cenos8 stream版本安装podman配置

admin

1、安装 Podman 和 Podman-Compose。

1）安装 Podman：
7 o. f6 m; [, Q4 s4 m" i
[root@host ~]# dnf install podman podman-plugins cockpit cockpit-podman
: ~7 i2 i3 \: ]: X: @* [: T[root@host ~]# systemctl enable --now podman
$ k9 s" @; x+ I3 l  X[root@host ~]# systemctl enable --now cockpit.socket
8 @5 _& J) v: b2 R( U  U" f+ G安装cockpit和cockpit-podman后，可以通过【https://ip:9090】来管理容器。

2）安装 Podman-Compose：

[root@host ~]# dnf install python3
9 M* t( j2 u: J+ y1 k[root@host ~]# pip3 install podman-compose
程序安装位置：
镜像管理程序：/usr/bin/podman
编译文件执行程序：/usr/local/bin/podman-compose
* Z3 \" ]! c9 H: J2 R9 I& `- K配置文件目录：/etc/containers，/usr/share/containers

# _  w! [8 o  C6 M) F更新

6 Z: ^6 P0 |  {+ T4 T* s[root@host ~]# dnf upgrade podman
[root@host ~]# pip3 install -U podman-compose
* W) T; g" V. u7 b6 [2 w' Z) z; I5 t
2、设置国内镜像仓库加速器。
& {! i/ i7 L2 F* N; E  l8 ^
1）备份原配置文件：

[root@host ~]# cp /etc/containers/registries.conf{,.bak}
5 ?% ?0 X( P+ S. x" L2）使用文本编辑器打开配置文件：
1 E! B* |" _& Z- t
[root@host ~]# vim /etc/containers/registries.conf
3）删除原有内容，重新编写文件内容后保存：

unqualified-search-registries = ["docker.io"]
. v2 K( b+ E% Z. \
[[registry]]
3 _# L" q# M+ |1 fprefix = "docker.io"
location = "docker.io"

/ W1 r  v7 d/ x# j[[registry.mirror]]
location = "mirrors.tuna.tsinghua.edu.cn"
3 Q( B1 }' d% j/ y3 B
# U# p6 w8 U" j! p" B
  w/ t$ ?3 V5 T! @" G4、设置镜像仓库和运行时目录。
* R" x) L5 U2 V: K# o1 S$ n
1）创建镜像仓库目录：
- o" q8 a/ h; c) o& y
[root@host ~]# mkdir -p /data/containers/{run,graph}
6 V7 A( S: _0 ?/ k& q  B2）备份原配置文件：
% K: C! c0 D- S" v% R/ J
& Q& w2 v( e. N2 J9 x+ n1 ?3 u[root@host ~]# cp /etc/containers/storage.conf{,.bak}
. R7 F/ e. @7 R2 l; m  ~2 R3）使用文本编辑器打开配置文件：

[root@host ~]# vim /etc/containers/storage.conf
4 R7 o! |- f. [' K( |4）修改文件以下内容后保存：
: h3 L+ S  A1 M1 G1 L: p" z2 k, j
& Y" b0 T2 s* y# root 用户运行时目录
runroot = "/data/containers/run"
6 @# }6 m" C7 |9 V3 k
; X' u; ]0 y0 Z( U6 F- `2 S4 k# root 用户镜像仓库目录
graphroot = "/data/containers/graph"
3 ~  w0 {: ^  ?" o  f0 k9 l3 Z
$ g% h, J3 k4 N5、修改 SELinux 配置文件，永久关闭 SELinux。

% H3 _) |7 }" O; R7 R8 E$ |使用文本编辑器打开"/etc/selinux/config"文件：

[root@host ~]# vim /etc/selinux/config
3 x' t: a5 Z( p将 "SELINUX" 参数设置为："permissive" 或者 "disabled"，并保存：

. K8 @  p7 k" ]# a5 g/ [
. J( f" X5 T# J8 I/ Q#     enforcing - 表示启用 SELinux 安全策略。
( \$ f( `' }) m2 e" U( Y, D#     permissive - 表示启用 SELinux 安全策略，但不强制验证。如果执行第一步可以正常运行，则建议设置此值。
( y; `6 K  E& a- b5 [#     disabled - 关闭 SELinux 安全策略，相当于没有安装 SELinux。
) o0 ~6 b! P" b# ISELINUX=disabled

