Viewing profile — eriksjolund

Sometimes it's possible to not use the Podman API at all. Convert the compose file to quadlet files with the command-line tool podlet and start the container with "systemctl --user…

That workaround is not needed if the web server container supports socket activation. Due to the fork-exec architecture of Podman, the socket-activated socket is inherited by the c…

The license would no longer be open source if you limit use to only community. See "6. No Discrimination Against Fields of Endeavor" in The Open Source Definition https://opensourc…

I did it out of pure interest, just to explore ways of locking down a web server.

You can use the podman option `--network=none` together with the systemd directive `RestrictAddressFamilies=` I wrote a demo: https://www.redhat.com/en/blog/podman-systemd-limit-ac…

Podman quadlet supports "Socket activation of containers" https://github.com/containers/podman/blob/main/docs/tutorial... This allows you to run a network server with `Network=none…

Socket activation can be used with quadlets but not with docker-compose. That is a big advantage. https://github.com/containers/podman/blob/main/docs/tutorial...

If you want to know why bootc is needed check this list of goals: https://containers.github.io/bootable/ I found that URL by following the link in "bootc is the key component in a …

Another tool that can be used by an unprivileged user for analysing network traffic is rootless Podman with Pasta. Just add the podman run option --network=pasta:--pcap,myfile.pcap…

How to display circles on top of zoomable images without getting flickering is an interesting problem. (This comment does not refer specifically to displaying a tree map) I noticed…

Here are some documentation and demos from me and others if you're interested: https://github.com/eriksjolund/podman-networking-docs https://github.com/eriksjolund/podman-nginx-soc…

Rootless Podman uses slirp4netns by default. The default will soon change to pasta. Pasta has better performance than slirp4netns. For best performance if your container supports i…

Podman can run a socket-activated network server (such as docker.io/library/nginx) with the "--network=none" option. This improves security.

It seems Red Hat believes in Loki Red Hat logging product manager says: "We made the decision to move to Loki and Vector" https://www.youtube.com/watch?v=QZ4Hv85lEJ0&t=938s

I just tried this out. The new systemd directive OpenFile= opens up the possibility to pass the file descriptor of a file from the host to a container running in a container. (usin…

I wrote a mini tutorial (as a Reddit comment) about how to deal with UID/GID mappings when you run rootless podman and you want a specific container user to write to a bind-mounted…

Podman has a feature that Docker does not yet have: Socket activation of containers. I created a proof-of-concept demo of how to run an nginx container with rootless Podman and soc…

Ok, I understand your concern about Slirp. Regarding the other idea: I've now tested it and verified that it works. The remote address is available when running a socket-activated …

The remote address is available when running a socket-activated container with rootless Podman. I verified it in a test.

Not exactly what you are asking for but there is a Systemd feature request to add Connect= setting to service unit files. https://github.com/systemd/systemd/issues/23067#issuecomme…

You could detect the source IP address by using the command-line option: --net=slirp4netns:port_handler=slirp4netns See https://github.com/containers/podman/discussions/10472#discu…

I haven't tried it out, but shouldn't you be able to detect the true remote address by using a socket that has been passed in via socket activation?

I like this Podman feature: Socket activation of containers Advantages: - Faster network. Rootless Podman will run with native network speed. Normally rootless Podman runs with red…