopt = "nodev" + +# Set to skip a PRIVATE bind mount on the storage home directory. +# This is a "string bool": "false" | "true" (cannot be native TOML boolean) +# skip_mount_home = "false" + +# Set to use composefs to mount data layers with overlay. +# This is a "string bool": "false" | "true" (cannot be native TOML boolean) +# use_composefs = "false" + +# Size is used to set a maximum size of the container image. +# size = "" + +# ForceMask specifies the permissions mask that is used for new files and +# directories. +# +# The values "shared" and "private" are accepted. +# Octal permission masks are also accepted. +# +# "": No value specified. +# All files/directories, get set with the permissions identified within the +# image. +# "private": it is equivalent to 0700. +# All files/directories get set with 0700 permissions. The owner has rwx +# access to the files. No other users on the system can access the files. +# This setting could be used with networked based homedirs. +# "shared": it is equivalent to 0755. +# The owner has rwx access to the files and everyone else can read, access +# and execute them. This setting is useful for sharing containers storage +# with other users. For instance have a storage owned by root but shared +# to rootless users as an additional store. +# NOTE: All files within the image are made readable and executable by any +# user on the system. Even /etc/shadow within your image is now readable by +# any user. +# +# OCTAL: Users can experiment with other OCTAL Permissions. +# +# Note: The force_mask Flag is an experimental feature, it could change in the +# future. When "force_mask" is set the original permission mask is stored in +# the "user.containers.override_stat" xattr and the "mount_program" option must +# be specified. Mount programs like "/usr/bin/fuse-overlayfs" present the +# extended attribute permissions to processes within containers rather than the +# "force_mask" permissions. +# +# force_mask = ""