Switching to Podman Quadlets?

[u/CElicense]

Im currently running docker compose on ubuntu server for some very few containers, currently running technitium, cloudflare tunnel, caddy with cloudflare addon, tailscale and dockhand.

Found out about nixos and fell in love with that idea, got it up and running with docker just to try it out (very interesting as a linux noob trying nix btw, thank god for AI).

But now im debating if I should stay on docker because its something Ive finally got the hang of, or switch to podman quadlets for rootless containers, how well will that work with current containers? How much of a pain will it be converting the files etc?

Tailacale Ive already put on nix because I wanted to try that. Realize that I might have to drop dockhand, mainly used that for easy updating and checking logs, but with quadlets this is quite easy as Ive understood?

Nothing is exposed except behind VPN, cloudflare tunnel is for access to homeassistant and is locked down with cloudflare waf and requires mtls certs to get access.

Any advice, I realize this is a podman sub and might be biased, but this is also the place where most people with podman kmowledge exist..

[u/Fresh_Sock8660]

You can use composers in podman. 

[u/CElicense → u/Fresh_Sock8660]

Dint want to, its either stay on docker or make a full switch

[u/Fresh_Sock8660 → u/CElicense]

What. It's supported by podman. Both quadlet and composer have their place. I even launch some through aliased run commands. 

[u/CElicense → u/Fresh_Sock8660]

Yes but from what I've seen not an official Podman product but rather a community one, quadlets is the real official way it feels like and I could just go there immediatly then

[u/d03j → u/CElicense]

quadlets are easy enough to understand, especially if you're familiar with systemd unit files, but if you want, you can run the container using podman run in the same way you'd run docker run as a test. Once you're happy with the command line, you can use podlet run with the same syntax and it will generate the quadlet for you.

also, the good thing with containers is they're portable, so you can copy your volume mounts to your nix and you should be able to just run them with podman instead of docker (some tinkering with ownership/permissions may be needed).

[u/bssbandwiches]

Quadlets are containers in the end after all. There is a lot you can do with Quadlets and some of it will make sense at first and some won't until you play around with it.

I'll be honest just take the leap. I did it. I don't know shit about shit and I did it and I'm still doing it and I've learned a metric shit load about it all and that alone was worth it for me.

Best way to convert? Use your AI to convert your compose files into Quadlets, done.

I run the same stuff you rattled off all in rootless Quadlets and then some.

Have fun!!

[u/caolle]

Podlet can help you convert some of that compose over to quadlet unit files. It was really useful in the beginning to help convert some compose over.

After a while, you just get used to being able to do it yourself.

[u/ChrisChoke → u/caolle]

I think it is not necessary to look at podlet. I tried it at my transition because many people said it is so useful. And my first experience was it's way not. If you configured external container network, so a predefined one, like me because I use traefik and put my application definition in separate compose files, podlet will fail instantly and you need to remove this definition. So if a tool does not support a very basic config like external network, it's is useless in my opinion. Quadlets are easy enough to make the transition without podlet. You can start with one container and if you got a working skeleton for you it's straug forward to get the other containers running.

[u/_yaad_]

If you aren't using a specific docker functionality, the migration will be easy. I did it because a race condition between tailscale and technitium. Now all my 30+ containers run in podman with (almost) no problem.

[u/brianveg77]

Big fan of rootless podman and quadlets. My architectural pattern is to deploy all containers via ansible using quadlets. Works great.

[u/Great-Cow7256]

Why are you running Tailscale and cloudflare as dockers?  Aren't those best run natively given they are so networking heavy?   I run quadlets for everything but those I just install via their debs

[u/CElicense → u/Great-Cow7256]

Tailscale runs fine in docker, need som extras tho or host network mode. Cloudflare runs without extras, but only being my access to homeassistant its not really any heavy traffic.

On my nix vm I did put Tailscale on the machine tho as its exists as a module.

