Podman ansible role

2024-11-08 - The ansible role I use to manage my podman containers
Tags: ansible podman

Introduction

Before succumbing to nixos, I had was running all my containers on k3s. This time I am migrating things to podman and trying to achieve a lighter setup. This article presents the ansible role I wrote to manage podman containers.

The role

Tasks

The main tasks file setups podman and the required network configurations with:

---
- name: 'Run OS specific tasks for the podman role'
  include_tasks: '{{ ansible_distribution }}.yaml'

- name: 'Make podman scripts directory'
  file:
    path: '/etc/podman'
    mode: '0700'
    owner: 'root'
    state: 'directory'

- name: 'Deploy podman configuration files'
  copy:
    src: 'cni-podman0'
    dest: '/etc/network/interfaces.d/'
    owner: 'root'
    mode: '444'

My OS specific task file Debian.yaml looks like this:

---
- name: 'Install podman dependencies'
  ansible.builtin.apt:
    name:
      - 'buildah'
      - 'podman'
      - 'rootlesskit'
      - 'slirp4netns'

- name: 'Deploy podman configuration files'
  copy:
    src: 'podman-bridge.json'
    dest: '/etc/cni/net.d/87-podman-bridge.conflist'
    owner: 'root'
    mode: '444'

The entrypoint tasks for this role is the container.yaml task file:

---
# Inputs:
#   container:
#     cmd: optional(list(string))
#     env_vars: list(env_var)
#     image: string
#     name: string
#     publishs: list(publish)
#     volumes: list(volume)
# With:
#   env_var:
#     name: string
#     value: string
#   publish:
#     container_port: string
#     host_port: string
#     ip: string
#   volume:
#     dest: string
#     src: string

- name: 'Deploy podman systemd service for {{ container.name }}'
  template:
    src: 'container.service'
    dest: '/etc/systemd/system/podman-{{ container.name }}.service'
    owner: 'root'
    mode: '0444'
  notify: 'systemctl daemon-reload'

- name: 'Deploy podman scripts for {{ container.name }}'
  template:
    src: 'container-{{ item }}.sh'
    dest: '/etc/podman/{{ container.name }}-{{ item }}.sh'
    owner: 'root'
    mode: '0500'
  register: 'deploy_podman_scripts'
  loop:
    - 'start'
    - 'stop'

- name: 'Restart podman container {{ container.name }}'
  shell:
    cmd: "systemctl restart podman-{{ container.name }}"
  when: 'deploy_podman_scripts.changed'

- name: 'Start podman container {{ container.name }} and activate it on boot'
  service:
    name: 'podman-{{ container.name }}'
    enabled: true
    state: 'started'

Handlers

There is a single main.yaml handler:

---
- name: 'systemctl daemon-reload'
  shell:
    cmd: 'systemctl daemon-reload'

Files

Here is the cni-podman0 I deploy on Debian hosts. It is required for the bridge to be up on boot so that other services can bind ports on it. Without this, the bridge would only come up when the first container starts which is too late in the boot process.

###############################################################################
#     \_o<     WARNING : This file is being managed by ansible!      >o_/     #
#     ~~~~                                                           ~~~~     #
###############################################################################

auto cni-podman0
iface cni-podman0 inet static
address 10.88.0.1/16
pre-up brctl addbr cni-podman0
post-down brctl delbr cni-podman0

Here is the JSON cni bridge configuration file I use, customized to add IPv6 support:

{
  "cniVersion": "0.4.0",
  "name": "podman",
  "plugins": [
    {
      "type": "bridge",
      "bridge": "cni-podman0",
      "isGateway": true,
      "ipMasq": true,
      "hairpinMode": true,
      "ipam": {
        "type": "host-local",
        "routes": [
          {
            "dst": "0.0.0.0/0"
          }, {
            "dst": "::/0"
          }
        ],
        "ranges": [
          [{
            "subnet": "10.88.0.0/16",
            "gateway": "10.88.0.1"
          }], [{
            "subnet": "fd42::/48",
            "gateway": "fd42::1"
          }]
        ]
      }
    }, {
      "type": "portmap",
      "capabilities": {
        "portMappings": true
      }
    }, {
      "type": "firewall"
    }, {
      "type": "tuning"
    }
  ]
}

Templates

Here is the jinja templated start bash script:

#!/usr/bin/env bash
###############################################################################
#     \_o<     WARNING : This file is being managed by ansible!      >o_/     #
#     ~~~~                                                           ~~~~     #
###############################################################################
set -euo pipefail

podman rm -f {{ container.name }} || true
rm -f /run/podman-{{ container.name }}.ctr-id

exec podman run \
  --rm \
  --name={{ container.name }} \
  --log-driver=journald \
  --cidfile=/run/podman-{{ container.name }}.ctr-id \
  --cgroups=no-conmon \
  --sdnotify=conmon \
  -d \
{% for env_var in container.env_vars | default([]) %}
  -e {{ env_var.name }}={{ env_var.value }} \
{% endfor %}
{% for publish in container.publishs | default([]) %}
  -p {{ publish.ip }}:{{ publish.host_port }}:{{ publish.container_port }} \
{% endfor %}
{% for volume in container.volumes | default([]) %}
  -v {{ volume.src }}:{{ volume.dest }} \
{% endfor %}
  {{ container.image }} {% for cmd in container.cmd | default([]) %}{{ cmd }} {% endfor %}

Here is the jinja templated stop bash script:

#!/usr/bin/env bash
###############################################################################
#     \_o<     WARNING : This file is being managed by ansible!      >o_/     #
#     ~~~~                                                           ~~~~     #
###############################################################################
set -euo pipefail

if [[ ! "$SERVICE_RESULT" = success ]]; then
    podman stop --ignore --cidfile=/run/podman-{{ container.name }}.ctr-id
fi

podman rm -f --ignore --cidfile=/run/podman-{{ container.name }}.ctr-id

Here is the jinja templated systemd unit service:

###############################################################################
#     \_o<     WARNING : This file is being managed by ansible!      >o_/     #
#     ~~~~                                                           ~~~~     #
###############################################################################

[Unit]
After=network-online.target
Description=Podman container {{ container.name }}

[Service]
ExecStart=/etc/podman/{{ container.name }}-start.sh
ExecStop=/etc/podman/{{ container.name }}-stop.sh
NotifyAccess=all
Restart=always
TimeoutStartSec=0
TimeoutStopSec=120
Type=notify

[Install]
WantedBy=multi-user.target

Usage example

I do not call the role from a playbook, I prefer running the setup from an application’s role that relies on podman using a meta/main.yaml containing something like:

---
dependencies:
  - role: 'borg'
  - role: 'nginx'
  - role: 'podman'

Then from a tasks file:

- include_role:
    name: 'podman'
    tasks_from: 'container'
  vars:
    container:
      cmd: ['--config-path', '/srv/cfg/conf.php']
      name: 'privatebin'
      env_vars:
        - name: 'PHP_TZ'
          value: 'Europe/Paris'
        - name: 'TZ'
          value: 'Europe/Paris'
      image: 'docker.io/privatebin/nginx-fpm-alpine:1.7.4'
      publishs:
        - container_port: '8080'
          host_port: '8082'
          ip: '127.0.0.1'
      volumes:
        - dest: '/srv/cfg/conf.php:ro'
          src: '/etc/privatebin.conf.php'
        - dest: '/srv/data'
          src: '/srv/privatebin'

Conclusion

I enjoy this design, it works really well. I am missing a task for deprovisioning a container but I have not needed it yet.