I’ve long wanted to Dockerize the main applications and services running on this personal server. The main goal would be to make it easier to upgrade the OS and\/or move servers, which I seem to do every 2 years or so. All I’d have to do is build my containers on the new host and copy over the data volumes. The other concern is improved security: containers would help wall off applications and limit exposure if one of them is compromised.<\/p>\n\n\n\n
While I was at it, I thought I’d try Podman instead. I like the idea of running rootless, for even better security.<\/p>\n\n\n\n
While Podman is pretty painless to use as a drop-in replacement for Docker (you can even install “podman-docker” and “podman-compose” packages so the “docker” command is aliased to “podman”), its default system behaviors are actually very different out of the box. I thought I’d write up a few notes here on what I had to do to get it working well for me. I’m running Ubuntu 26.04.<\/p>\n\n\n\n
Run this:<\/p>\n\n\n\n
By default, rootless containers aren’t allowed to bind to port < 1024 on the host. To run a web server like nginx and allow it to listen on port 80, I had to run these commands:<\/p>\n\n\n\n Out of the box, Podman won’t look for an image named “nginx:latest” on Docker Hub. You need to specifically point to that registry so unqualified names resolve there.<\/p>\n\n\n\n Unlike Docker, when you log out, Podman kills your containers. That’s not useful! Run this.<\/p>\n\n\n\n Even if a container has a restart policy of “always”, Podman won’t automatically restart it after a reboot. You need to enable a restart service that will do this, like so:<\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" I’ve long wanted to Dockerize the main applications and services running on this personal server. The main goal would be to make it easier to upgrade the OS and\/or move servers, which I seem to do every 2 years or so. All I’d have to do is build my containers on the new host and … Continue reading “Migrating to Podman”<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1196","post","type-post","status-publish","format-standard","hentry","category-misc"],"_links":{"self":[{"href":"https:\/\/codefork.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/1196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/codefork.com\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/codefork.com\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/codefork.com\/blog\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/codefork.com\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=1196"}],"version-history":[{"count":1,"href":"https:\/\/codefork.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/1196\/revisions"}],"predecessor-version":[{"id":1197,"href":"https:\/\/codefork.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/1196\/revisions\/1197"}],"wp:attachment":[{"href":"https:\/\/codefork.com\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=1196"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/codefork.com\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=1196"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/codefork.com\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=1196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}systemctl --user enable --now podman.socket<\/code><\/p>\n\n\n\nAllow rootless containers to listen on privileged ports <\/h3>\n\n\n\n
echo 'net.ipv4.ip_unprivileged_port_start=80' | sudo tee \/etc\/sysctl.d\/50-rootless-ports.conf
sudo sysctl --system<\/code><\/p>\n\n\n\nResolve short image names to docker hub<\/h3>\n\n\n\n
mkdir -p ~\/.config\/containers
nano ~\/.config\/containers\/registries.conf
# add this line<\/code><\/p>\n\n\n\nunqualified-search-registries = [\"docker.io\"]<\/code><\/p>\n\n\n\nAllow containers to keep running after you logout<\/h3>\n\n\n\n
loginctl enable-linger $USER<\/code><\/p>\n\n\n\nRestart containers on reboot<\/h3>\n\n\n\n
systemctl --user enable podman-restart.service
systemctl --user start podman-restart.service<\/code><\/p>\n\n\n\n