Podman Rootless Containers - Architecture, Security, and Production Deployment#

1
#!/bin/bash
2
# Script to properly set up volumes for rootless containers
3

4
# Get subuid/subgid ranges
5
SUBUID_START=$(grep "^${USER}:" /etc/subuid | cut -d: -f2)
6
SUBUID_COUNT=$(grep "^${USER}:" /etc/subuid | cut -d: -f3)
7
SUBGID_START=$(grep "^${USER}:" /etc/subgid | cut -d: -f2)
8
SUBGID_COUNT=$(grep "^${USER}:" /etc/subgid | cut -d: -f3)
9

10
echo "User ${USER} UID mapping: ${SUBUID_START}:${SUBUID_COUNT}"
11
echo "User ${USER} GID mapping: ${SUBGID_START}:${SUBGID_COUNT}"
12

13
# Create volume with proper permissions
14
create_rootless_volume() {
15
    local volume_name=$1
16
    local container_uid=${2:-0}
17
    local container_gid=${3:-0}
18

19
    # Create the volume
20
    podman volume create ${volume_name}
21

22
    # Get volume path
23
    volume_path=$(podman volume inspect ${volume_name} --format '{{ .Mountpoint }}')
24

25
    # Calculate host UID/GID
26
    host_uid=$((SUBUID_START + container_uid))
27
    host_gid=$((SUBGID_START + container_gid))
28

29
    echo "Setting volume ownership to ${host_uid}:${host_gid}"
30

31
    # Set ownership using podman unshare
32
    podman unshare chown ${container_uid}:${container_gid} "${volume_path}"
33
}
34

35
# Example: Create OpenSearch data volume
36
create_rootless_volume opensearch-data 1000 1000
37

38
# Fix existing volume permissions
39
fix_volume_permissions() {
40
    local volume_name=$1
41
    local container_uid=${2:-0}
42
    local container_gid=${3:-0}
43

44
    volume_path=$(podman volume inspect ${volume_name} --format '{{ .Mountpoint }}')
45

46
    # Use podman unshare to enter the user namespace
47
    podman unshare chown -R ${container_uid}:${container_gid} "${volume_path}"
48
}

1
graph TB
2
    subgraph "Security Layers"
3
        subgraph "Container Isolation"
4
            UserNS[User Namespaces]
5
            PidNS[PID Namespaces]
6
            NetNS[Network Namespaces]
7
            MountNS[Mount Namespaces]
8
        end
9

10
        subgraph "Access Control"
11
            SubUIDs[Sub UID/GID Mapping]
12
            Capabilities[Dropped Capabilities]
13
            Seccomp[Seccomp Profiles]
14
            SELinux[SELinux Contexts]
15
        end
16

17
        subgraph "Runtime Security"
18
            ReadOnly[Read-only Rootfs]
19
            NoNewPrivs[No New Privileges]
20
            SecureMounts[Secure Mounts]
21
            ResourceLimits[Resource Limits]
22
        end
23

24
        subgraph "Network Security"
25
            PortRestrictions[Port >1024 Only]
26
            NetworkIsolation[Network Isolation]
27
            DNSSecurity[DNS Security]
28
        end
29
    end
30

31
    UserNS --> Isolation[Container Isolation]
32
    PidNS --> Isolation
33
    NetNS --> Isolation
34
    MountNS --> Isolation
35

36
    SubUIDs --> Access[Access Control]
37
    Capabilities --> Access
38
    Seccomp --> Access
39
    SELinux --> Access
40

41
    ReadOnly --> Runtime[Runtime Protection]
42
    NoNewPrivs --> Runtime
43
    SecureMounts --> Runtime
44
    ResourceLimits --> Runtime
45

46
    PortRestrictions --> Network[Network Protection]
47
    NetworkIsolation --> Network
48
    DNSSecurity --> Network
49

50
    Isolation --> Security[Complete Security]
51
    Access --> Security
52
    Runtime --> Security
53
    Network --> Security
54

