Rootless podman - API library

[andrasi]

Hello!

I'm currently looking for a way to interact with podman from my C/C++ application and scale this up for multiple, unprivileged users.
I see there's a RESTful API where one can start podman as a service and listen for incoming requests.

The problem I have with this is scaling things up, in terms of users who need to be able to manage containers.
The podman instance started as a service is started as a specific (unprivileged) user and I can't tell it to manage a container (run/stop/create) for a different host user.

What would be a good solution here?
A podman instance started for each user who wants to manage containers?

I was thinking also of running my application as a privileged user which, in turn, using system calls would call podman as the unprivileged user.

myapp:
su - user1 -c podman run -d image1

The error handling I think will be really clunky this way.

Is there a C/C++ library to interact with podman instead?

Thank you!

[rhatdan]

What is your goal? Do you actually want each podman container running as a different User or do you want containers running with different UIDs? Are you dealing with real users ?

[andrasi]

Thank you for your reply and suggestion, Daniel!

You mean something like this: https://www.redhat.com/en/blog/painless-services-implementing-serverless-rootless-podman-and-systemd ?
Noted the linger mode suggestion also.

Additional questions:

• how would the application know that the container was started successfully or in general check its state?
• how could a container startup be changed dynamically at runtime, e.g.: change the bind mounts path, container image name, etc. (variance in the podman run arguments)? Changing the .service file is not an option.

[andrasi]

From the example mentioned in the Red Hat blog article and also this youtube video https://www.youtube.com/watch?v=AGkM2jGT61Y
I've noticed that in all cases the systemd unit file just handles the start and stop for an already created container.

How would I proceed with create / run a container?

I think I should use the --new flag: https://docs.podman.io/en/latest/markdown/podman-generate-systemd.1.html#generate-systemd-unit-file-for-a-container-with-new-flag

Still, if I would need to change the run parameters I would have to regenerated the unit file.

And it's unclear how I would have my application know the container state (I have no knowledge/control of the things which run inside the containers in order to have a consistent way of notifying me back on host side).

[rhatdan]

--new is the way.
Yes if you want to change the run , you either need to edit the unit file or regenerate it.

I am not sure what that means.
@vrothberg PTAL

[andrasi]

Hello Dan,

Thank you for your answer.

Reading the documentation more closely I've found this entry under --new:

Note that --new only works on containers and pods created directly via Podman (i.e., podman [container] {create,run} or podman pod create). It does not work on containers or pods created via the REST API or via podman play kube.

This is a blocker for me since currently the only way I can create/run containers is via the application which interacts with podman via its REST API.

Moreover, at the first boot of the system there are no containers created/running. Someone/somehow needs to do that in the first place.

[rhatdan]

Yup the podman client embeds the command line options which is then used within the systemd unit file to create the container. Bottom line without the podman run command we don't have a mechanism to easily understand what the user wants to do with his container.