Podman, Buildah, Crun, Cgroupv2 Manjaro Linux

Posted on December 03, 2020

Manjaro linux by default membawa cgroup v1 dan v2, tapi yang diaktifkan adalah cgroup v1. Ketika hendak belajar tentang podman, buildah, dan crun maka kita perlu mengatifkan cgroupv2. Mengaktifkan cgroupv2 di Manjaro Linux ini mudah, semudah membalik telapak tangan.

Untuk mengaktifkan cgroupv2 di Manjaro Linux, pertama edit parameter kernel

sudo nano /etc/default/grub

cari line GRUB_CMDLINE_LINUX_DEFAULT=, kemudian tambahkan parameter cgroup_no_v1=all

Hasil akhirnya kira-kira begini

GRUB_DEFAULT=saved
GRUB_TIMEOUT=3
GRUB_TIMEOUT_STYLE=menu
GRUB_DISTRIBUTOR="Manjaro"
GRUB_CMDLINE_LINUX_DEFAULT="apparmor=1 security=apparmor resume=UUID=587103ec-55a5-4f4d-9c9d-53c191644c67 udev.log_priority=3 mitigations=off cgroup_no_v1=all"

<redacted krn kepanjangan>

Kemudian, update grub dan reboot manjaro

sudo update-grub
systemctl reboot

Sekarang, Manjaro Linux sudah pakai cgroupv2. Selanjutnya, aku akan memasang podman, buildah, dan crun

sudo pacman -S buildah podman crun fuse-overlayfs

Kemudian, untuk run unprivileged container kita harus set subuid dan subguid untuk user dan group kita

echo "$(whoami):100000:65536" | sudo tee -a /etc/subuid
echo "$(whoami):100000:65536" | sudo tee -a /etc/subgid

Reboot Manjaro Linux

systemctl reboot

Terakhir apakah podman sudah pakai cgroupv2

podman info --debug     

#output
host:
  arch: amd64
  buildahVersion: 1.16.1
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: Unknown
    path: /usr/bin/conmon
    version: 'conmon version 2.0.21, commit: 35a2fa83022e56e18af7e6a865ba5d7165fa2a4a'
  cpus: 4
  distribution:
    distribution: manjaro
    version: unknown
  eventLogger: journald
  hostname: x240
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536

<redated krn panjang>

Selanjutnya, kita harus set image registry yg akan dipakai oleh buildah, krn defaultnya kosong dan menyebabkan buildah tidak bisa pull image

sudo nano /etc/containers/registries.conf

Tambahkan

[registries.search]
registries = ['docker.io', 'registry.fedoraproject.org', 'quay.io', 'registry.access.redhat.com', 'registry.centos.org']

Tes buildah pull image

buildah pull nginx:alpine

# output
Completed short name "nginx" with unqualified-search registries (origin: /etc/containers/registries.conf)
Getting image source signatures
Copying blob 188c0c94c7c5 skipped: already exists  
Copying blob af69a9b963c8 done  
Copying blob 7d856acdaa9c done  
Copying blob a0d3c6e28e6d done  
Copying blob 617561f33ec6 done  
Copying config 98ab35023f done  
Writing manifest to image destination
Storing signatures
98ab35023fd67311434b73434d860138a203ab5851fcc9a7161510d5c43fc755

Tes podman run image

podman run -p 1992:80 nginx:alpine

# output
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Configuration complete; ready for start up

Sekian, dan terima gaji.