Sock in podman in podman

[podhorsky-ksj]

I would like to run forgejo runner safely. It needs socket for running containers, but I don't want to give him host podman socket
I know there is possibility to run podman inside podman like this:

podman run --user podman --device /dev/fuse quay.io/podman/stable podman run alpine echo hello

I tried to create socket in podman, so I can redirect it to second container, but

podman system service -t 0 &

doesn't seem to create a socket

Second choice would be something like docker-in-docker mentioned here, https://forgejo.org/docs/v8.0/admin/runner-installation/
which creates separate container. But it doesn't seems to working in podman.

Before this, I had containers separated by users accounts in host, but I would like to use selinux, which separates the containers, but I don't know how to make safe the podman socket with selinux. I don't think it is possible.

[nalind]

Try adding --log-level=info, i.e., running podman --log-level=info system service -t 1 in the foreground, at least once, to double-check if it's creating a socket, and if so, where.

[podhorsky-ksj]

it is creating, but then it is shut down by something:

[podman@08f02980624d /]$ podman --log-level=info  system service -t 1
INFO[0000] podman filtering at log level info           
INFO[0000] Using sqlite as database backend             
INFO[0000] Setting parallel job count to 37             
INFO[0000] podman filtering at log level info           
INFO[0000] Using sqlite as database backend             
INFO[0000] Setting parallel job count to 37             
INFO[0000] API service listening on "/tmp/storage-run-1000/podman/podman.sock". URI: "unix:///tmp/storage-run-1000/podman/podman.sock" 
INFO[0001] Received shutdown.Stop(), terminating!        PID=174

[nalind]

Well, yes, I suggested -t 1 to have it time out after 1 second, since this was a diagnostic run.

[podhorsky-ksj]

ok, i will try it with -t 0 and find if it helped. Thanks.

[podhorsky-ksj]

It looks like it is working. Thanks.