使用 Podman 运行一个 “hello world” MLCube
Podman MLCube
![](/data/attachment/album/202204/27/103635qwtt6329orht0393.jpg)


[MLCube](https://mlcommons.org/en/mlcube/) 是一个新的基于基础设施规范的开源容器，被引入到基于 Python 的机器学习工作流程中，以实现可重复性。它可以利用诸如 [Podman](https://podman.io/)、[Singularity](https://sylabs.io/singularity/) 和 [Docker](https://www.docker.com/) 等工具。也支持在远程平台上的执行。开发 MLCube 的 MLCommons 最佳实践工作组的主席之一是来自 Red Hat 的 [Diane Feddema](https://www.redhat.com/en/authors/diane-feddema)。这篇介绍性文章解释了如何在 Fedora Linux 上使用 Podman 运行 [“hello world” MLCube 例子](https://mlcommons.github.io/mlcube/getting-started/hello-world/)。


[Yazan Monshed](https://fedoramagazine.org/author/yazanalmonshed/) 写了一篇关于 [Fedora 上的 Podman](https://fedoramagazine.org/getting-started-with-podman-in-fedora/) 的非常有用的介绍，对这里使用的一些步骤给出了更多细节。


首先安装必要的依赖项。



```
sudo dnf -y update
sudo dnf -y install podman git virtualenv \
                    policycoreutils-python-utils

```

然后，按照文档的要求，设置一个虚拟环境并获得示例代码。为了确保可重复性，使用一个特定的提交，因为该项目正在积极改进。



```
virtualenv -p python3 ./env_mlcube 
source ./env_mlcube/bin/activate
git clone https://github.com/mlcommons/mlcube_examples.git 
cd ./mlcube_examples/hello_world
git checkout 5fe69bd
pip install mlcube mlcube-docker
mlcube describe

```

现在，通过编辑 $HOME/mlcube.yaml 文件，将运行器命令从 `docker` 改为 `podman`，即：



```
docker: docker

```

改为：



```
docker: podman

```

如果你使用的是 x86\_64 架构的电脑，你可以用以下方式获取容器：



```
mlcube configure --mlcube=. --platform=docker

```

你会看到一些选项：



```
? Please select an image: 
  ▸ registry.fedoraproject.org/mlcommons/hello_world:0.0.1
    registry.access.redhat.com/mlcommons/hello_world:0.0.1
    docker.io/mlcommons/hello_world:0.0.1
    quay.io/mlcommons/hello_world:0.0.1

```

选择 `docker.io/mlcommons/hello_world:0.0.1` 来获取容器。


如果你的电脑不是 x86\_64 架构的，你需要构建容器。改变文件 `$HOME/mlcube.yaml`，将这一行：



```
build_strategy: pull

```

变为：



```
build_strategy: auto

```

然后用以下方法构建容器：



```
mlcube configure --mlcube=. --platform=docker

```

要运行测试，你可能需要在目录中适当地设置 SELinux 权限。你可以通过输入以下内容来检查 SELinux 是否已经启用：



```
sudo sestatus

```

应该会有类似这样的输出：



```
SELinux status:                 enabled
...

```

[Josphat Mutai](https://computingforgeeks.com/set-selinux-context-label-for-podman-graphroot-directory/)、[Christopher Smart](https://blog.christophersmart.com/2021/01/31/podman-volumes-and-selinux/) 和 [Daniel Walsh](https://opensource.com/article/18/2/selinux-labels-container-runtimes) 解释说，在为容器使用的文件设置适当的 SELinux 策略时，你需要谨慎。在这里，你将允许容器读取和写入 `workspace` 目录。



```
sudo semanage fcontext -a -t container_file_t "$PWD/workspace(/.*)?"
sudo restorecon -Rv $PWD/workspace

```

现在检查目录策略：



```
ls -Z

```

输出结果类似于：



```
unconfined_u:object_r:user_home_t:s0 Dockerfile
unconfined_u:object_r:user_home_t:s0 README.md
unconfined_u:object_r:user_home_t:s0 mlcube.yaml
unconfined_u:object_r:user_home_t:s0 requirements.txt
unconfined_u:object_r:container_file_t:s0 workspace

```

现在运行这个例子：



```
mlcube run --mlcube=. --task=hello --platform=docker
mlcube run --mlcube=. --task=bye --platform=docker

```

最后，检查输出：



```
cat workspace/chats/chat_with_alice.txt

```

有类似于以下的文字：



```
Hi, Alice! Nice to meet you.
Bye, Alice! It was great talking to you.

```

你可以按照 [这里](https://mlcommons.github.io/mlcube/tutorials/create-mlcube/) 的描述创建你自己的 MLCube。欢迎对 [MLCube 示例库](https://github.com/mlcommons/mlcube_examples) 做出贡献。[Udica](https://github.com/containers/udica) 是一个新项目，它承诺为容器提供更精细的 SELinux 策略控制，便于系统管理员应用。这些项目的积极开发正在进行中。对它们进行测试并提供反馈，将有助于使带有 SELinux 的系统上的安全数据管理更容易、更有效。




---


via: <https://fedoramagazine.org/mlcube-and-podman/>


作者：[Benson Muite](https://fedoramagazine.org/author/fed500/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
[MLCube](https://mlcommons.org/en/mlcube/) is a new open source container based infrastructure specification introduced to enable reproducibility in Python based machine learning workflows. It can utilize tools such as [Podman](https://podman.io/), [Singularity](https://sylabs.io/singularity/) and [Docker](https://www.docker.com/). Execution on remote platforms is also supported. One of the chairs of the MLCommons Best Practices working group that is developing MLCube is [Diane Feddema](https://www.redhat.com/en/authors/diane-feddema) from Red Hat. This introductory article explains how to run the [hello world MLCube example](https://mlcommons.github.io/mlcube/getting-started/hello-world/) using Podman on Fedora Linux.

