Podman pod supported on Windows with WSL2 ?

[tdesaules]

Hello Podman community :)

I try since several days to get a working Podman install on Windows.

It seems to work using "classic" container but when I try to play with pod podman get freeze. Sometime it create the pod but fail on some random container inside it and almost all the time it create locks on containers and I can't delete the pod. In that case I need to reset podman.

I'm worry about the pod support on Windows/WSL2 since I got this on my two laptop.

Some more info :

Windows

Edition	        Windows 11 Pro
Version	        22H2
Installed on	‎10/‎9/‎2022
OS build	        22621.674
Experience	Windows Feature Experience Pack 1000.22634.1000.0

WSL2

WSL version: 0.70.4.0
Kernel version: 5.15.74.2
WSLg version: 1.0.45
MSRDC version: 1.2.3575
Direct3D version: 1.606.4
DXCore version: 10.0.25131.1002-220531-1700.rs-onecore-base2-hyp
Windows version: 10.0.22621.674

Podman

Client:       Podman Engine
Version:      4.3.0
API Version:  4.3.0
Go Version:   go1.18.7
Git Commit:   ad42af94903ce4f3c3cd0693e4e17e4286bf094b
Built:        Wed Oct 19 19:53:21 2022
OS/Arch:      windows/amd64

Server:       Podman Engine
Version:      4.2.1
API Version:  4.2.1
Go Version:   go1.18.5
Built:        Wed Sep  7 21:58:19 2022
OS/Arch:      linux/amd64

Don't know if the version diff should be an issue between 4.3.0 and 4.2.1 but I have the same issue using a 4.2.1 client

Podman Info

host:
  arch: amd64
  buildahVersion: 1.27.0
  cgroupControllers: []
  cgroupManager: cgroupfs
  cgroupVersion: v1
  conmon:
    package: conmon-2.1.4-3.fc36.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.4, commit: '
  cpuUtilization:
    idlePercent: 99.9
    systemPercent: 0.06
    userPercent: 0.05
  cpus: 16
  distribution:
    distribution: fedora
    variant: container
    version: "36"
  eventLogger: journald
  hostname: DESKTOP-IVUMN45
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 5.15.74.2-microsoft-standard-WSL2
  linkmode: dynamic
  logDriver: journald
  memFree: 6270595072
  memTotal: 7195668480
  networkBackend: netavark
  ociRuntime:
    name: crun
    package: crun-1.6-2.fc36.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.6
      commit: 18cf2efbb8feb2b2f20e316520e0fd0b6c41ef4d
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: true
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.0-0.2.beta.0.fc36.x86_64
    version: |-
      slirp4netns version 1.2.0-beta.0
      commit: 477db14a24ff1a3de3a705e51ca2c4c1fe3dda64
      libslirp: 4.6.1
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.3
  swapFree: 2147483648
  swapTotal: 2147483648
  uptime: 1h 36m 13.00s (Approximately 0.04 days)
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
  - quay.io
store:
  configFile: /home/user/.config/containers/storage.conf
  containerStore:
    number: 5
    paused: 0
    running: 0
    stopped: 5
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/user/.local/share/containers/storage
  graphRootAllocated: 1081101176832
  graphRootUsed: 831381504
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 10
  runRoot: /run/user/1000/containers
  volumePath: /home/user/.local/share/containers/storage/volumes
version:
  APIVersion: 4.2.1
  Built: 1662580699
  BuiltTime: Wed Sep  7 21:58:19 2022
  GitCommit: ""
  GoVersion: go1.18.5
  Os: linux
  OsArch: linux/amd64
  Version: 4.2.1

[tdesaules]

Also some more info about the process

I install the podman windows exe file.
I init podman machine with

❯ podman machine init
Extracting compressed file
Importing operating system into WSL (this may take a few minutes on a new WSL install)...
Import in progress, this may take a few minutes.
The operation completed successfully.
Configuring system...
Generating public/private ed25519 key pair.
Your identification has been saved in podman-machine-default
Your public key has been saved in podman-machine-default.pub
The key fingerprint is:
SHA256:Am7GcvoNzEN6P0bxZOjwd5nOXMDhiPqUMp91iRfB58k root@DESKTOP-IVUMN45
The key's randomart image is:
+--[ED25519 256]--+
|         .       |
|          + .    |
|    .  o + * .   |
|   o..+ + = E    |
|  . B=.*S. *     |
|   @+ *.= B .    |
|  o *B + B .     |
|   o =*   +      |
|    ..o.         |
+----[SHA256]-----+
Machine init complete
To start your machine run:

        podman machine start

❯ podman machine start
Starting machine "podman-machine-default"