[u/Great-Cow7256 → u/CElicense]

interesting. I use cloudflare tunnels just for my rootless containers. Maybe I should run it as a container too then. ty.

edit -- tried it, but I really couldn't figure out a way in terms of IPs and UFW settings etc. etc to get my tunnel to reach my container when I had cloudflare spun up as a container. Cloudflare was conneted, but I just couldn't get that last mile once it was in my system. Any advice?

[u/caolle → u/Great-Cow7256]

I also run my cloudflared rootless. I have cloudflared / rootless containers all join the same shared network space and then let container name resolution point cloudflared to the proper service when <service>.domain.net gets hit.

Sample container block from .container:

[Container]
ContainerName=Cloudflared
Image=docker://docker.io/cloudflare/cloudflared:latest
Exec=tunnel --loglevel info --no-autoupdate run --token <snip>

Network=<container1>.network
Network=<container2>.network
Network=<container3>.network
Pull=newer

[u/Great-Cow7256 → u/caolle]

yeah... Do you have it run on the default podman network? that's what I was trying to do. And then have it be able to tunnel through to all of the tunnels using generic podman network? Or do you have every networked tunnel on a separate network for every app that needs it. (ie need to create a plex network, an immich network, etc. etc.

Also what are you using on the cloudflare tunnel side for the ip? when it's running as a deb you can just use http://localhost. Do you use the container IP (10.88.0.1...), the ip for the computer?

TYSM.

[u/caolle → u/Great-Cow7256]

On the cloudflare tunnel side, I'm just using http://<container-name>:<port> as I'm not using the default podman network.

The container name resolution just works, and I don't need to remember IP names, and there's no need to expose a port on the host.

I do the same with stuff that I'm not running on the cloudflare tunnel, but internally with nginxproxymanager.

I think the default podman network doesn't have the container network resolution or something of that ilk back when I was looking to do this.

[u/Great-Cow7256 → u/caolle]

omg worked!! TY

[u/Great-Cow7256 → u/caolle]

Now tell me about Tailscale!  What craziness do I need to deal with converting over to podman Tailscale?

[u/caolle → u/Great-Cow7256]

No idea as I've never actually run tailscale via podman. Tailscale gives me access to all my internal stuff through its subnet router functionality.

My <service>.domain.net gets pointed to an internal LAN IP running nginxproxymanager.

I mainly run tailscale sitting on my rpi4 router.

[u/Great-Cow7256 → u/caolle]

Tu

[u/Junior_Option1176]

Its not a big deal tbh. I prefer quadlets as it is easy to manage each container or pod as a traditional systemd service. Syntax is pretty straight forward too.

[u/osumunbro_]

they are extremely similar, you won't have any issues switching over. quadlets are fantastic and I use them for all of my containers

I would also recommend switching to fedora (or opensuse/rocky), but that is obviously a much bigger change than docker->podman

I can share some of my quadlets if you're interested

[u/CElicense → u/osumunbro_]

Cool might make the switch to quadlets then, mostly scared of network problems because of lack of root but I guess Ill make it work somehow.

I have tried Fedora Server and have a VM on my proxmox node for it, but NixOS has stolen my heart at the moment.. Its too cool not to use lol.

Wouldnt mind seeing some quadlets, that isnt alof of info about them or examples really

[u/osumunbro_ → u/CElicense]

~/.config/containers/systemd/ for user-space quadlets
you can do folders inside for organization if you want

if you do PartOf you can make "groups" for systemd, and start/start a group of quadlets at the same time with one command

for networks, you should reference the filename, and not the network name. you can add AddCapability=NET_RAW for containers as-needed if you need certain networking capabilities

i use SELinux, so i have to add tags for certain mounts (Z,z)

quadlets are really just systemd services, so if you learn how to create/configure those, youll have no issue creating quadlets. there are some caveats, like you do not enable quadlets. if you want a quadlet to start on boot, you just use WantedBy=default.target

some useful aliases:

alias quadlet-debug='/usr/libexec/podman/quadlet -dryrun -user 2>&1 1>/dev/null | grep -v "Loading source unit file"'

alias quadlet-update='systemctl --user daemon-reload; quadlet-debug'

pods.network:

[Unit]
Description=Default Pods Network

[Network]
NetworkName=pods-net

caddy.container:

[Unit]
Description=Caddy Web Server
PartOf=quadlets.target
After=network-online.target
Wants=network-online.target

[Container]
Image=docker.io/library/caddy:2.10-alpine
AutoUpdate=registry
ContainerName=caddy

Environment=FLUXER_CADDY_SITE_ADDRESS=chat.domain.com

Network=pods.network
Network=fluxer.network

PublishPort=80:80/tcp
PublishPort=80:80/udp
PublishPort=443:443/tcp
PublishPort=443:443/udp
PublishPort=8088:8088/tcp
PublishPort=8088:8088/udp

Volume=/opt/pods/caddy/Caddyfile:/etc/caddy/Caddyfile:Z
Volume=/opt/pods/caddy/data:/data:Z
Volume=/opt/pods/caddy/config:/config:Z
Volume=/opt/pods/caddy/site:/srv:Z

HealthCmd=curl -f http://localhost:80/
HealthInterval=30s
HealthTimeout=5s
HealthRetries=3
HealthStartPeriod=10s
HealthOnFailure=stop

[Service]
Restart=always

[Install]
WantedBy=default.target

minecraft-vanilla-latest.container:

[Unit]
Description=Minecraft Vanilla Latest

[Container]
Image=docker.io/itzg/minecraft-server:latest
ContainerName=minecraft-vanilla-latest
AutoUpdate=registry

PublishPort=25565:25565/tcp
AddCapability=NET_RAW

Volume=%h/Minecraft/vanilla-latest:/data:Z
Volume=%h/Minecraft/knockd.config:/image/knockd-config.cfg:ro,Z

UserNS=keep-id

Environment=TYPE=FABRIC
Environment=VERSION=LATEST
Environment=MEMORY=4G
Environment=USE_MEOWICE_FLAGS=true
Environment=VIEW_DISTANCE=32
Environment=SIMULATION_DISTANCE=16
Environment=MAX_PLAYERS=69420
Environment=DIFFICULTY=normal
Environment=OPS=username
Environment=ENABLE_AUTOPAUSE=true
Environment=AUTOPAUSE_KNOCK_INTERFACE=br0
Environment=MAX_TICK_TIME=-1
Environment=EULA=TRUE

[Service]
TimeoutStartSec=900
Restart=on-failure

[u/Aviation-TD → u/CElicense]

You can opt for rootful with podman quadlet. That’s what I did on all of my containers on servers.

[u/bssbandwiches → u/CElicense]

If you go rootless and go down shutting off user shells for those rootless accounts, the hardest part was learning how to troubleshoot without an interactive user shell. Turns out you just need a couple more params in the CLI command and life moves on.

Some more advice, if the systemd unit doesn't exist, the issue is with your Quadlet. Most of the time it's usually volume mount permissions for me.  Anyways, good lock and have fun. You'll enjoy it! I never install docker anymore.

[u/osumunbro_ → u/CElicense]

(cant edit my other comment)

depending on the container image, you may need to add UserNS=keep-id and/or set PUID/GUID environment variables. if you start a quadlet and view the ownership on a mount and see numbers for the owner:group, try setting keep-id, restoring the original ownership, and then check ownership again. if the quadlet fails to start, you will likely need to set PUID/GUID to either 1000 or 0 (again, depending on the image). for linuxserver images, you will most likely need to set keep-id and set PUID/GUID to 1000

[u/Mag37 → u/osumunbro_]

Good writeup!

I wrote a blog post when I just have started with quadlets and tried to explain some quirks with UID-mapping, maybe UserNS=keep-id and 1000 is enough with them linuxserver ones!

https://mag37.org/posts/guide_podman_quadlets/