diff options
| author | TomSweeneyRedHat <tsweeney@redhat.com> | 2019-09-07 18:28:20 -0400 |
|---|---|---|
| committer | TomSweeneyRedHat <tsweeney@redhat.com> | 2019-09-11 17:15:52 -0400 |
| commit | 6c702171da9552f3b5204567792fd56f81048e0a (patch) | |
| tree | 2dce930f1ccc492405c24f11a7981344a380a11a /rootless.md | |
| parent | 79ebb5f254d6f3498500f823cf1b856fed2e6149 (diff) | |
| download | podman-6c702171da9552f3b5204567792fd56f81048e0a.tar.gz podman-6c702171da9552f3b5204567792fd56f81048e0a.tar.bz2 podman-6c702171da9552f3b5204567792fd56f81048e0a.zip | |
Add cgroup v2 info to rootless tutorial
Adding cgroup v2 information to the rootless tutorial. Will post it to a Google Doc
to for easier review comments.
https://docs.google.com/document/d/1hrxU-CYhrKDjMf6cIRuegbyY9pkDv-AlEF-i0I8_kdk
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
Diffstat (limited to 'rootless.md')
| -rw-r--r-- | rootless.md | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/rootless.md b/rootless.md index c5033881b..7d5db3868 100644 --- a/rootless.md +++ b/rootless.md @@ -6,14 +6,14 @@ Contributors are more than welcomed to help with this work. If you decide to ca * Podman can not create containers that bind to ports < 1024. * The kernel does not allow processes without CAP_NET_BIND_SERVICE to bind to low ports. -* Lacking “How To” documentation or documentation in general -* If /etc/subuid and /etc/subgid not setup for a user, then podman commands +* “How To” documentation is in patchy at best. +* If /etc/subuid and /etc/subgid are not setup for a user, then podman commands can easily fail * This can be a big issue on machines using Network Based Password information (FreeIPA, Active Directory, LDAP) * We are working to get support for NSSWITCH on the /etc/subuid and /etc/subgid files. -* No cgroup Support (hopefully fixed when cgroups V2 happens). - * Cgroups V1 does not safely support cgroup delegation. - * Cgroups V2 development for container support is ongoing. +* No cgroup V1 Support + * cgroup V1 does not safely support cgroup delegation. + * cgroup V2 is available on Fedora 29 and later and other Linux distributions. * Can not share container images with CRI-O or other users * Difficult to use additional stores for sharing content * Does not work on NFS or parallel filesystem homedirs (e.g. [GPFS](https://www.ibm.com/support/knowledgecenter/en/SSFKCN/gpfs_welcome.html)) @@ -28,13 +28,13 @@ can easily fail * No CNI Support * CNI wants to modify IPTables, plus other network manipulation that requires CAP_SYS_ADMIN. * There is potential we could probably do some sort of blacklisting of the relevant plugins, and add a new plugin for rootless networking - slirp4netns as one example and there may be others -* Cannot use ping +* Cannot use ping out of the box. * [(Can be fixed by setting sysctl on host)](https://github.com/containers/libpod/blob/master/troubleshooting.md#5-rootless-containers-cannot-ping-hosts) -* Requires new shadow-utils (not found in older (RHEL7/Centos7 distros) Should be fixed in RHEL7.7 release +* Requires new shadow-utils (not found in older (RHEL7/Centos7 distros) Should be fixed in RHEL7.7 release) * A few commands do not work. * mount/unmount (on fuse-overlay) * Only works if you enter the mount namespace with a tool like buildah unshare - * podman stats (Lack of Cgroup support) + * podman stats (Without cgroup V2 support) * Checkpoint and Restore (CRIU requires root) * Pause and Unpause (no freezer cgroup) * Issues with higher UIDs can cause builds to fail |