2 W) I2 l3 l( m1 D+ z1 X1 _
重启服务器：
; L7 S  @+ h+ F9 ]1 r  n
$ o$ q/ [3 `5 ?/ O" h1 P[root@host ~]# shutdown -r now
% ]- V: L2 a" F- h( ?  U7 @/ h  u6 I
/ B3 B: F1 ~7 R+ U3 r1 r' `3 P

admin

podman的配置文件 /etc/containers/registries.conf
- x4 t, p" e3 X全局配置文件: /etc/containers/registries.conf
用户配置文件: ~/.config/containers/registries.conf
6 h& ]0 n: y7 g6 x备份原文件
" O/ s9 A) E7 ^) b" l
sudo cp /etc/containers/registries.conf /etc/containers/registries.conf.bak
( q% B6 P5 S) F, |' H+ T! }# y5 ^
' T6 R/ f: r* Hsudo cp /etc/containers/registries.conf /etc/containers/registries.conf.`date "+%Y-%m-%dT%H:%M:%S"`.bak

) @2 B8 H4 t. `1 C: x4 e: \sudo cp /etc/containers/registries.conf /etc/containers/registries.conf.`date "+%Y%m%d%H%M%S"`.bak
2 D6 B9 {0 u& D; Q7 Q) J
9 J6 I2 i! N, C2 c( H' k. ssudo cp /etc/containers/registries.conf /etc/containers/registries.conf.`date "+%y%m%d%H%M%S"`.bak

& l9 b* c7 C8 n& P: v4 K8 Q% R[ -e /etc/containers/registries.conf.BackupDir ] || mkdir /etc/containers/registries.conf.BackupDir
sudo cp /etc/containers/registries.conf /etc/containers/registries.conf.BackupDir/registries.conf.`date "+%Y%m%d%H%M%S"`.bak

0 }8 |- F7 w; ]* X) r2 F- {4 q编辑
$ a3 p! O* O$ _6 A. L. S6 E
# m3 E1 w7 p( w6 l9 y# |sudo vi /etc/containers/registries.conf
( C; W; N( }1 j0 g
sudo vi ~/.config/containers/registries.conf

查看

sudo cat /etc/containers/registries.conf
) e' l9 a/ V( j( H; R& e
sudo cat ~/.config/containers/registries.conf

sudo more /etc/containers/registries.conf

sudo less /etc/containers/registries.conf

其中prefix是pull的时候指定的镜像前缀，location是获取镜像的地址，如果不指定prefix则默认和location一致。insecure=true表示允许通过HTTP协议来获取镜像，对于私有化部署/内网测试环境下无https证书的环境来说很有帮助。

- C4 @; @* N4 B. b" |; V' r3 \# y配置单个镜像源
& v5 j" R* _) L* C
) i  K2 C6 R1 {8 y使用中科大源
* {5 l* {6 ?" O* z
% k6 a, V: g& P' i# n2 X# F###  CentOS9原版 unqualified-search-registries
# unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "registry.centos.org", "quay.io", "docker.io"]
- x' U: ~% u. M) B( Z  B
* Q# W; F# J; V4 W/ K/ Y###  Fedora36原版 unqualified-search-registries
" y, Q$ T1 Z. `" ^2 g# unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "docker.io", "quay.io"]
3 c6 |" w& O- o" I6 L7 {
###  Rocky9原版 unqualified-search-registries
# unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "registry.centos.org", "quay.io", "docker.io"]

% X6 r$ n' U" I. o; K5 l###  AlmaLinux9原版 unqualified-search-registries
# unqualified-search-registries = ["registry.access.redhat.com", "registry.redhat.io", "docker.io"]

### 取消从默认地址搜索的仓库域名
% V2 h% w: x- i) B' e# `* R! N( Sunqualified-search-registries = ["docker.io"]

/ a9 C/ G) A6 F9 L3 t6 G4 Q### 自定义搜索器
5 \* f; I8 c( o& f, C+ I& q, Z[[registry]]
) m7 j2 \/ I2 q8 y8 Q4 ^# @7 A### 仓库前缀
prefix = "docker.io"
5 j$ w/ G7 o9 |% l# s0 s8 n4 G### 加速器地址
# G, o; s0 K2 Q8 v2 {1 Y: E2 w& c( Llocation = "docker.mirrors.ustc.edu.cn"
### 允许通过http协议获取镜像
insecure = true
* J" u) o' {5 w3 y% n8 o- Y/ ~


1 \8 a& u9 a$ N) [4 l) K' F
使用docker中国区的源

unqualified-search-registries = ["docker.io"]
( I; E( w; A" c0 m% l
/ Y: f+ n4 O$ A* m& B, f( z' @[[registry]]
prefix = "docker.io"
location = "registry.docker-cn.com"
* X& ]$ u' a1 N4 }5 J. rinsecure = true
/ l( m& T' I# w' M8 u& ~% u" K4 ^8 Q
+ q& T% n, i, d
使用163源

