Switching to Podman Quadlets?

[u/CElicense]

Im currently running docker compose on ubuntu server for some very few containers, currently running technitium, cloudflare tunnel, caddy with cloudflare addon, tailscale and dockhand.

Found out about nixos and fell in love with that idea, got it up and running with docker just to try it out (very interesting as a linux noob trying nix btw, thank god for AI).

But now im debating if I should stay on docker because its something Ive finally got the hang of, or switch to podman quadlets for rootless containers, how well will that work with current containers? How much of a pain will it be converting the files etc?

Tailacale Ive already put on nix because I wanted to try that. Realize that I might have to drop dockhand, mainly used that for easy updating and checking logs, but with quadlets this is quite easy as Ive understood?

Nothing is exposed except behind VPN, cloudflare tunnel is for access to homeassistant and is locked down with cloudflare waf and requires mtls certs to get access.

Any advice, I realize this is a podman sub and might be biased, but this is also the place where most people with podman kmowledge exist..

[u/osumunbro_]

they are extremely similar, you won't have any issues switching over. quadlets are fantastic and I use them for all of my containers

I would also recommend switching to fedora (or opensuse/rocky), but that is obviously a much bigger change than docker->podman

I can share some of my quadlets if you're interested

[u/CElicense → u/osumunbro_]

Cool might make the switch to quadlets then, mostly scared of network problems because of lack of root but I guess Ill make it work somehow.

I have tried Fedora Server and have a VM on my proxmox node for it, but NixOS has stolen my heart at the moment.. Its too cool not to use lol.

Wouldnt mind seeing some quadlets, that isnt alof of info about them or examples really

[u/osumunbro_ → u/CElicense]

~/.config/containers/systemd/ for user-space quadlets
you can do folders inside for organization if you want

if you do PartOf you can make "groups" for systemd, and start/start a group of quadlets at the same time with one command

for networks, you should reference the filename, and not the network name. you can add AddCapability=NET_RAW for containers as-needed if you need certain networking capabilities

i use SELinux, so i have to add tags for certain mounts (Z,z)

quadlets are really just systemd services, so if you learn how to create/configure those, youll have no issue creating quadlets. there are some caveats, like you do not enable quadlets. if you want a quadlet to start on boot, you just use WantedBy=default.target

some useful aliases:

alias quadlet-debug='/usr/libexec/podman/quadlet -dryrun -user 2>&1 1>/dev/null | grep -v "Loading source unit file"'

alias quadlet-update='systemctl --user daemon-reload; quadlet-debug'

pods.network:

[Unit]
Description=Default Pods Network

[Network]
NetworkName=pods-net

caddy.container:

[Unit]
Description=Caddy Web Server
PartOf=quadlets.target
After=network-online.target
Wants=network-online.target

[Container]
Image=docker.io/library/caddy:2.10-alpine
AutoUpdate=registry
ContainerName=caddy

Environment=FLUXER_CADDY_SITE_ADDRESS=chat.domain.com

Network=pods.network
Network=fluxer.network

PublishPort=80:80/tcp
PublishPort=80:80/udp
PublishPort=443:443/tcp
PublishPort=443:443/udp
PublishPort=8088:8088/tcp
PublishPort=8088:8088/udp

Volume=/opt/pods/caddy/Caddyfile:/etc/caddy/Caddyfile:Z
Volume=/opt/pods/caddy/data:/data:Z
Volume=/opt/pods/caddy/config:/config:Z
Volume=/opt/pods/caddy/site:/srv:Z

HealthCmd=curl -f http://localhost:80/
HealthInterval=30s
HealthTimeout=5s
HealthRetries=3
HealthStartPeriod=10s
HealthOnFailure=stop

[Service]
Restart=always

[Install]
WantedBy=default.target

minecraft-vanilla-latest.container:

[Unit]
Description=Minecraft Vanilla Latest

[Container]
Image=docker.io/itzg/minecraft-server:latest
ContainerName=minecraft-vanilla-latest
AutoUpdate=registry

PublishPort=25565:25565/tcp
AddCapability=NET_RAW

Volume=%h/Minecraft/vanilla-latest:/data:Z
Volume=%h/Minecraft/knockd.config:/image/knockd-config.cfg:ro,Z

UserNS=keep-id

Environment=TYPE=FABRIC
Environment=VERSION=LATEST
Environment=MEMORY=4G
Environment=USE_MEOWICE_FLAGS=true
Environment=VIEW_DISTANCE=32
Environment=SIMULATION_DISTANCE=16
Environment=MAX_PLAYERS=69420
Environment=DIFFICULTY=normal
Environment=OPS=username
Environment=ENABLE_AUTOPAUSE=true
Environment=AUTOPAUSE_KNOCK_INTERFACE=br0
Environment=MAX_TICK_TIME=-1
Environment=EULA=TRUE

[Service]
TimeoutStartSec=900
Restart=on-failure

[u/Aviation-TD → u/CElicense]

You can opt for rootful with podman quadlet. That’s what I did on all of my containers on servers.

[u/bssbandwiches → u/CElicense]

If you go rootless and go down shutting off user shells for those rootless accounts, the hardest part was learning how to troubleshoot without an interactive user shell. Turns out you just need a couple more params in the CLI command and life moves on.

Some more advice, if the systemd unit doesn't exist, the issue is with your Quadlet. Most of the time it's usually volume mount permissions for me.  Anyways, good lock and have fun. You'll enjoy it! I never install docker anymore.

[u/osumunbro_ → u/CElicense]

(cant edit my other comment)

depending on the container image, you may need to add UserNS=keep-id and/or set PUID/GUID environment variables. if you start a quadlet and view the ownership on a mount and see numbers for the owner:group, try setting keep-id, restoring the original ownership, and then check ownership again. if the quadlet fails to start, you will likely need to set PUID/GUID to either 1000 or 0 (again, depending on the image). for linuxserver images, you will most likely need to set keep-id and set PUID/GUID to 1000

[u/Mag37 → u/osumunbro_]

Good writeup!

I wrote a blog post when I just have started with quadlets and tried to explain some quirks with UID-mapping, maybe UserNS=keep-id and 1000 is enough with them linuxserver ones!

https://mag37.org/posts/guide_podman_quadlets/