How I can use podman-compose (podman.socket) instead of docker?

[ThomasGehPunkt]

Hello,

the server we'll have to rollout the toolkit based overleaf intance will have podman.socket instead of docker.

How I can change the composing that it'll uses podman instead of docker?

Thanks for some hint too.

Best.

[storca]

Hello,

I managed to run overleaf on podman in rootless mode.

Installing podman

Podman has to be installed in lieu of docker, meaning that the docker command should redirect to podman. In the case of RHEL, the podman-docker and poddman-compose packages should be installed. Overleaf tookit scripts do not need to be changed.

Podman compatibility

There are two modifications needed in order to spawn the containers, it may break some other things, I haven't tested everything.

Presumably, podman compose does not parse arguments the same way docker compose does. Passing the command with an environment variable inside the .yml does not work with podman.

In lib/docker-compose.mongo.yml, change the command to the following:

        command:
          - mongod
          - --replSet
          - overleaf
          - --bind_ip_all

Same in lib/docker-compose.redis.yml, change the command to the following:

        command:
          - redis-server
          - --appendonly
          - "yes"

Now that the compose files are fixed, you may proceed with the normal instructions.
Now if you want to go rootless, instructions may differ per distro, below is an example with SELinux.

Going rootless on RHEL/Rocky linux 10

Depending on your threat model, the instructions below may not be relevant to your setup, but I think it is the simplest way to deal with SELinux while keeping a better security than with docker in root mode.

• Create a dedicated user to run overleaf useradd overleaf
• Switch to user su -l overleaf (note the -l)
• Clone the toolkit and apply the modifications mentionned above

Since the overleaf data directory will be accessed by containers, add the container_file_t attribute to the directory.

chcon -Rt container_file_t /path/to/overleaf-toolkit/data

From now, you can follow the normal install steps!
Note that you will need to either allow your user to use the port 80 or change the OVERLEAF_PORT in config/overleaf.rc.

Feel free to correct me if i'm wrong !
Best

[Falk358]

Regarding the selinux issue, this fixed it for me without needing to use chcon:

under lib/docker-compose.base.yml change the volume path mapping to include :Z at the end:

  sharelatex:
    restart: always
    image: "${IMAGE}"
    container_name: sharelatex
    volumes:
      - "${OVERLEAF_DATA_PATH}:${OVERLEAF_IN_CONTAINER_DATA_PATH}:Z" # add :Z here
    ports:
      - "${OVERLEAF_LISTEN_IP:-127.0.0.1}:${OVERLEAF_PORT:-80}:80"

do the same for the volume definition in docker-compose.mongo.yml and docker-compose.redis.yml

short explanation:

Two suffixes :z or :Z can be added to the volume mount. These suffixes tell Docker to relabel file objects on the shared volumes. The 'z' option tells Docker that the volume content will be shared between containers. Docker will label the content with a shared content label. Shared volumes labels allow all containers to read/write content. The 'Z' option tells Docker to label the content with a private unshared label. Private volumes can only be used by the current container.

This tells selinux to use the correct context labelling for the folder on your os (which is mounted inside the docker container)