diff options
Diffstat (limited to 'docs/tutorials')
| -rw-r--r-- | docs/tutorials/rootless_tutorial.md | 47 |
1 files changed, 44 insertions, 3 deletions
diff --git a/docs/tutorials/rootless_tutorial.md b/docs/tutorials/rootless_tutorial.md index 821c07647..b53b67647 100644 --- a/docs/tutorials/rootless_tutorial.md +++ b/docs/tutorials/rootless_tutorial.md @@ -58,7 +58,7 @@ The number of user namespaces that are allowed on the system is specified in the ### /etc/subuid and /etc/subgid configuration -Rootless Podman requires the user running it to have a range of UIDs listed in /etc/subuid and /etc/subgid files. The `shadows-utils` or `newuid` package provides these files on different distributions and they must be installed on the system. These files will need someone with root privileges on the system to add or update the entries within them. The following is a summarization from the [How does rootless Podman work?](https://opensource.com/article/19/2/how-does-rootless-podman-work) article by Dan Walsh on [opensource.com](https://opensource.com) +Rootless Podman requires the user running it to have a range of UIDs listed in /etc/subuid and /etc/subgid files. The `shadow-utils` or `newuid` package provides these files on different distributions and they must be installed on the system. These files will need someone with root privileges on the system to add or update the entries within them. The following is a summarization from the [How does rootless Podman work?](https://opensource.com/article/19/2/how-does-rootless-podman-work) article by Dan Walsh on [opensource.com](https://opensource.com) Update the /etc/subuid and /etc/subgid with fields for each user that will be allowed to create containers that look like the following. Note that the values for each user must be unique and without any overlap. If there is an overlap, there is a potential for a user to use another’s namespace and they could corrupt it. @@ -106,9 +106,50 @@ Once the Administrator has completed the setup on the machine and then the confi ### User Configuration Files -The Podman configuration files for root reside in `/usr/share/containers` with overrides in `/etc/containers`. In the rootless environment they reside in `${XDG_CONFIG_HOME}/containers` (usually `~/.config/containers`) and are owned by each individual user. The main files are `containers.conf` and `storage.conf` and the user can modify these files as they wish. +The Podman configuration files for root reside in `/usr/share/containers` with overrides in `/etc/containers`. In the rootless environment they reside in `${XDG_CONFIG_HOME}/containers` (usually `~/.config/containers`) and are owned by each individual user. -The default authorization file used by the `podman login` and `podman logout` commands reside in `${XDG_RUNTIME_DIR}/containers/auth.json`. +The three main configuration files are [containers.conf](https://github.com/containers/common/blob/master/docs/containers.conf.5.md), [storage.conf](https://github.com/containers/storage/blob/master/docs/containers-storage.conf.5.md) and [registries.conf](https://github.com/containers/image/blob/master/docs/containers-registries.conf.5.md). The user can modify these files as they wish. + +#### containers.conf +Podman reads +1. `/usr/share/containers/containers.conf` +2. `/etc/containers/containers.conf` +3. `$HOME/.config/containers/containers.conf` + +if they exist in that order. Each file can override the previous for particular fields. + +#### storage.conf +For `storage.conf` the order is +1. `/etc/containers/storage.conf` +2. `$HOME/.config/containers/storage.conf` + +In rootless podman certain fields in `/etc/containers/storage.conf` are ignored. These fields are: +``` +graphroot="" + container storage graph dir (default: "/var/lib/containers/storage") + Default directory to store all writable content created by container storage programs. + +runroot="" + container storage run dir (default: "/var/run/containers/storage") + Default directory to store all temporary writable content created by container storage programs. +``` +In rootless podman these fields default to +``` +graphroot="$HOME/.local/share/containers/storage" +runroot="$XDG_RUNTIME_DIR/containers" +``` +[$XDG_RUNTIME_DIR](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html#variables) defaults on most systems to `/run/user/$UID`. + +#### registries +Registry configuration is read in by this order +1. `/etc/containers/registries.conf` +2. `/etc/containers/registries.d/*` +3. `HOME/.config/containers/registries.conf` + +The files in the home directory should be used to configure rootless podman for personal needs. These files are not created by default. Users can copy the files from `/usr/share/containers` or `/etc/containers` and modify them. + +#### Authorization files + The default authorization file used by the `podman login` and `podman logout` commands reside in `${XDG_RUNTIME_DIR}/containers/auth.json`. ### Using volumes |