Enable varlink socket

[volfco]

Podman exposes a varlink socket that can be enabled as a service.

https://podman.io/blogs/2019/01/16/podman-varlink.html

I'm thinking it could be it's own class, invoked like this:

podman::varlink:
    enabled: true
    socket: /run/podman/io.podman

Also- thanks for this module

[southalc]

Thanks for the feedback. I'll admit that I'm unfamiliar with the varlink interface, so I did some reading. It's unclear to me whether the varlink socket supports rootless containers. If so, does it require each user to run a separate instance/socket? The documentation I can find is unclear. I can do some testing to verify the behavior if I'm unable to get more clarity.

Managing podman objects from varlink seems to conflict with the premise of management from Puppet, although a valid use case might be to simply use Puppet to setup podman packages and the varlink service for other management tools. Is that what you had in mind, or are there something else I'm missing?

Also FYI, I found a thread that indicates the varlink interface will be replaced in the future.
containers/python-podman#16 (comment)

[volfco]

I think it supports rootless containers. I'm not 100% sure, as I don't understand the magic behind systemd's socket ... management? I would assume so.

The main goal here is that i'm using this module to configure podman for Nomad, which will then do the spawning of containers. I'm using both. Puppet managed containers using your module, and then nomad doing it's own thing. I don't see it being a conflict. With puppet modules I assume that anything the program is reasonably expected to do can be managed via puppet.

I need to make another issue for management of docker config file (~/.docker/config.json) so I can manage repository configuration

[optiz0r]

FWIW, I got nomad+podman v1 working with varlink, however I don't think it supports rootless containers in podman v1. The additional config in my own site_podman wrapper class which includes the podman class from this module for varlink was:

        group {
            'podman':
                ensure  => present,
                system  => true,
                members => $users;
        }

        package {
            'libvarlink-util':
                ensure => installed;
        }

        systemd::tmpfile {
            'podman.conf':
                content => 'd /run/podman 0750 root podman',
                require => [
                    Package['libvarlink-util'],
                    Group['podman'],
                ];
        }

        systemd::dropin_file {
            'nomad.conf':
                ensure  => present,
                unit    => 'io.podman.socket',
                content => epp('site_podman/podman-socket-nomad.conf.epp'),
                require => Group['podman'],
                before  => Service['io.podman.socket'];
        }

        service {
            'io.podman.socket':
                ensure  => running,
                enable  => true,
                require => Class['systemd::tmpfiles'];
        }

Where the template file modules/site_podman/templates/podman-socket-nomad.conf.epp' contains:

[Socket]
ListenStream=/run/podman/io.podman
SocketMode=0660
SocketGroup=podman

However this interface is deprecated in podman v2 and replaced with a rest api via the podman.socket system service. Support for podman v2's rest api landed in the master branch of nomad-driver-podman a week or so ago, and can be used to start containers from nomad, but also not in rootless mode. (For rootless mode, I think the driver will need to setup a user namespace, which it currently does not do; the relevant code for this is commented out in the driver). I did also get nomad+podman v2 (from kubic repositories) to start up a container after jumping through some additional hoops:

• Reconfiguring the system to using cgroup v2
• Building my own copy of crun (not provided by OS), and stealing the build-time dependencies from elsewhere
• Configuring podman to use cgroupfs rather than systemd to manage the cgroup hierarchy for the container, since my version of systemd is too old
• Enabling the podman.socket system service provided by the podman v2 package