[Yazan Monshed](https://fedoramagazine.org/author/yazanalmonshed/) has written a very helpful introduction to [Podman on Fedora](https://fedoramagazine.org/getting-started-with-podman-in-fedora/) which gives more details on some of the steps used here.

First install the necessary dependencies.

sudo dnf -y update sudo dnf -y install podman git virtualenv \ policycoreutils-python-utils

Then, following the documentation, setup a virtual environment and get the example code. To ensure reproducibility, use a specific commit as the project is being actively improved.

virtualenv -p python3 ./env_mlcube source ./env_mlcube/bin/activate git clone https://github.com/mlcommons/mlcube_examples.git cd ./mlcube_examples/hello_world git checkout 5fe69bd pip install mlcube mlcube-docker mlcube describe

Now change the runner command from *docker* to *podman* by editing the file `$HOME/mlcube.yaml` so that the line

docker: docker

becomes

docker: podman

If you are on a computer with x86_64 architecture, you can get the container using

mlcube configure --mlcube=. --platform=docker

You will see a number of options

? Please select an image: ▸ registry.fedoraproject.org/mlcommons/hello_world:0.0.1 registry.access.redhat.com/mlcommons/hello_world:0.0.1 docker.io/mlcommons/hello_world:0.0.1 quay.io/mlcommons/hello_world:0.0.1

Choose `docker.io/mlcommons/hello_world:0.0.1` to obtain the container.

If you are not on a computer with x86_64 architecture, you will need to build the container. Change the file `$HOME/mlcube.yaml` so that the line

build_strategy: pull

becomes

build_strategy: auto

and then build the container using

mlcube configure --mlcube=. --platform=docker

To run the tests, you may need to set SELinux permissions in the directories appropriately. You can check that SELinux is enabled by typing

sudo sestatus

which should give you output similar to

SELinux status: enabled ...

[Josphat Mutai](https://computingforgeeks.com/set-selinux-context-label-for-podman-graphroot-directory/), [Christopher Smart](https://blog.christophersmart.com/2021/01/31/podman-volumes-and-selinux/) and [Daniel Walsh](https://opensource.com/article/18/2/selinux-labels-container-runtimes) explain that you need to be careful in setting appropriate SELinux policies for files used by containers. Here, you will allow the container to read and write to the *workspace* directory.

sudo semanage fcontext -a -t container_file_t "$PWD/workspace(/.*)?" sudo restorecon -Rv $PWD/workspace

Now check the directory policy by checking that

ls -Z

gives output similar to

unconfined_u:object_r:user_home_t:s0 Dockerfile unconfined_u:object_r:user_home_t:s0 README.md unconfined_u:object_r:user_home_t:s0 mlcube.yaml unconfined_u:object_r:user_home_t:s0 requirements.txt unconfined_u:object_r:container_file_t:s0 workspace

Now run the example

mlcube run --mlcube=. --task=hello --platform=docker mlcube run --mlcube=. --task=bye --platform=docker

Finally, check that the output

cat workspace/chats/chat_with_alice.txt

has text similar to

Hi, Alice! Nice to meet you. Bye, Alice! It was great talking to you.

You can create your own MLCube as described [here](https://mlcommons.github.io/mlcube/tutorials/create-mlcube/). Contributions to the [MLCube examples repository](https://github.com/mlcommons/mlcube_examples) are welcome. [Udica](https://github.com/containers/udica) is a new project that promises more fine grained SELinux policy controls for containers that are easy for system administrators to apply. Active development of these projects is ongoing. Testing and providing feedback on them would help make secure data management on systems with SELinux easier and more effective.

## Angel Yocupicio

Thank you very much for create this tool MLCube open source container. It is very interesting. I think that will include on one tutorial tune up for Fedora 36 coming soon.

## Benson Muite

Thanks for your feedback, further tutorials would be great. I am not a developer of MLCube, a new user.

## Michael Rivard

In order for rootless podman containers to access the host’s NVIDIA GPU, I had to run (once, on the host):

. (Search here for

.)

I have never seen this mentioned anywhere else, not even in NVIDIA’s own documentation or user forums.

## Benson Muite

Thanks for this. Finding good desktop defaults is helpful, but SELinux also offers many opportunities for customization which are useful when working with sensitive and/or valuable data for which access needs to be controlled.

## Jonatas Esteves

On the part about setting SELinux labels for the workspace directory, the commands

and

should not need

.

Also, I think this should be reported as an issue to MLCube. It could have done this automatically for you (or as an option) by just passing a

or

flag when mounting the directory.

## Benson Muite

Thanks for your feedback. Passing :Z is one of the suggested options that could be implemented https://github.com/mlcommons/mlcube/issues/205 Suggestions on how this would work best in your workflows would be greatly appreciated.

## sid

Thanks for the info