podman命令使用和用户配置--688IT编程网

podman命令使⽤和⽤户配置

什么是Podman？

详情见：

Podman可以替换Docker中了⼤多数⼦命令（RUN，PUSH，PULL等）。Podman不需要守护进程，⽽是使⽤⽤户命名空间来模拟容器中的root，⽆需连接到具有root权限的套接字保证容器的体系安全。

Podman专注于维护和修改OCI镜像的所有命令和功能，例如拉动和标记。它还允许我们创建，运⾏和维护从这些图像创建的容器。

Podman 可以管理和运⾏任何符合 OCI（Open Container Initiative）规范的容器和容器镜像。Podman 提供了⼀个与 Docker 兼容的命令⾏前端来管理 Docker 镜像。

PODMAN主要由红帽发起和推动，是下⼀代的容器技术，包括如下三个模块：Podman，Skopeo和Buildah

这三个⼯具都是符合OCI计划下的⼯具（github/containers）。主要是由RedHat推动的，他们配合可以完成Docker所有的功能，⽽且不需要守护程序或访问有root权限的组，更加安全可靠，是下⼀代容器容器⼯具。

Podman 是⼀个开源的容器运⾏时项⽬，可在⼤多数 Linux 平台上使⽤。Podman 提供与 Docker ⾮常相似的功能。正如前⾯提到的那样，它不需要在你的系统上运⾏任何守护进程，并且它也可以在没有 root 权限的情况下运⾏。

Podman 和docker不同之处？

docker 需要在我们的系统上运⾏⼀个守护进程(docker daemon)，⽽podman 不需要

启动容器的⽅式不同：

docker cli 命令通过API跟 Docker Engine(引擎)交互告诉它我想创建⼀个container，然后docker Engine才会调⽤OCI container runtime(runc)来启动⼀个container。这代表container的process(进程)不会是Docker CLI的child process(⼦进程)，⽽是Docker Engine的child process。

Podman是直接给OCI containner runtime(runc)进⾏交互来创建container的，所以container process直接是podman的child process。

因为docke有docker daemon，所以docker启动的容器⽀持--restart策略，但是podman不⽀持，如果在k8s中就不存在这个问题，我们可以设置pod的重启策略，在系统中我们可以采⽤编写systemd服务来完成⾃启动docker需要使⽤root⽤户来创建容器，但是podman不需要

Podman安装和配置加速器

安装Podman

[root@pos.d]# yum -y install podman

Updating Subscription Management repositories.

warning: /var/cache/dnf/base-43708d1174dbbac2/packages/checkpolicy-2.9-1.el8.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 8483c65d: NOKEY

Transaction test succeeded.

Running transaction

Preparing : 1/1

Installing : python3-libsemanage-2.9-2.el8.x86_64 1/22

Verifying : podman-2.dule_el8.3.0+699+d61d9c41.x86_64 17/22

Verifying : podman-catatonit-2.dule_el8.3.0+699+d61d9c41.x 18/22

Verifying : protobuf-c-1.3.0-4.el8.x86_64 19/22

Complete!

Podman别名

//别名为docker

[root@localhost ~]# alias docker=podman

//确认没有装docker

[root@localhost ~]# rpm -qa|grep docker

//可以使⽤“docker”命令

[root@localhost ~]# docker images

REPOSITORY TAG IMAGE ID CREATED SIZE

docker.io/library/nginx latest 35c43ace9216 2 weeks ago 137 MB

配置加速器

加速器的获取，详情见：

//备份⽂件

[root@localhost ~]# cd /etc/containers/

[root@localhost containers]# ls

certs.d oci policy.json f registries.d f

[root@localhost containers]# f-origin

[root@localhost containers]# ls

certs.d policy.json f-origin f

oci f registries.d

//配置⽂件

#prefix后⾯可以不跟配置，加速器使⽤的是⾃⼰的阿⾥云加速器

[root@localhost containers]# f

unqualified-search-registries = ["docker.io"]

[[registry]]

prefix = "docker.io"

location = "zyva0762.mirror.aliyuncs"

Podman基本命令

podman search 在官⽹搜索镜像

[root@localhost ~]# podman search nginx

INDEX NAME DESCRIPTION STARS OFFICIAL AUTOMATED

docker.io docker.io/library/nginx Official build of Nginx. 14547 [OK]

docker.io docker.io/jwilder/nginx-proxy Automated Nginx reverse proxy for 1982 [OK]

docker.io docker.io/bitnami/nginx Bitnami nginx Docker Image 94 [OK]

podman pull 下载官⽹的镜像，不加版本号默认下载最新版本

[root@localhost ~]# podman pull nginx

Completed short name "nginx" with unqualified-search registries (origin: /etc/f)

