使用 Podman 以非 root 用户身份运行 Linux 容器
Docker 容器
![](/data/attachment/album/201810/26/082845qyjxxcmccjjm6cn0.jpg)


Linux 容器是由 Linux 内核所提供的具有特定隔离功能的进程 —— 包括文件系统、进程和网络的隔离。容器有助于实现可移植性 —— 应用可以在容器镜像中与其依赖项一起分发，并可在几乎任何有容器运行时环境的 Linux 系统上运行。


虽然容器技术存在了很长时间，但 Linux 容器是由 Docker 而得到了广泛推广。 “Docker” 这个词可以指几个不同的东西，包括容器技术和工具，周围的社区，或者 Docker Inc. 公司。但是，在本文中，我将用来指管理 Linux 容器的技术和工具。


### 什么是 Docker


[Docker](https://docs.docker.com/) 是一个以 root 身份在你的系统上运行的守护程序，它利用 Linux 内核的功能来管理正在运行的容器。除了运行容器之外，它还可以轻松管理容器镜像 —— 与容器注册库交互、存储映像、管理容器版本等。它基本上支持运行单个容器所需的所有操作。


但即使 Docker 是管理 Linux 容器的一个非常方便的工具，它也有两个缺点：它是一个需要在你的系统上运行的守护进程，并且需要以 root 权限运行，这可能有一定的安全隐患。然而，Podman 在解决这两个问题。


### Podman 介绍


[Podman](https://podman.io/) 是一个容器运行时环境，提供与 Docker 非常相似的功能。正如已经提示的那样，它不需要在你的系统上运行任何守护进程，并且它也可以在没有 root 权限的情况下运行。让我们看看使用 Podman 运行 Linux 容器的一些示例。


#### 使用 Podman 运行容器


其中一个最简单的例子可能是运行 Fedora 容器，在命令行中打印 “Hello world!”：



```
$ podman run --rm -it fedora:28 echo "Hello world!"
```

使用通用 Dockerfile 构建镜像的方式与 Docker 相同：



```
$ cat Dockerfile
FROM fedora:28
RUN dnf -y install cowsay

$ podman build . -t hello-world
... output omitted ...

$ podman run --rm -it hello-world cowsay "Hello!"
```

为了构建容器，Podman 在后台调用另一个名为 Buildah 的工具。你可以阅读最近一篇[关于使用 Buildah 构建容器镜像的文章](https://fedoramagazine.org/daemon-less-container-management-buildah/) —— 它不仅仅是使用典型的 Dockerfile。


除了构建和运行容器外，Podman 还可以与容器托管进行交互。要登录容器注册库，例如广泛使用的 Docker Hub，请运行：



```
$ podman login docker.io
```

为了推送我刚刚构建的镜像，我只需打上标记来代表特定的容器注册库，然后直接推送它。



```
$ podman -t hello-world docker.io/asamalik/hello-world
$ podman push docker.io/asamalik/hello-world
```

顺便说一下，你是否注意到我如何以非 root 用户身份运行所有内容？此外，我的系统上没有运行又大又重的守护进程！


#### 安装 Podman


Podman 默认在 [Silverblue](https://silverblue.fedoraproject.org/) 上提供 —— 一个基于容器的工作流的新一代 Linux 工作站。要在任何 Fedora 版本上安装它，只需运行：



```
$ sudo dnf install podman
```



---


via: <https://fedoramagazine.org/running-containers-with-podman/>


作者：[Adam Šamalík](https://fedoramagazine.org/author/asamalik/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
Linux containers are processes with certain isolation features provided by a Linux kernel — including filesystem, process, and network isolation. Containers help with portability — applications can be distributed in container images along with their dependencies, and run on virtually any Linux system with a container runtime.


Although container technologies exist for a very long time, Linux containers were widely popularized by Docker. The word “Docker” can refer to several different things, including the container technology and tooling, the community around that, or the Docker Inc. company. However, in this article, I’ll be using it to refer to the technology and the tooling that manages Linux containers.