55
    style UserNS fill:#f96,stroke:#333,stroke-width:2px
56
    style Security fill:#9f9,stroke:#333,stroke-width:2px

1
#!/bin/bash
2
# Rootless container security hardening
3

4
# Function to create secure container
5
create_secure_container() {
6
    local name=$1
7
    local image=$2
8

9
    podman run -d \
10
        --name "${name}" \
11
        --security-opt no-new-privileges:true \
12
        --security-opt seccomp=/etc/containers/seccomp.json \
13
        --security-opt label=type:container_runtime_t \
14
        --cap-drop ALL \
15
        --cap-add NET_BIND_SERVICE \
16
        --read-only \
17
        --read-only-tmpfs \
18
        --tmpfs /tmp:noexec,nosuid,nodev,size=100m \
19
        --tmpfs /run:noexec,nosuid,nodev,size=100m \
20
        --memory 2g \
21
        --memory-reservation 1g \
22
        --memory-swap 2g \
23
        --cpus 2 \
24
        --pids-limit 200 \
25
        --ulimit nofile=1024:2048 \
26
        --ulimit nproc=50:100 \
27
        --health-cmd '/bin/sh -c "curl -f http://localhost:9200/_cluster/health || exit 1"' \
28
        --health-interval 30s \
29
        --health-retries 3 \
30
        --health-start-period 60s \
31
        --health-timeout 10s \
32
        "${image}"
33
}
34

