Run via rootless podman or singularity/apptainer?

[yarikoptic]

We should check with @asmacdo if that would be possible to avoid possible "kill all by using docker" scenario ;)

[asmacdo]

Without fully understanding the use case I think the answer is yes.

With podman, we have 4 options.

• run podman as root, run container as root
• run podman as root, run container as non-root (specify -u someuser)
• run podman as non-root, run the container as root (ex. UID 0 inside the container maps to UID 1000 outside)
• run podman as non-root, run the container as non-root. safety first!

[yarikoptic]

FWIW we have podman installed on smaug now.
In development mode we need to start db and broker from https://github.com/datalad/datalad-registry/blob/master/docker-compose.yml .
https://github.com/datalad/datalad-registry/blob/master/up is the script used for that purpose.

Can you @asmacdo work with @candleindark and research into possibility of the "non-root" execution of those instances? I think it should be feasible since really there is no need for "outside root" - ports they use are not privileged so for that root also would not be needed.

[candleindark]

@yarikoptic Podman on Smaug is currently @ 3.0.1. Can we have it updated to the current version 4.4.1?

[yarikoptic]

I've tried to backport 4.3.1 (present in debian unstable) but "no good".

Why would we need 4.4.1? is there a way for user-space installation (attn @asmacdo)?

[asmacdo]

Seems like it's possible but probably not worth the effort.

containers/podman#3100

[candleindark]

I've tried to backport 4.3.1 (present in debian unstable) but "no good".

Why would we need 4.4.1? is there a way for user-space installation (attn @asmacdo)?

All the documentation I have been reading is at version 4+. I was just wondering if we can upgrade to version 4+ just for consistency. It actually don't have to be 4.4.1 in particular.

[candleindark]

Datalad-registry has been run by Podman for more than 7 days. I think we should close this issue.

[yarikoptic]

feel welcome to close issues you consider addressed. Where possible/relevant -- reference a commit or PR which closed it. In this case I guess it might benefit from a quick section in README.md on podman and settings to use to avoid containers being killed.

[candleindark]

Note:
Before closing this issue, provide a section on README.md for running registry on Podman. This section should provide the solution to avoid Podman containers being killed by systemd.

[yarikoptic]

could we consider #102 as a replacement for this one? ;)

[candleindark]

Sure, let's close this one.