Skip to content

example1

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

example1

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
README.md
README.md
 
 
http.socket
http.socket
 
 
https.socket
https.socket
 
 
mynet.network
mynet.network
 
 
traefik.container
traefik.container
 
 
whoami.container
whoami.container
 
 

README.md

return to main page

Example 1

graph TB

    a1[curl] -.->a2[traefik container reverse proxy]
    a2 -->|"for http://whoami.example.com"| a3["whoami container"]
Loading

Set up a systemd user service example1.service for the user test where rootless podman is running the container image localhost/traefik. Configure socket activation for TCP ports 80 and 443.

Requirements:

  • podman 4.4.0 or later (needed for using quadlets). Not strictly needed for this example but podman 5.3.0 or later is recommended because then AddHost=postgres.example.com:host-gateway, host.containers.internal or host.docker.internal could be used to let a container on the custom network connect to a service that is listening on the host's main network interface. For details, see Outbound TCP/UDP connections to the host's main network interface (e.g eth0)

  • ip_unprivileged_port_start ≤ 80

    Verify that ip_unprivileged_port_start is less than or equal to 80

    $ cat /proc/sys/net/ipv4/ip_unprivileged_port_start
80

  1. Create a test user

    sudo useradd test

  2. Open a shell for user test

    sudo machinectl shell --uid=test

  3. Optional step: enable lingering to avoid services from being stopped when the user test logs out.

    loginctl enable-linger test

  4. Create directories

    mkdir -p ~/.config/systemd/user
mkdir -p ~/.config/containers/systemd

  5. Pull the traefik container image

    podman pull docker.io/library/traefik

  6. Pull the whoami container image

    podman pull docker.io/traefik/whoami

  7. Clone git repo

    git clone https://github.com/eriksjolund/podman-traefik-socket-activation.git

  8. Install the container unit files

    cp podman-traefik-socket-activation/examples/example1/*.container \
   ~/.config/containers/systemd/

  9. Install the network unit file

    cp podman-traefik-socket-activation/examples/example1/mynet.network \
   ~/.config/containers/systemd/

  10. Install the socket unit files

    cp podman-traefik-socket-activation/examples/example1/*.socket \
   ~/.config/systemd/user/

  11. Reload the systemd user manager

    systemctl --user daemon-reload

    This triggers systemd to execute the generator /usr/lib/systemd/user-generators/podman-user-generator that will generate systemd user service unit files out of the quadlet files (that is the files having filenames ending with .container, .volume and .network). The generated files are written to the directory /run/user/<USERID>/systemd/generator. For details, see podman-systemd.unit(5) and systemd.generator(7).

  12. Start the podman socket. (The path to the unix socket is $XDG_RUNTIME_DIR/podman/podman.sock which would for example expand to /run/user/1003/podman/podman.sock if the UID of the user test is 1003)

    systemctl --user start podman.socket

  13. Start the socket for TCP port 80

    systemctl --user start http.socket

  14. Start the socket for TCP port 443

    systemctl --user start https.socket

  15. Start the whoami container

    systemctl --user start whoami.service

  16. Start the traefik container

    systemctl --user start traefik.service

    This step was added due to traefik issue 7347.

  17. Wait a few seconds

    sleep 3

    This is also related to traefik issue 7347. Traefik sends READY=1 before traefik is ready.

  18. Download a web page http://whoami.example.com from the traefik container and see that the request is proxied to the container whoami. Resolve whoami.example.com to 127.0.0.1.

    $ curl -s --resolve whoami.example.com:80:127.0.0.1 http://whoami.example.com:80
Hostname: 0315603f400d
IP: 127.0.0.1
IP: ::1
IP: 10.89.0.2
IP: fe80::18fe:c3ff:fe9e:d8ee
RemoteAddr: 10.89.0.3:37168
GET / HTTP/1.1
Host: whoami.example.com
User-Agent: curl/8.6.0
Accept: */*
Accept-Encoding: gzip
X-Forwarded-For: 127.0.0.1
X-Forwarded-Host: whoami.example.com
X-Forwarded-Port: 80
X-Forwarded-Proto: http
X-Forwarded-Server: 046d07b93fc9
X-Real-Ip: 127.0.0.1

    result: The IPv4 address 127.0.0.1 matches the IP address of X-Forwarded-For and X-Real-Ip

  19. Check the IPv4 address of the main network interface. Run the command

    hostname -I

    The following output is printed

    192.168.10.108 192.168.39.1 192.168.122.1 fd25:c7f8:948a:0:912d:3900:d5c4:45ad

    result: The IPv4 address of the main network interface is 192.168.10.108 (the address furthest to the left)

  20. Download a web page http://whoami.example.com from the traefik container and see that the request is proxied to the container whoami. Resolve whoami.example.com to the IP address of the main network interface. Run the command

    curl --resolve whoami.example.com:80:192.168.10.108 http://whoami.example.com

    The following output is printed

    Hostname: 0315603f400d
IP: 127.0.0.1
IP: ::1
IP: 10.89.0.2
IP: fe80::18fe:c3ff:fe9e:d8ee
RemoteAddr: 10.89.0.3:37168
GET / HTTP/1.1
Host: whoami.example.com
User-Agent: curl/8.6.0
Accept: */*
Accept-Encoding: gzip
X-Forwarded-For: 192.168.10.108
X-Forwarded-Host: whoami.example.com
X-Forwarded-Port: 80
X-Forwarded-Proto: http
X-Forwarded-Server: 046d07b93fc9
X-Real-Ip: 192.168.10.108

    result: The IPv4 address of the main network interface, 192.168.10.108, matches the IPv4 address of X-Forwarded-For and X-Real-Ip

  21. From another computer download a web page http://whoami.example.com from the traefik container and see that the request is proxied to the container whoami.

    curl --resolve whoami.example.com:80:192.168.10.108 http://whoami.example.com

    The following output is printed

    Hostname: 0315603f400d
IP: 127.0.0.1
IP: ::1
IP: 10.89.0.2
IP: fe80::18fe:c3ff:fe9e:d8ee
RemoteAddr: 10.89.0.3:42586
GET / HTTP/1.1
Host: whoami.example.com
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
X-Forwarded-For: 192.168.10.161
X-Forwarded-Host: whoami.example.com
X-Forwarded-Port: 80
X-Forwarded-Proto: http
X-Forwarded-Server: 046d07b93fc9
X-Real-Ip: 192.168.10.161

    Check the IP address of the other computer (which in this example runs macOS). In the macOS terminal run the command

    ipconfig getifaddr en0

    The following output is printed

    192.168.10.161

    result: The IPv4 address of the other computer matches the IPv4 address of X-Forwarded-For and X-Real-Ip

    troubleshooting tip: If the curl command fails with Connection timed out or Connection refused, then there is probably a firewall blocking the connection. How to open up the firewall is beyond the scope of this tutorial.

Using Internal=true

The file mynet.network currently contains

[Network]
Options=isolate=strict
Internal=true

The line

Internal=true

prevents containers on the network to connect to the internet. To allow Containers on the network to download files from the internet you would need to remove the line.