What OS is this based on?

[emacsen]

There's a bit missing from these examples on my system, Ubuntu.

Firstly, I had to install podman (seems obvious) but also systemd-container for machinectl.

Next, I wonder if useradd is different in Fedora perhaps, because running it as shown doesn't create a home directory for the new user unless you specify -m.

adduser does create the home directory by default but then you need to coax it not to ask for a password, etc.

Also, relatedly, while we need a shell to execute with machinectl, does linger require it? Could we possibly set the shell to /sbin/nologin or /bin/false as we might do with system accounts?

[eriksjolund]

I ran the examples with Fedora CoreOS, which is just a variant of Fedora.
I think Podman probably has best support on Fedora since it's used by most
of the Podman developers. Usually a new Podman release
is available in the Fedora official package repository within a few weeks.

Creating a new account with useradd is more or less optional. I think it's good practice
to use a separate account when trying out something new.

Next, I wonder if useradd is different in Fedora perhaps, because running it as shown doesn't create a home directory for the new user unless you specify -m.

Yes, I think useradd in Fedora and Ubuntu might differ a bit. Often Fedora has newer software versions than Ubuntu.

Also, relatedly, while we need a shell to execute with machinectl, does linger require it?

I don't think linger requires machinectl.
Using machinectl is optional. You could also log in with a text terminal or with ssh (if you have sshd running)

Is your question about whether it's possible to not have a shell installed?
In general I don't think a quadlet or a systemd service require a shell to be installed but I'm not sure. It's an interesting question. My guess is that it should be possible to set everything up in the filesystem and have systemd start the services automatically without having a shell installed.

Could we possibly set the shell to /sbin/nologin or /bin/false as we might do with system accounts?
Yes, I think it should be possible.

An extra tip:
On Fedora there is the useradd option -F (i.e., --add-subids-for-system) that is useful when creating a system account:

useradd -F -r -s /usr/sbin/nologin -m -d /home/myuser myuser

I discovered that option here:
containers/podman#17610 (comment)

[emacsen]

It seems the useradd may just be different between the systems, rather than newer. I don't need to add explicit command line support for subuid/subgid, as this appears to be taken care for me by default.

I am suggesting that you mention your OS in this guide, and or mention the Debian/Ubuntu commands to do the same.

You may also want to add an example5 which uses Caddy's automatic https (https://caddyserver.com/docs/automatic-https)

One question that I have as a new Podman user is whether or not there's an easy way to replicate the functionality of caddy-docker-proxy ( https://github.com/lucaslorentz/caddy-docker-proxy ) which may or may not offer this already, but I'm very unsure if this can work with podman based on this (lucaslorentz/caddy-docker-proxy#426 ).

If it does, it seems like a good next step, though I have some other questions for example as well, such as using pods, and then if there are ways to use init containers, or sidecars, etc. as you might with Kubernetes.

[eriksjolund]

I am suggesting that you mention your OS in this guide, and or mention the Debian/Ubuntu commands to do the same.

Good idea, info about requirements (OS and podman version) would be useul. I'll do that later.

You may also want to add an example5 which uses Caddy's automatic https (https://caddyserver.com/docs/automatic-https)

Isn't automatic https already used in example3 and example4 ?

https://github.com/eriksjolund/podman-caddy-socket-activation/blob/main/examples/example3/Caddyfile
https://github.com/eriksjolund/podman-caddy-socket-activation/blob/main/examples/example4/Caddyfile

One question that I have as a new Podman user is whether or not there's an easy way to
replicate the functionality of caddy-docker-proxy ( https://github.com/lucaslorentz/caddy-docker-proxy )
which may or may not offer this already, but I'm very unsure if this can work with
podman based on this (lucaslorentz/caddy-docker-proxy#426 ).

That's interesting functionality.
It looks like https://github.com/lucaslorentz/caddy-docker-proxy makes use of reloading the Caddy configuration
which does not work right now.

I added a note about reloading the caddy configuration here:

• Caddy reload does not work. Mention caddy issue 6631. #33

If it does, it seems like a good next step, though I have some other questions for example as well, such as using pods, and then if there are ways to use init containers, or sidecars, etc. as you might with Kubernetes.

Feel free to open discussion threads here
https://github.com/eriksjolund/podman-caddy-socket-activation/discussions

Disclaimer: currently I don't have a good understanding of how pods can be used together with custom networks. That's an area I would like to explore.

For more general podman questions there is also
https://github.com/containers/podman/discussions
where core Podman developers hang around.

[VinzNL]

I don't think linger requires machinectl. Using machinectl is optional. You could also log in with a text terminal or with ssh (if you have sshd running)

Confirming linger works fine without machinectl installed.

However, machinectl is one of the easiest ways to get a full login shell with things like D-Bus working (which systemd needs), which sudo and friends don't do. The other methods you mention also have the desired result.