35
# Seccomp profile generator
36
generate_seccomp_profile() {
37
    cat > /etc/containers/seccomp.json << 'EOF'
38
{
39
    "defaultAction": "SCMP_ACT_ERRNO",
40
    "defaultErrnoRet": 1,
41
    "archMap": [
42
        {
43
            "architecture": "SCMP_ARCH_X86_64",
44
            "subArchitectures": ["SCMP_ARCH_X86", "SCMP_ARCH_X32"]
45
        }
46
    ],
47
    "syscalls": [
48
        {
49
            "names": [
50
                "accept", "accept4", "access", "alarm", "bind", "brk",
51
                "capget", "capset", "chdir", "chmod", "chown", "chown32",
52
                "clock_getres", "clock_gettime", "clock_nanosleep", "close",
53
                "connect", "copy_file_range", "creat", "dup", "dup2", "dup3",
54
                "epoll_create", "epoll_create1", "epoll_ctl", "epoll_ctl_old",
55
                "epoll_pwait", "epoll_wait", "epoll_wait_old", "eventfd",
56
                "eventfd2", "execve", "execveat", "exit", "exit_group",
57
                "faccessat", "fadvise64", "fadvise64_64", "fallocate",
58
                "fanotify_mark", "fchdir", "fchmod", "fchmodat", "fchown",
59
                "fchown32", "fchownat", "fcntl", "fcntl64", "fdatasync",
60
                "fgetxattr", "flistxattr", "flock", "fork", "fremovexattr",
61
                "fsetxattr", "fstat", "fstat64", "fstatat64", "fstatfs",
62
                "fstatfs64", "fsync", "ftruncate", "ftruncate64", "futex",
63
                "futimesat", "getcpu", "getcwd", "getdents", "getdents64",
64
                "getegid", "getegid32", "geteuid", "geteuid32", "getgid",
65
                "getgid32", "getgroups", "getgroups32", "getitimer", "getpeername",
66
                "getpgid", "getpgrp", "getpid", "getppid", "getpriority",
67
                "getrandom", "getresgid", "getresgid32", "getresuid", "getresuid32",
68
                "getrlimit", "get_robust_list", "getrusage", "getsid", "getsockname",
69
                "getsockopt", "get_thread_area", "gettid", "gettimeofday", "getuid",
70
                "getuid32", "getxattr", "inotify_add_watch", "inotify_init",
71
                "inotify_init1", "inotify_rm_watch", "io_cancel", "ioctl",
72
                "io_destroy", "io_getevents", "ioprio_get", "ioprio_set",
73
                "io_setup", "io_submit", "kill", "lchown", "lchown32",
74
                "lgetxattr", "link", "linkat", "listen", "listxattr",
75
                "llistxattr", "lremovexattr", "lseek", "lsetxattr", "lstat",
76
                "lstat64", "madvise", "memfd_create", "mincore", "mkdir",
77
                "mkdirat", "mknod", "mknodat", "mlock", "mlock2", "mlockall",
78
                "mmap", "mmap2", "mprotect", "mq_getsetattr", "mq_notify",
79
                "mq_open", "mq_timedreceive", "mq_timedsend", "mq_unlink",
80
                "mremap", "msgctl", "msgget", "msgrcv", "msgsnd", "msync",
81
                "munlock", "munlockall", "munmap", "nanosleep", "newfstatat",
82
                "open", "openat", "pause", "pipe", "pipe2", "poll", "ppoll",
83
                "prctl", "pread64", "preadv", "preadv2", "prlimit64", "pselect6",
84
                "pwrite64", "pwritev", "pwritev2", "read", "readahead",
85
                "readlink", "readlinkat", "readv", "recv", "recvfrom",
86
                "recvmmsg", "recvmsg", "remap_file_pages", "removexattr",
87
                "rename", "renameat", "renameat2", "restart_syscall", "rmdir",
88
                "rt_sigaction", "rt_sigpending", "rt_sigprocmask", "rt_sigqueueinfo",
89
                "rt_sigreturn", "rt_sigsuspend", "rt_sigtimedwait", "rt_tgsigqueueinfo",
90
                "sched_getaffinity", "sched_getattr", "sched_getparam",
91
                "sched_get_priority_max", "sched_get_priority_min", "sched_getscheduler",
92
                "sched_rr_get_interval", "sched_setaffinity", "sched_setattr",
93
                "sched_setparam", "sched_setscheduler", "sched_yield", "seccomp",
94
                "select", "semctl", "semget", "semop", "semtimedop", "send",
95
                "sendfile", "sendfile64", "sendmmsg", "sendmsg", "sendto",
96
                "setfsgid", "setfsgid32", "setfsuid", "setfsuid32", "setgid",
97
                "setgid32", "setgroups", "setgroups32", "setitimer", "setpgid",
98
                "setpriority", "setregid", "setregid32", "setresgid", "setresgid32",
99
                "setresuid", "setresuid32", "setreuid", "setreuid32", "setrlimit",
100
                "set_robust_list", "setsid", "setsockopt", "set_thread_area",
101
                "set_tid_address", "setuid", "setuid32", "setxattr", "shmat",
102
                "shmctl", "shmdt", "shmget", "shutdown", "sigaltstack", "signalfd",
103
                "signalfd4", "sigreturn", "socket", "socketcall", "socketpair",
104
                "splice", "stat", "stat64", "statfs", "statfs64", "statx",
105
                "symlink", "symlinkat", "sync", "sync_file_range", "syncfs",
106
                "sysinfo", "tee", "tgkill", "time", "timer_create", "timer_delete",
107
                "timerfd_create", "timerfd_gettime", "timerfd_settime",
108
                "timer_getoverrun", "timer_gettime", "timer_settime", "times",
109
                "tkill", "truncate", "truncate64", "ugetrlimit", "umask", "uname",
110
                "unlink", "unlinkat", "utime", "utimensat", "utimes", "vfork",
111
                "vmsplice", "wait4", "waitid", "waitpid", "write", "writev"
112
            ],
113
            "action": "SCMP_ACT_ALLOW"
114
        }
115
    ]
116
}
117
EOF
118
}

1
graph TB
2
    subgraph "Production Environment"
3
        subgraph "User: app1 (UID: 2001)"
4
            App1Pod[Podman]
5
            App1Systemd[systemd --user]
6
            App1Containers[App Containers]
7
            App1Storage[~app1/.local/share/containers]
8
        end
9

