x

os/FreeBSD/Podman.md

@@ -0,0 +1,103 @@
+# Podman
+
+Podman! On FreeBSD!
+
+# Install
+
+```sh
+pkg install podman-suite
+```
+
+or 
+
+Repeat the messages:
+
+```sh
+pkg info -D containers-common podman podman-suite
+```
+
+Follow the instructions for creating the zfs mount point, enabling podman and Linux.
+
+Then PF:
+
+```sh
+cp /usr/local/etc/containers/pf.conf.sample /etc/pf.conf
+```
+
+Edit it. I added my own rules too:
+
+```pf
+v4egress_if = "em0"
+v6egress_if = "em0"
+
+nat on $v4egress_if inet from <cni-nat> to any -> ($v4egress_if)
+nat on $v6egress_if inet6 from <cni-nat> to !ff00::/8 -> ($v6egress_if)
+
+rdr-anchor "cni-rdr/*"
+nat-anchor "cni-rdr/*"
+table <cni-nat>
+
+# My rules
+block in all
+
+ext_if="em0"
+
+pass in on $ext_if proto tcp to ($ext_if) port 22
+pass in on $ext_if proto tcp to ($ext_if) port 80
+pass in on $ext_if proto tcp to ($ext_if) port 443
+
+tailscale_if="tailscale0"
+pass in on $tailscale_if proto tcp to any port 22
+
+pass out all keep state
+```
+
+# Run
+
+Run a Freebsd container:
+
+```sh
+podman run --rm quay.io/dougrabson/hello
+```
+
+Run a Linux container. Note that when you want to run something from docker you qualify it with `docker.io`
+
+```sh
+podman run --rm --os=linux docker.io/alpine cat /etc/os-release | head -1
+```
+
+# Networking
+
+If you run a container, it will use the default network podman which has a subnet of `10.88.0.0/16`, for example:
+
+```sh
+podman run --rm --os=linux docker.io/httpd
+```
+
+Will give you
+
+```
+AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.88.0.8. Set the 'ServerName' directive globally to suppress this message
+```
+
+This message actually comes from the Apache Web Server, so that's useful. You can only access it from the same machine though:
+
+```sh
+curl 10.88.0.8
+```
+
+If you want to expose it externally, like we do on our Linux box, you need to attach it to the host network:
+
+```sh
+podman run --rm --os=linux --network=host docker.io/httpd
+```
+
+Then Apache complains:
+
+```
+AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1. Set the 'ServerName' directive globally to suppress this message
+```
+
+I can now access the website on the host machine:
+
+* http://192.168.1.10/