This machine is currently configured in rootless mode. If your containers
require root permissions (e.g. ports < 1024), or if you run into compatibility
issues with non-podman clients, you can switch using the following command:

        podman machine set --rootful

API forwarding listening on: npipe:////./pipe/docker_engine

Docker API clients default to this address. You do not need to set DOCKER_HOST.
Machine "podman-machine-default" started successfully

I build a small container image

podman build `
    --tag nats `
    $Home\Repositories\GitHub\containers\nats

based on Dockerfile

FROM docker.io/alpine:latest

ENV NATS_SERVER 2.9.5
ENV NATS_CLI 0.0.34

RUN echo "@edge http://nl.alpinelinux.org/alpine/edge/main" >> /etc/apk/repositories ;\
	echo "@edgecommunity http://nl.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories ;\
	echo "@testing http://nl.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories

RUN apk update ;\
	apk upgrade ;\
	apk add --no-cache curl bash icu-libs krb5-libs libgcc libintl libssl1.1 libstdc++ zlib jq

RUN curl -L https://github.com/nats-io/nats-server/releases/download/v${NATS_SERVER}/nats-server-v${NATS_SERVER}-linux-amd64.zip --output /tmp/nats-server-v${NATS_SERVER}-linux-amd64.zip ;\
	unzip /tmp/nats-server-v${NATS_SERVER}-linux-amd64.zip -d /tmp ;\
	cp /tmp/nats-server-v${NATS_SERVER}-linux-amd64/nats-server /usr/bin/nats-server ;\
	rm -rf /tmp/nats-server-v${NATS_SERVER}-linux-amd64*

RUN curl -L https://github.com/nats-io/natscli/releases/download/v${NATS_CLI}/nats-${NATS_CLI}-linux-amd64.zip --output /tmp/nats-${NATS_CLI}-linux-amd64.zip ;\
	unzip /tmp/nats-${NATS_CLI}-linux-amd64.zip -d /tmp ;\
	cp /tmp/nats-${NATS_CLI}-linux-amd64/nats /usr/bin/nats-client ;\
	rm -rf /tmp/nats-${NATS_CLI}-linux-amd64*

CMD [ "/bin/ash", "sleep infinity" ]

I create a pod using

podman pod create `
    --name nats `
    --publish 4222:4222 `
    --publish 8222:8222 `
    --publish 4223:4223 `
    --publish 8223:8223 `
    --publish 4224:4224 `
    --publish 8224:8224

I add my containers to the pod like

podman run `
    --detach `
    --interactive `
    --tty `
    --name nats-server-0 `
    --pod nats `
    nats nats-server --port 4222 --cluster_name nats --cluster nats://0.0.0.0:6222 --http_port 8222

podman run `
    --detach `
    --interactive `
    --tty `
    --name nats-server-1 `
    --pod nats `
    nats nats-server --port 4223 --cluster_name nats --cluster nats://0.0.0.0:6223 --routes=nats://127.0.0.1:6222 --http_port 8223

podman run `
    --detach `
    --interactive `
    --tty `
    --name nats-server-2 `
    --pod nats `
    nats nats-server --port 4224 --cluster_name nats --cluster nats://0.0.0.0:6224 --routes=nats://127.0.0.1:6222 --http_port 8224

podman run `
    --detach `
    --interactive `
    --tty `
    --name nats-client `
    --pod nats `
    nats sleep infinity

to get

❯ podman pod ls
POD ID        NAME        STATUS      CREATED        INFRA ID      # OF CONTAINERS
c293cdae1e0b  nats        Running     2 minutes ago  f701a2e869c2  5

❯ podman ps
CONTAINER ID  IMAGE                                    COMMAND               CREATED             STATUS                 PORTS                                                               NAMES
f701a2e869c2  localhost/podman-pause:4.2.1-1662580699                        3 minutes ago       Up About a minute ago  0.0.0.0:4222-4224->4222-4224/tcp, 0.0.0.0:8222-8224->8222-8224/tcp  c293cdae1e0b-infra
0e85c4113f81  localhost/nats:latest                    nats-server --por...  About a minute ago  Up About a minute ago  0.0.0.0:4222-4224->4222-4224/tcp, 0.0.0.0:8222-8224->8222-8224/tcp  nats-server-0
65535f2a72d0  localhost/nats:latest                    nats-server --por...  About a minute ago  Up About a minute ago  0.0.0.0:4222-4224->4222-4224/tcp, 0.0.0.0:8222-8224->8222-8224/tcp  nats-server-1
438dda38f8af  localhost/nats:latest                    nats-server --por...  About a minute ago  Up About a minute ago  0.0.0.0:4222-4224->4222-4224/tcp, 0.0.0.0:8222-8224->8222-8224/tcp  nats-server-2
3082b906f4c4  localhost/nats:latest                    sleep infinity        59 seconds ago      Up About a minute ago  0.0.0.0:4222-4224->4222-4224/tcp, 0.0.0.0:8222-8224->8222-8224/tcp  nats-client