10
        subgraph "User: app2 (UID: 2002)"
11
            App2Pod[Podman]
12
            App2Systemd[systemd --user]
13
            App2Containers[DB Containers]
14
            App2Storage[~app2/.local/share/containers]
15
        end
16

17
        subgraph "User: monitor (UID: 2003)"
18
            MonPod[Podman]
19
            MonSystemd[systemd --user]
20
            MonContainers[Monitoring Stack]
21
            MonStorage[~monitor/.local/share/containers]
22
        end
23

24
        subgraph "Shared Resources"
25
            SharedNet[Shared Network<br/>10.88.0.0/16]
26
            SharedVol[Shared Volumes<br/>NFS/GlusterFS]
27
            Registry[Container Registry]
28
        end
29

30
        subgraph "Management Layer"
31
            Ansible[Ansible Automation]
32
            Monitoring[Prometheus/Grafana]
33
            Logging[Centralized Logging]
34
        end
35
    end
36

37
    App1Systemd --> App1Pod
38
    App1Pod --> App1Containers
39
    App1Containers --> App1Storage
40

41
    App2Systemd --> App2Pod
42
    App2Pod --> App2Containers
43
    App2Containers --> App2Storage
44

45
    MonSystemd --> MonPod
46
    MonPod --> MonContainers
47
    MonContainers --> MonStorage
48

49
    App1Containers -.-> SharedNet
50
    App2Containers -.-> SharedNet
51
    MonContainers -.-> SharedNet
52

53
    App1Containers -.-> SharedVol
54
    App2Containers -.-> SharedVol
55

56
    Registry --> App1Pod
57
    Registry --> App2Pod
58
    Registry --> MonPod
59

60
    Ansible --> App1Systemd
61
    Ansible --> App2Systemd
62
    Ansible --> MonSystemd
63

64
    MonContainers --> Monitoring
65
    All[All Containers] -.-> Logging
66

67
    style SharedNet fill:#f96,stroke:#333,stroke-width:2px
68
    style Ansible fill:#9f9,stroke:#333,stroke-width:2px

1
graph LR
2
    subgraph "Performance Bottlenecks"
3
        FUSE[FUSE Overhead]
4
        Network[Network Translation]
5
        UID[UID Mapping]
6
        Cgroup[Cgroup Limits]
7
    end
8

9
    subgraph "Optimization Strategies"
10
        Storage[Storage Driver Selection]
11
        NetOpt[Network Optimization]
12
        Caching[Volume Caching]
13
        Resources[Resource Allocation]
14
    end
15

16
    subgraph "Solutions"
17
        Native[Native Overlayfs<br/>(Kernel 5.11+)]
18
        Pasta[Pasta Networking]
19
        DirectVol[Direct Volume Mounts]
20
        CgroupV2[Cgroup v2 Delegation]
21
    end
22

23
    FUSE --> Storage
24
    Network --> NetOpt
25
    UID --> Caching
26
    Cgroup --> Resources
27

28
    Storage --> Native
29
    NetOpt --> Pasta
30
    Caching --> DirectVol
31
    Resources --> CgroupV2
32

33
    style FUSE fill:#f99,stroke:#333,stroke-width:2px
34
    style Native fill:#9f9,stroke:#333,stroke-width:2px

1
#!/bin/bash
2
# Rootless container performance optimization
3

4
# Enable native overlayfs if available (kernel 5.11+)
5
setup_native_overlay() {
6
    kernel_version=$(uname -r | cut -d. -f1,2)
7
    if (( $(echo "$kernel_version >= 5.11" | bc -l) )); then
8
        echo "Native overlayfs available"
9
        mkdir -p ~/.config/containers
10
        cat > ~/.config/containers/storage.conf << EOF
11
[storage]
12
driver = "overlay"
13

14
[storage.options.overlay]
15
# Use native overlay instead of fuse-overlayfs
16
mount_program = ""
17
# Optimize for performance
18
skip_mount_home = "true"
19
mountopt = "noatime,volatile"
20
EOF
21
    else
22
        echo "Kernel too old for native overlayfs, using fuse-overlayfs"
23
    fi
24
}
25