## What is Docker

[Docker](https://docs.docker.com/) is a daemon that runs on your system as root, and manages running containers by leveraging features of the Linux kernel. Apart from running containers, it also makes it easy to manage container images — interacting with container registries, storing images, managing container versions, etc. It basically supports all the operations you need to run individual containers.

But even though Docker is very a handy tool for managing Linux containers, it has two drawbacks: it is a daemon that needs to run on your system, and it needs to run with root privileges which might have certain security implications. Both of those, however, are being addressed by Podman.

## Introducing Podman

[Podman](https://podman.io/) is a container runtime providing a very similar features as Docker. And as already hinted, it doesn’t require any daemon to run on your system, and it can also run without root privileges. So let’s have a look at some examples of using Podman to run Linux containers.

### Running containers with Podman

One of the simplest examples could be running a Fedora container, printing “Hello world!” in the command line:

$podman run --rm -it fedora:28 echo "Hello world!"

Building an image using the common Dockerfile works the same way as it does with Docker:

$cat DockerfileFROM fedora:28 RUN dnf -y install cowsay $podman build . -t hello-world... output omitted ... $podman run --rm -it hello-world cowsay "Hello!"

To build containers, Podman calls another tool called Buildah in the background. You can read a recent [post about building container images with Buildah](https://fedoramagazine.org/daemon-less-container-management-buildah/) — not just using the typical Dockerfile.

Apart from building and running containers, Podman can also interact with container registries. To log in to a container registry, for example the widely used Docker Hub, run:

$podman login docker.io

To push the image I just built, I just need to tag so it refers to the specific container registry and my personal namespace, and then simply push it.

$podman -t hello-world docker.io/asamalik/hello-world$podman push docker.io/asamalik/hello-world

By the way, have you noticed how I run everything as a non-root user? Also, there is no big fat daemon running on my system!

### Installing Podman

Podman is available by default on [Silverblue](https://silverblue.fedoraproject.org/) — a new generation of Linux Workstation for container-based workflows. To install it on any Fedora release, simply run:

$ sudo dnf install podman

## Dragnucs

Thank you for the explanation.

Can podman be used with tools like Docker-compose or similar?

## Dragnucs

After some research it turns out that Compose and Swarm are not supported, but Kubernetes is.

## Blaise Pabon

Hi @dragnucs, I have found that the atomic host commands are comparable to

and

, whereas podman is more comparable to openshift and kubectl.

## Steven Miano

It feels like something is broken with this example:

$ podman run –rm -it hello-world cowsay “Hello!”

As it pulls down an image from docker.io/library/hello-world

But that image isn’t in the right state. Whereas if you do a podman images and find the ‘IMAGE ID’ of the image just created:

$ podman run ${NEW_IMAGE_ID} cowsay “hello!”

Will work…not sure if this might be a bit more clear for folks not used to what’s going on or not….

…..great introduction to how podman works/functions though! Thanks much!

## Sascha

Looks like “-t ” needs to be specified before the directory reference:

podman build -t hello-world:latest .

instead of

podman build -t . hello-world:latest

Kind regards,

Sascha

## Blaise Pabon

Yes,

expects the name of the tag to follow it. It’s like saying

## Thomas

why does this work now? when did it start to work? can you give some pointers?

and “non-root” ? 😉

root

## Drakkai

Root is inside container, the container itself is run as a non-root user.

## Thomas

what are the limitations of non-root containers?

how can i access my $HOME content? i suspect is some uid/gid mapping is happening because adding a user with same uid in the container isnt enough to access my

mounted volume in the container.

## Drakkai

You can try to map user/group with –uidmap and –gidmap.

## Joe

This looks neat. I’m looking forward to port forwarding support.

## eee

when translate to Polish?

documentation and examples

## Bradley D. Thornton

Podman works great as a containerization method for those working with shared webhosting infrastructure; for example, with cPanel or Plesk accounts where the user does not have root access, and needs to run a few containers.

## Mahesh Hegde

Does it require

feature to run?