and I generate it like

❯ podman generate kube nats
# Save the output of this file and use kubectl create -f to import
# it into Kubernetes.
#
# Created with podman-4.2.1
apiVersion: v1
kind: Pod
metadata:
  annotations:
    io.kubernetes.cri-o.ContainerType/nats-client: container
    io.kubernetes.cri-o.ContainerType/nats-server-0: container
    io.kubernetes.cri-o.ContainerType/nats-server-1: container
    io.kubernetes.cri-o.ContainerType/nats-server-2: container
    io.kubernetes.cri-o.SandboxID/nats-client: f701a2e869c2654e7a4512b6c63d36eda7b7c098d01d3a6ac077d689c80d1f6
    io.kubernetes.cri-o.SandboxID/nats-server-0: f701a2e869c2654e7a4512b6c63d36eda7b7c098d01d3a6ac077d689c80d1f6
    io.kubernetes.cri-o.SandboxID/nats-server-1: f701a2e869c2654e7a4512b6c63d36eda7b7c098d01d3a6ac077d689c80d1f6
    io.kubernetes.cri-o.SandboxID/nats-server-2: f701a2e869c2654e7a4512b6c63d36eda7b7c098d01d3a6ac077d689c80d1f6
    io.kubernetes.cri-o.TTY/nats-client: "true"
    io.kubernetes.cri-o.TTY/nats-server-0: "true"
    io.kubernetes.cri-o.TTY/nats-server-1: "true"
    io.kubernetes.cri-o.TTY/nats-server-2: "true"
    io.podman.annotations.autoremove/nats-client: "FALSE"
    io.podman.annotations.autoremove/nats-server-0: "FALSE"
    io.podman.annotations.autoremove/nats-server-1: "FALSE"
    io.podman.annotations.autoremove/nats-server-2: "FALSE"
    io.podman.annotations.init/nats-client: "FALSE"
    io.podman.annotations.init/nats-server-0: "FALSE"
    io.podman.annotations.init/nats-server-1: "FALSE"
    io.podman.annotations.init/nats-server-2: "FALSE"
    io.podman.annotations.privileged/nats-client: "FALSE"
    io.podman.annotations.privileged/nats-server-0: "FALSE"
    io.podman.annotations.privileged/nats-server-1: "FALSE"
    io.podman.annotations.privileged/nats-server-2: "FALSE"
    io.podman.annotations.publish-all/nats-client: "FALSE"
    io.podman.annotations.publish-all/nats-server-0: "FALSE"
    io.podman.annotations.publish-all/nats-server-1: "FALSE"
    io.podman.annotations.publish-all/nats-server-2: "FALSE"
    org.opencontainers.image.base.digest/nats-client: sha256:6a53c8e832267ad5ce22a70a961f5587ff5c5f4440bd092a9cb7517e
    org.opencontainers.image.base.digest/nats-server-0: sha256:6a53c8e832267ad5ce22a70a961f5587ff5c5f4440bd092a9cb7517e
    org.opencontainers.image.base.digest/nats-server-1: sha256:6a53c8e832267ad5ce22a70a961f5587ff5c5f4440bd092a9cb7517e
    org.opencontainers.image.base.digest/nats-server-2: sha256:6a53c8e832267ad5ce22a70a961f5587ff5c5f4440bd092a9cb7517e
    org.opencontainers.image.base.name/nats-client: docker.io/library/alpine:latest
    org.opencontainers.image.base.name/nats-server-0: docker.io/library/alpine:latest
    org.opencontainers.image.base.name/nats-server-1: docker.io/library/alpine:latest
    org.opencontainers.image.base.name/nats-server-2: docker.io/library/alpine:latest
  creationTimestamp: "2022-11-04T12:33:59Z"
  labels:
    app: nats
  name: nats
spec:
  containers:
  - command:
    - nats-server
    - --port
    - "4222"
    - --cluster_name
    - nats
    - --cluster
    - nats://0.0.0.0:6222
    - --http_port
    - "8222"
    image: localhost/nats:latest
    name: nats-server-0
    ports:
    - containerPort: 4222
      hostPort: 4222
    - containerPort: 4223
      hostPort: 4223
    - containerPort: 4224
      hostPort: 4224
    - containerPort: 8222
      hostPort: 8222
    - containerPort: 8223
      hostPort: 8223
    - containerPort: 8224
      hostPort: 8224
    resources: {}
    securityContext:
      capabilities:
        drop:
        - CAP_MKNOD
        - CAP_NET_RAW
        - CAP_AUDIT_WRITE
    stdin: true
    tty: true
  - command:
    - nats-server
    - --port
    - "4223"
    - --cluster_name
    - nats
    - --cluster
    - nats://0.0.0.0:6223
    - --routes=nats://127.0.0.1:6222
    - --http_port
    - "8223"
    image: localhost/nats:latest
    name: nats-server-1
    resources: {}
    securityContext:
      capabilities:
        drop:
        - CAP_MKNOD
        - CAP_NET_RAW
        - CAP_AUDIT_WRITE
    stdin: true
    tty: true
  - command:
    - nats-server
    - --port
    - "4224"
    - --cluster_name
    - nats
    - --cluster
    - nats://0.0.0.0:6224
    - --routes=nats://127.0.0.1:6222
    - --http_port
    - "8224"
    image: localhost/nats:latest
    name: nats-server-2
    resources: {}
    securityContext:
      capabilities:
        drop:
        - CAP_MKNOD
        - CAP_NET_RAW
        - CAP_AUDIT_WRITE
    stdin: true
    tty: true
  - command:
    - sleep
    - infinity
    image: localhost/nats:latest
    name: nats-client
    resources: {}
    securityContext:
      capabilities:
        drop:
        - CAP_MKNOD
        - CAP_NET_RAW
        - CAP_AUDIT_WRITE
    stdin: true
    tty: true
  hostname: nats
  restartPolicy: Never
status: {}