Trying to pull docker.io/library/

Getting image source signatures

Copying blob 19e2441aeeab done

Copying blob 8acc495f1d91 done

Copying blob f5a38c5f8d4e done

Copying blob 45b42c59be33 [======================================] 25.8MiB / 25.8MiB

Copying blob ec3bd7de90d7 done

Copying blob 83500d851118 done

Copying config 35c43ace92 done

Writing manifest to image destination

Storing signatures

35c43ace9216212c0f0e546a65eec93fa9fc8e96b25880ee222b7ed2ca1d2151

podman images 查看有哪些镜像

[root@localhost ~]# podman images

REPOSITORY TAG IMAGE ID CREATED SIZE

docker.io/library/nginx latest 35c43ace9216 2 weeks ago 137 MB

podman create 创建⼀个容器

#第⼀种⽅式

[root@localhost ~]# podman create docker.io/library/nginx

6c491585fba9de855e425571b919c3bc33bbe2bd7d43097979fc0cd63864297b

#第⼆种⽅式

[root@localhost ~]# podman create nginx

19a2b985132f269556bdfb9b0772e090e25f6fbf16948a08de4867a7b14c011c

podman ps 查看正在运⾏的容器；-a 表⽰所有的容器

[root@localhost ~]# docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

[root@localhost ~]# docker ps -a

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

19a2b985132f docker.io/library/nginx:latest nginx -g 22 seconds ago Created romantic_saha

6c491585fba9 docker.io/library/nginx nginx -g 29 seconds ago Created elegant_elion

podman start 启动容器

[root@localhost ~]# podman start 79c842403792

79c842403792

#查看正在运⾏的容器

[root@localhost ~]# podman ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

79c842403792 docker.io/library/nginx:latest nginx -g 50 seconds ago Up 22 seconds ago vigorous_newton

podman stop 停⽌容器运⾏

[root@localhost ~]# podman stop 79c842403792

79c8424037921370db4b12473dac4d5f5a899d5bd0deb510743d4e7fe6a07839

#查看正在运⾏的容器

[root@localhost ~]# podman ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

podman restart 重启容器

[root@localhost ~]# podman restart 79c842403792

79c8424037921370db4b12473dac4d5f5a899d5bd0deb510743d4e7fe6a07839

#查看正在运⾏的容器

[root@localhost ~]# podman ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

79c842403792 docker.io/library/nginx:latest nginx -g 5 minutes ago Up 3 seconds ago vigorous_newton

podman rm 删除⼀个容器，不能删除正在运⾏的容器；-f可以删除正在运⾏的容器;rmi删除镜像

#查看正在运⾏的容器

curl是什么命令

[root@localhost ~]# podman ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

79c842403792 docker.io/library/nginx:latest nginx -g 6 minutes ago Up About a minute ago vigorous_newton

#删除容器报错

[root@localhost ~]# podman rm 79c842403792

Error: cannot remove container 79c8424037921370db4b12473dac4d5f5a899d5bd0deb510743d4e7fe6a07839 as it is running - running or paused containers cannot be removed without force: container state improper #强制删除

[root@localhost ~]# podman rm -f 79c842403792

79c8424037921370db4b12473dac4d5f5a899d5bd0deb510743d4e7fe6a07839

#停⽌运⾏

[root@localhost ~]# podman ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

podman run 直接运⾏⼀个容器；-d在后台运⾏

#运⾏⼀个容器

[root@localhost ~]# podman run nginx

/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration

/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/

/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh

10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.f

10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.f

/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh

docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh

/docker-entrypoint.sh: Configuration complete; ready for start up

#打开新终端，查看正在运⾏的容器

[root@localhost ~]# podman ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

1a2defb333e2 docker.io/library/nginx:latest nginx -g 23 seconds ago Up 23 seconds ago dazzling_perlman

#-d在后台运⾏

[root@localhost ~]# podman run -d nginx

966417eedde4e21a7216a7a5126069431fa0e5f3bd0abdea6d94a16520acd24e

podman logs 查看容器⽇志

[root@localhost ~]# podman logs 966417eedde4

/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration

/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/

/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh

10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.f

10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.f

/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh

/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh

/docker-entrypoint.sh: Configuration complete; ready for start up

#在⼀台终端上访问IP

[root@localhost ~]# curl 10.88.0.5

<!DOCTYPE html>

<html>

<head>

<title>Welcome to nginx!</title>

<style>

body {

width: 35em;

margin: 0 auto;

font-family: Tahoma, Verdana, Arial, sans-serif;

}

</style>

</head>

<body>

<h1>Welcome to nginx!</h1>

<p>If you see this page, the nginx web server is successfully installed and

working. Further configuration is required.</p>

<p>For online documentation and support please refer to

Commercial support is available at

<a href="nginx/">nginx</a>.</p>

<p><em>Thank you for using nginx.</em></p>

</body>

</html>

#⽇志已更新