26
# Configure pasta networking (faster than slirp4netns)
27
setup_pasta_network() {
28
    if command -v pasta &> /dev/null; then
29
        echo "Configuring pasta networking"
30
        mkdir -p ~/.config/containers
31
        cat >> ~/.config/containers/containers.conf << EOF
32
[network]
33
default_rootless_network_cmd = "pasta"
34
EOF
35
    else
36
        echo "Pasta not available, install it for better network performance"
37
    fi
38
}
39

40
# Optimize cgroup v2 delegation
41
setup_cgroup_delegation() {
42
    if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
43
        echo "Cgroup v2 detected"
44
        # Request delegation for current user
45
        systemctl --user set-property systemd-oomd.service "Delegate=cpu cpuset io memory pids"
46
    fi
47
}
48

49
# Volume performance optimization
50
optimize_volumes() {
51
    # Use tmpfs for temporary data
52
    podman volume create temp-data --opt type=tmpfs --opt device=tmpfs --opt o=size=1g,noatime
53

54
    # Use dedicated disk for persistent data
55
    podman volume create persistent-data --opt type=none --opt device=/fast-ssd/containers --opt o=bind,noatime
56
}
57

58
# Main execution
59
setup_native_overlay
60
setup_pasta_network
61
setup_cgroup_delegation
62
optimize_volumes
63

64
echo "Performance optimizations applied"

1
graph TB
2
    subgraph "Container Metrics"
3
        PodmanStats[Podman Stats API]
4
        ConmonLogs[Conmon Logs]
5
        HealthChecks[Health Checks]
6
    end
7

8
    subgraph "System Metrics"
9
        NodeExporter[Node Exporter]
10
        CgroupMetrics[Cgroup Metrics]
11
        ProcessMetrics[Process Metrics]
12
    end
13

14
    subgraph "Collection Layer"
15
        Prometheus[Prometheus]
16
        Loki[Loki]
17
        Telegraf[Telegraf]
18
    end
19

20
    subgraph "Storage"
21
        MetricsDB[Metrics Storage]
22
        LogsDB[Logs Storage]
23
    end
24

25
    subgraph "Visualization"
26
        Grafana[Grafana]
27
        Alerts[Alert Manager]
28
    end
29

30
    PodmanStats --> Telegraf
31
    ConmonLogs --> Loki
32
    HealthChecks --> Prometheus
33

34
    NodeExporter --> Prometheus
35
    CgroupMetrics --> Telegraf
36
    ProcessMetrics --> Prometheus
37

38
    Telegraf --> MetricsDB
39
    Prometheus --> MetricsDB
40
    Loki --> LogsDB
41

42
    MetricsDB --> Grafana
43
    LogsDB --> Grafana
44
    MetricsDB --> Alerts
45

46
    style Prometheus fill:#f96,stroke:#333,stroke-width:2px
47
    style Grafana fill:#9f9,stroke:#333,stroke-width:2px

1
graph TB
2
    subgraph "Development"
3
        Dev[Development Environment]
4
        Test[Testing]
5
        Build[Image Building]
6
    end
7

8
    subgraph "Deployment"
9
        Stage[Staging Deployment]
10
        Prod[Production Deployment]
11
        Monitor[Monitoring Setup]
12
    end
13

14
    subgraph "Maintenance"
15
        Updates[Regular Updates]
16
        Backups[Backup Strategy]
17
        Recovery[Disaster Recovery]
18
    end
19

20
    Dev --> Test
21
    Test --> Build
22
    Build --> Stage
23
    Stage --> Prod
24
    Prod --> Monitor
25

26
    Monitor --> Updates
27
    Updates --> Backups
28
    Backups --> Recovery
29

30
    style Prod fill:#f96,stroke:#333,stroke-width:2px
31
    style Monitor fill:#9f9,stroke:#333,stroke-width:2px