较新的工具链为podman跑容器，buildah构建镜像，skopeo传输管理镜像。
podman是一个容器引擎，某些方面上对docker进行了改进并可替代其一部分功能，本篇博客基本上是抄了一遍官网安装步骤，列举了遇到的几个坑，想用podman搭一个k3s但是失败了。
podman官网为podman.io
podman官网
可见其自我介绍
Podman is a daemonless container engine for developing, managing, and running OCI Containers on your Linux System. Containers can either be run as root or in rootless mode. Simply put:
alias docker=podman.
相比于docker，podman没有守护进程，大部分命令无需root，且podman的命令兼容docker的。
安装过程
参考官网安装说明即可。我用的是ubuntu 19.04，关键步骤如下：
sudo apt-get update -qq
sudo apt-get install -qq -y software-properties-common uidmap
sudo add-apt-repository -y ppa:projectatomic/ppa
sudo apt-get update -qq
sudo apt-get -qq -y install podman
其他发行版看对应段落即可
可简单测试一下
$ podman -v
podman version 1.6.2
$ podman info
host:
BuildahVersion: 1.11.3
CgroupVersion: v1
Conmon:
package: 'conmon: /usr/libexec/podman/conmon'
path: /usr/libexec/podman/conmon
version: 'conmon version 2.0.2, commit: unknown'
Distribution:
distribution: ubuntu
version: "19.04"
IDMappings:
gidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 100000
size: 65536
uidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 100000
size: 65536
MemFree: 398770176
MemTotal: 3991453696
OCIRuntime:
name: runc
package: 'cri-o-runc: /usr/lib/cri-o-runc/sbin/runc'
path: /usr/lib/cri-o-runc/sbin/runc
version: 'runc version spec: 1.0.1-dev'
SwapFree: 8190685184
SwapTotal: 8191471616
arch: amd64
cpus: 4
eventlogger: journald
hostname: dk-Aspire-5943G
kernel: 5.0.0-32-generic
os: linux
rootless: true
slirp4netns:
Executable: /usr/bin/slirp4netns
Package: 'slirp4netns: /usr/bin/slirp4netns'
Version: |-
slirp4netns version 0.4.2
commit: unknown
uptime: 3h 11m 43.34s (Approximately 0.12 days)
registries:
blocked: null
insecure: null
search: null
store:
ConfigFile: /home/dk/.config/containers/storage.conf
ContainerStore:
number: 0
GraphDriverName: vfs
GraphOptions: {}
GraphRoot: /home/dk/.local/share/containers/storage
GraphStatus: {}
ImageStore:
number: 0
RunRoot: /run/user/1000
VolumePath: /home/dk/.local/share/containers/storage/volumes
$ podman --help
manage pods and images
Usage:
podman [flags]
podman [command]
Available Commands:
attach Attach to a running container
build Build an image using instructions from Containerfiles
commit Create new image based on the changed container
container Manage Containers
cp Copy files/folders between a container and the local filesystem
create Create but do not start a container
diff Inspect changes on container's file systems
events Show podman events
exec Run a process in a running container
export Export container's filesystem contents as a tar archive
generate Generated structured data
healthcheck Manage Healthcheck
help Help about any command
history Show history of a specified image
image Manage images
images List images in local storage
import Import a tarball to create a filesystem image
info Display podman system information
init Initialize one or more containers
inspect Display the configuration of a container or image
kill Kill one or more running containers with a specific signal
load Load an image from container archive
login Login to a container registry
logout Logout of a container registry
logs Fetch the logs of a container
mount Mount a working container's root filesystem
network Manage Networks
pause Pause all the processes in one or more containers
play Play a pod
pod Manage pods
port List port mappings or a specific mapping for the container
ps List containers
pull Pull an image from a registry
push Push an image to a specified destination
restart Restart one or more containers
rm Remove one or more containers
rmi Removes one or more images from local storage
run Run a command in a new container
save Save image to an archive
search Search registry for image
start Start one or more containers
stats Display a live stream of container resource usage statistics
stop Stop one or more containers
system Manage podman
tag Add an additional name to a local image
top Display the running processes of a container
umount Unmounts working container's root filesystem
unpause Unpause the processes in one or more containers
unshare Run a command in a modified user namespace
varlink Run varlink interface
version Display the Podman Version Information
volume Manage volumes
wait Block on one or more containers
Flags:
--cgroup-manager string Cgroup manager is not supported in rootless mode
--cni-config-dir string Path of the configuration directory for CNI networks
--config string Path of a libpod config file detailing container server configuration options
--conmon string Path of the conmon binary
--cpu-profile string Path for the cpu profiling results
--events-backend string Events backend to use
--help Help for podman
--hooks-dir strings Set the OCI hooks directory path (may be set multiple times)
--log-level string Log messages above specified level: debug, info, warn, error, fatal or panic (default "error")
--namespace string Set the libpod namespace, used to create separate views of the containers and pods on the system
--network-cmd-path string Path to the command for configuring the network
--root string Path to the root directory in which data, including images, is stored
--runroot string Path to the 'run directory' where all state information is stored
--runtime string Path to the OCI-compatible binary used to run containers, default is /usr/bin/runc
--storage-driver string Select which storage driver is used to manage storage of images and containers (default is overlay)
--storage-opt stringArray Used to pass an option to the storage driver
--syslog Output logging information to syslog as well as the console
--tmpdir string Path to the tmp directory
--trace Enable opentracing output
-v, --version Version of podman
Use "podman [command] --help" for more information about a command.