At this point (sometime before podman play kube) I got a dead podman freezy like this

❯ podman pod list --log-level=debug
time="2022-11-04T13:37:17+01:00" level=info msg="C:\\Program Files\\RedHat\\Podman\\podman.exe filtering at log level debug"
time="2022-11-04T13:37:17+01:00" level=debug msg="Called ps.PersistentPreRunE(C:\\Program Files\\RedHat\\Podman\\podman.exe pod list --log-level=debug)"
time="2022-11-04T13:37:17+01:00" level=debug msg="SSH Ident Key \"C:\\\\Users\\\\tdesa\\\\.ssh\\\\podman-machine-default\" SHA256:Am7GcvoNzEN6P0bxZOjwd5nOXMDhiPqUMp91iRfB58k ssh-ed25519"
time="2022-11-04T13:37:17+01:00" level=debug msg="DoRequest Method: GET URI: http://d/v4.3.0/libpod/_ping"
time="2022-11-04T13:37:17+01:00" level=debug msg="DoRequest Method: GET URI: http://d/v4.3.0/libpod/pods/json"

And I have to stop start the podman machine to try to get back podman

❯ podman machine stop
Machine "podman-machine-default" stopped successfully

❯ podman machine start
Starting machine "podman-machine-default"

This machine is currently configured in rootless mode. If your containers
require root permissions (e.g. ports < 1024), or if you run into compatibility
issues with non-podman clients, you can switch using the following command:

        podman machine set --rootful

API forwarding listening on: npipe:////./pipe/docker_engine

Docker API clients default to this address. You do not need to set DOCKER_HOST.
Machine "podman-machine-default" started successfully

❯ podman pod list --log-level=debug
time="2022-11-04T13:40:07+01:00" level=info msg="C:\\Program Files\\RedHat\\Podman\\podman.exe filtering at log level debug"
time="2022-11-04T13:40:07+01:00" level=debug msg="Called ps.PersistentPreRunE(C:\\Program Files\\RedHat\\Podman\\podman.exe pod list --log-level=debug)"
time="2022-11-04T13:40:07+01:00" level=debug msg="SSH Ident Key \"C:\\\\Users\\\\tdesa\\\\.ssh\\\\podman-machine-default\" SHA256:Am7GcvoNzEN6P0bxZOjwd5nOXMDhiPqUMp91iRfB58k ssh-ed25519"
time="2022-11-04T13:40:07+01:00" level=debug msg="DoRequest Method: GET URI: http://d/v4.3.0/libpod/_ping"
time="2022-11-04T13:40:07+01:00" level=debug msg="DoRequest Method: GET URI: http://d/v4.3.0/libpod/pods/json"
POD ID        NAME        STATUS      CREATED        INFRA ID      # OF CONTAINERS
836b707fb18e  nats        Created     3 minutes ago  512b874a9122  5
time="2022-11-04T13:40:07+01:00" level=debug msg="Called ps.PersistentPostRunE(C:\\Program Files\\RedHat\\Podman\\podman.exe pod list --log-level=debug)"

[rhatdan]

@n1hility PTAL

[tdesaules]

Well I will do more tests because it look better since I update my WSL kernel and I stopped using Podman Desktop (I was doing a mix between the cli and the gui)