Are system units for rootless podman containers supported for RHEL 8?

Latest response

So far we can create systemd user untis for containers for users with a login and linger enabled. However we want to have this working predictably for users with out logins using system units and User=... to run our containers.

While this appears to be stable on openSUSE Tumbleweed, it does not appear to be stable at all on RHEL 8. It works for the older version of podman (1.6.*) on CentOS Streams. For fedora 32 we seem to be able get this working if we create the containers to run for userA, login as userB and sudo systemctl start ... . Logging in as userA to do this does not work.

For RHEL 8.2, it seem we can do this only if we create a user that we never login as, i.e. a login set to /sbin/nologin. If we ever login and try to start the units under that user, using sudo, the services are broken for that user and we cant fix. We need to destroy the RHEL 8 image and start again.

We have run into errors like:
1) the unit starts but are actually dead and there is a /usr/bin/podman process running for the user that appears to not be doing anything, this happens when we don't use PIDFiles for conmon and in the unit files.

2) When we were using PIDFiles we'd get error messags like "new main pid does not belong to service and pid file is not owned by root. refusing". I have yet to find a useful solution posted by anyone for this anywhere on the Internet.

Perhaps what we are trying to do is not even supported. We just need to know to move forward.

So far system units for rootless podman do not appear to work well at all on RHEL 8. SUSE has been more friendly for this. Is this by design or just instability?

Responses