由于podman的命令完全兼容docker的，可以设置别名：
$ alias docker=podman
$ alias
alias docker='podman'
（略）
效果为使用docker命令实际上用的是podman
配置registry
未见到podman像docker一样配置registry-mirrors，而是有两个配置文件/etc/containers/registries.d/default.yaml和~/.config/containers/registries.conf。
似乎有效的方式为在配置中加入如下内容：
unqualified-search-registries = ["docker.io"]
[[registry]]
prefix = "docker.io"
location = "uyah70su.mirror.aliyuncs.com"
踩坑
linux版本
截止2019年11月3日，ubuntu 19.10通过apt-get install安装podman还是失败，因为podman的repo中还没有对ubuntu 19.10 Eoan Ermine的支持
取消alias
使用unalias命令
$ unalias docker
$ alias
（略，列出所有别名，可见已无docker）
用podman组建k3s
无论是否有alias docker=podman都会失败，通过journalctl查看k3s日志：
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: time="2019-11-03T21:21:46.672574217+08:00" level=info msg="Starting /v1, Kind=Node controller"
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.688252 17941 controller.go:606] quota admission added evaluator for: helmcharts.helm.cattle.i
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: time="2019-11-03T21:21:46.759228465+08:00" level=info msg="module br_netfilter was already loaded"
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: time="2019-11-03T21:21:46.759377842+08:00" level=info msg="module overlay was already loaded"
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: time="2019-11-03T21:21:46.759416652+08:00" level=info msg="module nf_conntrack was already loaded"
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: time="2019-11-03T21:21:46.775672300+08:00" level=info msg="Connecting to proxy" url="wss://192.168.3.4:6443/v1
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: time="2019-11-03T21:21:46.780820880+08:00" level=info msg="Handling backend connection request [dk-aspire-5943
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: time="2019-11-03T21:21:46.787235575+08:00" level=info msg="Running kubelet --address=0.0.0.0 --anonymous-auth=
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: W1103 21:21:46.796500 17941 server.go:208] WARNING: all flags other than --config, --write-config-to, and --
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: time="2019-11-03T21:21:46.804874817+08:00" level=info msg="waiting for node dk-aspire-5943g: nodes \"dk-aspire
11月 03 21:21:46 dk-Aspire-5943G systemd[1]: Started Kubernetes systemd probe.
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.818296 17941 server.go:406] Version: v1.16.2-k3s.1
11月 03 21:21:46 dk-Aspire-5943G systemd[1]: run-r4dcf5ad5acdb40369bbf93c377580560.scope: Succeeded.
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: E1103 21:21:46.854039 17941 node.go:124] Failed to retrieve node info: nodes "dk-aspire-5943g" not found
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.866160 17941 server.go:637] --cgroups-per-qos enabled, but --cgroup-root was not specified.
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.866738 17941 container_manager_linux.go:272] container manager verified user specified cgroup
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.866765 17941 container_manager_linux.go:277] Creating Container Manager object based on Node
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.866910 17941 fake_topology_manager.go:29] [fake topologymanager] NewFakeManager
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.866924 17941 container_manager_linux.go:312] Creating device plugin manager: true
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.866956 17941 fake_topology_manager.go:39] [fake topologymanager] AddHintProvider HintProvider
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.867011 17941 state_mem.go:36] [cpumanager] initializing new in-memory state store
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.867156 17941 state_mem.go:84] [cpumanager] updated default cpuset: ""
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.867179 17941 state_mem.go:92] [cpumanager] updated cpuset assignments: "map[]"
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.867200 17941 fake_topology_manager.go:39] [fake topologymanager] AddHintProvider HintProvider
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.867475 17941 kubelet.go:312] Watching apiserver
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.871762 17941 client.go:75] Connecting to docker on unix:///var/run/docker.sock
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: I1103 21:21:46.872291 17941 client.go:104] Start docker client with request timeout=2m0s
11月 03 21:21:46 dk-Aspire-5943G k3s[17941]: F1103 21:21:46.872989 17941 server.go:267] failed to run Kubelet: failed to create kubelet: failed to get do
其中可见Connecting to docker on unix:///var/run/docker.sock，是通过sock而不是docker命令操作docker的