search

containers / podman

Podman: A tool for managing OCI containers and pods.
https://podman.io
Apache License 2.0
22.37k stars 2.31k forks source link

[Quadlet] [rootless] dependencies not working #23077

Closed podhorsky-ksj closed 1 week ago

podhorsky-ksj commented 1 week ago

Issue Description

It seems quadlet don't care about dependencies during boot. Here is the quadlet file:

[Unit]
Description=Aria
Wants=network-online.target
After=network-online.target

[Container]
ContainerName=aria
AutoUpdate=local
Image=aria-ksj
UserNS=keep-id:uid=0,gid=0
Volume=%h/data:/data:Z
Exec=aria2c --conf-path=/aria.conf --on-download-complete=/ariahook.bash
PublishPort=6800:6800

[Service]
RestartSec=5
ExecStartPre=sh -c 'podman build --pull -t aria-ksj:latest -f %h/.config/containers/systemd/aria %h/.config/containers/systemd/ && podman image prune -f'
Restart=always

[Install]
WantedBy=default.target

And there are logs:

Jun 23 18:19:50 server-ksj systemd[895]: Starting Aria...
network-online.target - Network is Online
     Loaded: loaded (/usr/lib/systemd/system/network-online.target; static)
     Active: active since Sun 2024-06-23 18:19:54 CEST; 1h 18min ago

Steps to reproduce the issue

Steps to reproduce the issue

  1. add quadlet file to normal location for quadlet rootless files
  2. reboot

Describe the results you received

Service from quadlet starts before network is established and it failed on execstartpre step - this needs network

Describe the results you expected

service run after the network is established. I have the same issue with timer. I would like the quadlet service to run after this.

podman info output

host:
  arch: amd64
  buildahVersion: 1.36.0
  cgroupControllers:
  - cpu
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: /usr/bin/conmon is owned by conmon 1:2.1.12-1
    path: /usr/bin/conmon
    version: 'conmon version 2.1.12, commit: e8896631295ccb0bfdda4284f1751be19b483264'
  cpuUtilization:
    idlePercent: 89.85
    systemPercent: 1.35
    userPercent: 8.8
  cpus: 4
  databaseBackend: sqlite
  distribution:
    distribution: arch
    version: unknown
  eventLogger: journald
  freeLocks: 2047
  hostname: server-ksj
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 970
      size: 1
    - container_id: 1
      host_id: 10000
      size: 55537
    uidmap:
    - container_id: 0
      host_id: 970
      size: 1
    - container_id: 1
      host_id: 10000
      size: 55537
  kernel: 6.9.6-arch1-1
  linkmode: dynamic
  logDriver: journald
  memFree: 270630912
  memTotal: 8236285952
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: /usr/lib/podman/aardvark-dns is owned by aardvark-dns 1.11.0-1
      path: /usr/lib/podman/aardvark-dns
      version: aardvark-dns 1.11.0
    package: /usr/lib/podman/netavark is owned by netavark 1.11.0-2
    path: /usr/lib/podman/netavark
    version: netavark 1.11.0
  ociRuntime:
    name: crun
    package: /usr/bin/crun is owned by crun 1.15-1
    path: /usr/bin/crun
    version: |-
      crun version 1.15
      commit: e6eacaf4034e84185fd8780ac9262bbf57082278
      rundir: /run/user/970/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: /usr/bin/pasta is owned by passt 2024_06_07.8a83b53-1
    version: |
      pasta 2024_06_07.8a83b53
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/970/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /etc/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: /usr/bin/slirp4netns is owned by slirp4netns 1.3.1-1
    version: |-
      slirp4netns version 1.3.1
      commit: e5e368c4f5db6ae75c2fce786e31eef9da6bf236
      libslirp: 4.8.0
      SLIRP_CONFIG_VERSION_MAX: 5
      libseccomp: 2.5.5
  swapFree: 4026527744
  swapTotal: 4294963200
  uptime: 1h 24m 47.00s (Approximately 0.04 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  docker.io:
    Blocked: false
    Insecure: true
    Location: docker.io
    MirrorByDigestOnly: false
    Mirrors: []
    Prefix: docker.io
    PullFromMirror: ""
  ghcr.io:
    Blocked: false
    Insecure: true
    Location: ghcr.io
    MirrorByDigestOnly: false
    Mirrors: []
    Prefix: ghcr.io
    PullFromMirror: ""
  registry.access.redhat.com:
    Blocked: false
    Insecure: true
    Location: registry.access.redhat.com
    MirrorByDigestOnly: false
    Mirrors: []
    Prefix: registry.access.redhat.com
    PullFromMirror: ""
  registry.redhat.io:
    Blocked: false
    Insecure: true
    Location: registry.redhat.io
    MirrorByDigestOnly: false
    Mirrors: []
    Prefix: registry.redhat.io
    PullFromMirror: ""
store:
  configFile: /home/jellyfin/.config/containers/storage.conf
  containerStore:
    number: 1
    paused: 0
    running: 1
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/jellyfin/.local/share/containers/storage
  graphRootAllocated: 240056360960
  graphRootUsed: 65666342912
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 7
  runRoot: /run/user/970/containers
  transientStore: false
  volumePath: /home/jellyfin/.local/share/containers/storage/volumes
version:
  APIVersion: 5.1.1
  Built: 1717539130
  BuiltTime: Wed Jun  5 00:12:10 2024
  GitCommit: bda6eb03dcbcf12a5b7ae004c1240e38dd056d24-dirty
  GoVersion: go1.22.3
  Os: linux
  OsArch: linux/amd64
  Version: 5.1.1

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

Yes

Additional environment details

archlinux latest bare methal

Additional information

Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting

Luap99 commented 1 week ago

This is not a quadlet issue, it creates the unit file with the dependencies. Systemd however cannot handle dependencies on system units from the user session, see https://github.com/systemd/systemd/issues/3312 and https://github.com/containers/podman/issues/22197

podhorsky-ksj commented 1 week ago

I tried different approach, but I have still issue with quadlet file. It starts on boot. I used the network-online example from https://github.com/systemd/systemd/issues/3312, used wants, required i BindsTo between services, but still there is at least one failed service after boot. It will try it again, when there is restart, but this is wrong approach. I think it is because first time it starts after default.target is up regardless of dependencies - caused by enabled directive, which I don't know how to remove. If I remove [install] part, it doesn't start at all.

When I tried BindsTo with after like it is here: https://www.reddit.com/r/podman/comments/13sdjtm/quadlet_not_obeying_requires_unit_entry_and/ service will fail on dependency and don't even try to restart itself, even network_online is up.

I would like my containers start once the previous is started. E.g. first network-online, then postgres, then forgejo or else. But always some of them fail after boot.