8 S, c% H2 g% O6 ?: Ounqualified-search-registries = ["docker.io"]

[[registry]]
. ?# [- B/ h! C/ c$ Jprefix = "docker.io"
" `/ h$ y$ }, z  c5 H% slocation = "hub-mirror.c.163.com"
* f* Z) |# z% w# h* j% _insecure = true

9 {' l3 N/ z6 h8 ~. a
6 u# g* C) U* p7 S使用阿里源

unqualified-search-registries = ["docker.io"]
* e* G+ }2 J* x
[[registry]]
prefix = "docker.io"
3 m0 _/ ^; E7 Y- a4 K1 Ylocation = "xxxxxx.mirror.aliyuncs.com"
2 r) E+ s! g2 z% i5 G
' p, ^4 E% r! W0 r7 {% J

配置多个镜像源

unqualified-search-registries = ["docker.io"]
1 s, L- g% n- f6 w" j% A+ `
[[registry]]
prefix = "docker.io"
location = "hub-mirror.c.163.com"
insecure = true
) C" c2 [" z  n$ K9 S
' r" ~: Q4 v5 S5 C3 O; m. ?[[registry.mirror]]
location = "docker.mirrors.ustc.edu.cn"
0 \& U. @4 b1 V$ |! pinsecure = true
5 P' q6 g8 O* z; t; Q; x2 g[[registry.mirror]]
7 p7 C+ C6 b- B* |! F: Q+ flocation = "hub-mirror.c.163.com"
insecure = true
[[registry.mirror]]
$ }' X/ Z- D' X: }location = "registry.docker-cn.com"
insecure = true
/ g8 s1 K! W& X( ^
用脚本配置
& ]7 a8 |- a$ a3 l3 o
#!/bin/bash
[ -e /etc/containers/registries.conf.BackupDir ] || mkdir /etc/containers/registries.conf.BackupDir
% X! K$ G% J2 @4 l# J; c# ~sudo cp /etc/containers/registries.conf /etc/containers/registries.conf.BackupDir/registries.conf.`date "+%Y%m%d%H%M%S"`.bak
printf '
unqualified-search-registries = ["docker.io"]

[[registry]]
* V- u9 e* P, d: Q5 Z1 @5 H: Gprefix = "docker.io"
location = "hub-mirror.c.163.com"
insecure = true
[[registry.mirror]]
4 p+ f( X/ W. `& i5 Ulocation = "docker.mirrors.ustc.edu.cn"
insecure = true
[[registry.mirror]]
location = "hub-mirror.c.163.com"
2 q* E! r' i: q( a4 i% h: I2 L8 pinsecure = true
' V0 |0 A6 r5 z5 n[[registry.mirror]]
; {% `/ ^/ j! l! K* ?# L# Zlocation = "registry.docker-cn.com"
insecure = true
0 [: U5 s% ]% Q+ Q7 n' | sudo tee /etc/containers/registries.conf

* m) S8 F# S" v8 Q2 C2 u, v* [
. l4 R, ~7 V- `! ^3 x5 ?* [1 ^4 a测试,查看信息

sudo podman run hello-world
7 x/ L" P  }7 A9 y& A
sudo podman info
$ s& s% Q/ ?/ y* H1 V
: O  L* c" J1 v6 e: D! E8 W) ^

admin

安装podman：
dnf install -y @container-tools
dnf install -y podman
) H: v, o& R% K4 ]安装podman：
) U3 S% s. G! @$ i  p/ F/ J  U+ ldnf install -y @container-tools
0 L" l3 y) |5 n! I4 K% f' @- Qdnf install -y podman
; r# ]  e9 r- P* I' K
备份文件：
6 e) ^. \4 Y4 ~! h0 Ucp /etc/containers/registries.conf{,.bak}
4 O( n4 o, z. }! s4 d
! p2 ~3 C- @1 P2 e- t$ H修改文件：
vim /etc/containers/registries.conf
去掉红帽的哪些配置，只保留下面的配置：
- ]- d6 c0 w% s7 gunqualified-search-registries = ["docker.io"]
unqualified-search-registries = ["docker.io"]
[[registry]]
% k5 j0 u& v2 v4 y' F! B; mprefix = "docker.io"
0 T. [  {2 b9 b( a; ?location = "docker.io"

5 W( E- Y' g/ o# |" h* k) \[[registry.mirror]]
& O" I. C" Z3 G* r8 K; U& Plocation = "mirror.baidubce.com"
4 R7 Z; Q" f$ ]7 a9 ^( m; g6 Y
' e! Y6 E( F; j, i. L8 X2 g1 b# q

dnf install -y podman

dnf install -y podman podman-plugins cockpit cockpit-podman

systemctl enable --now podman.service

systemctl enable --now cockpit.socket

$ t  N/ t" g! R* i