Lab 17.1: Run a rootless web container as a systemd service

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Doel

As the normal user student, run a web server in a container, keep its content on the host, build your own image, and make the container start at boot as a user service — without any root rights for the container.

Voordat je begint

server1 with RHEL 10 and internet access to registry.access.redhat.com.
The user student (with sudo only for package install, firewall and linger).
sudo dnf install -y container-tools.

Taken

As student, pull registry.access.redhat.com/ubi10/httpd-24 and find out which ports it exposes.
Make the folder ~/site with an index.html that says rootless works. Run a container named site from the image, publish host port 8080 to the container's web port, and mount ~/site as the document root /var/www/html.
Show the logs of the container, and run cat /etc/os-release inside it.
Write a Containerfile in ~/build that starts from the same image and copies a file index.html (text built image) into /var/www/html/. Build it as localhost/built:1.0 and run it once on port 8081 to test it, then remove that test container.
Remove the container site. Make a Quadlet file so that site (same image, port and folder as in task 2) runs as a user service called site.service, restarts when it stops, and starts at boot.
Make sure the service of student starts at boot without a login, open port 8080/tcp in the firewall, and reboot. Check from server2 or your laptop.

Controleer je werk

$podman image inspect registry.access.redhat.com/ubi10/httpd-24 --format '{{.Config.ExposedPorts}}'
$systemctl --user is-active site.service
$podman ps --format '{{.Names}} {{.Ports}}'
$curl -s http://localhost:8080/
$loginctl show-user student -p Linger
$podman images localhost/built

systemctl --user is-active site.service prints active after a reboot, before you log in to a desktop.
curl prints rootless works.
Linger=yes.

Hints

Toon de hints

Rootless containers can not publish host ports below 1024; that is why the task uses 8080.
:Z at the end of -v (or Volume=) gives the folder the SELinux label for the container.
Quadlet files for users go in ~/.config/containers/systemd/NAME.container. Then systemctl --user daemon-reload.
Generated Quadlet units can not be enabled. WantedBy=default.target in [Install] makes them start at boot.

Oplossing

Toon de oplossing

Pull and inspect.

$podman pull registry.access.redhat.com/ubi10/httpd-24
$podman image inspect registry.access.redhat.com/ubi10/httpd-24 --format '{{.Config.ExposedPorts}}'
map[8080/tcp:{} 8443/tcp:{}]

Content and container.

$mkdir -p ~/site
$echo "rootless works" > ~/site/index.html
$podman run -d --name site -p 8080:8080 -v ~/site:/var/www/html:Z registry.access.redhat.com/ubi10/httpd-24
$curl -s http://localhost:8080/

Logs and a command inside.

$podman logs site
$podman exec site cat /etc/os-release

Build your own image.

$mkdir -p ~/build && cd ~/build
$echo "built image" > index.html
$printf 'FROM registry.access.redhat.com/ubi10/httpd-24\nCOPY index.html /var/www/html/index.html\n' > Containerfile
$podman build -t localhost/built:1.0 .
$podman run -d --name test -p 8081:8080 localhost/built:1.0
$curl -s http://localhost:8081/
$podman rm -f test

The Quadlet file.

$podman rm -f site
$mkdir -p ~/.config/containers/systemd
$vim ~/.config/containers/systemd/site.container
$cat ~/.config/containers/systemd/site.container
[Unit]
Description=Rootless site
 
[Container]
Image=registry.access.redhat.com/ubi10/httpd-24
ContainerName=site
PublishPort=8080:8080
Volume=%h/site:/var/www/html:Z
 
[Service]
Restart=always
 
[Install]
WantedBy=default.target
$systemctl --user daemon-reload
$systemctl --user start site.service
$systemctl --user status site.service

Linger, firewall, reboot.

$sudo loginctl enable-linger student
$sudo firewall-cmd --add-port=8080/tcp --permanent
$sudo firewall-cmd --reload
$sudo systemctl reboot

Mijn notities

Nog geen notities.

Run a rootless web container as a systemd service