You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add example5 that is similar to example4 but the containers use `--network=none`
and communicate over a Unix socket.
Move references to main README.md
Signed-off-by: Erik Sjölund <[email protected]>
Copy file name to clipboardexpand all lines: README.md
+20-1
Original file line number
Diff line number
Diff line change
@@ -7,10 +7,11 @@ Overview of the examples
7
7
8
8
| Example | Type of service | Port | Using quadlet | rootful/rootless podman | Comment |
9
9
| -- | -- | -- | -- | -- | -- |
10
-
|[Example 1](examples/example1)| systemd user service | 8080 | yes | rootless podman ||
10
+
|[Example 1](examples/example1)| systemd user service | 8080 | yes | rootless podman |Only unprivileged port numbers can be used |
11
11
|[Example 2](examples/example2)| systemd system service | 80 | yes | rootful podman ||
12
12
|[Example 3](examples/example3)| systemd system service (with `User=test`) | 80 | no | rootless podman | Status: experimental |
13
13
|[Example 4](examples/example4)| systemd system service (with `User=test`) | 80 | no | rootless podman | Similar to Example 3 but configured to run as an HTTP reverse proxy. Status: experimental. |
14
+
|[Example 5](examples/example5)| systemd system service (with `User=test`) | 80 | no | rootless podman | Similar to Example 4 but the containers use `--network=none` and communicate over a Unix socket. Status: experimental. |
14
15
15
16
> **Note**
16
17
> nginx has no official support for systemd socket activation (feature request: https://trac.nginx.org/nginx/ticket/237). These examples makes use of the fact that "_nginx includes an undocumented, internal socket-passing mechanism_" quote from https://freedesktop.org/wiki/Software/systemd/DaemonSocketActivation/
@@ -100,3 +101,21 @@ The Podman network tools are not needed when using __--network=host__ or __--ne
100
101
(see GitHub [issue comment](https://github.com/containers/podman/discussions/16493#discussioncomment-4140832)).
101
102
In other words, the total amount of executables and libraries that are needed by Podman is reduced
102
103
when you run the nginx container with _socket activation_ and __--network=none__.
104
+
105
+
### References
106
+
107
+
__Reference 1:__
108
+
109
+
The github project [PhracturedBlue/podman-socket-activated-services](https://github.com/PhracturedBlue/podman-socket-activated-services) contains an [example](https://github.com/PhracturedBlue/podman-socket-activated-services/tree/main/reverse-proxy) of a
110
+
customized socket-activated nginx container that watches a directory for Unix sockets that backend applications have created. In case of socket-activated backend application it would have
111
+
been systemd that created the Unix sockets. The __podman run__ option `--network none` is used.
112
+
113
+
__Reference 2:__
114
+
115
+
The article "_How to create multidomain web applications with Podman and Nginx_" https://www.redhat.com/sysadmin/podman-nginx-multidomain-applications
116
+
describes running nginx as a reverse proxy with rootless podman.
117
+
In the article rootless podman is given the privilege to listen on port 80 with the command
| docker.io/library/nginx | systemd system service with `User=test`| HTTP reverse proxy |
20
-
| docker.io/library/httpd | systemd user service | backend web server |
21
-
| docker.io/library/caddy | systemd user service | backend web server |
17
+
| Container image | Type of service | Role | Network | Socket activation |
18
+
| -- | -- | -- | -- | -- |
19
+
| docker.io/library/nginx | systemd system service with `User=test4`| HTTP reverse proxy|[internal bridge network](example4-net.network)|:heavy_check_mark:|
20
+
| docker.io/library/httpd | systemd user service |[internal bridge network](example4-net.network)|backend web server||
21
+
| docker.io/library/caddy | systemd user service | backend web server |[internal bridge network](example4-net.network)||
22
22
23
23
This example is similar to [Example 3](../example3) but here the nginx container is configured
24
-
as an HTTP reverse proxy for two backend web server containers (apache httpd and caddy) that
25
-
are running in systemd user services. All containers are run by rootless podman,
26
-
which belongs to the user _test_.
24
+
as an HTTP reverse proxy for two backend web server containers (apache httpd and caddy).
25
+
All containers are run by rootless podman, which belongs to the user _test_.
27
26
The containers communicate over an internal bridge network that does not have internet access.
28
27
29
-
#### set up _example4.service_
28
+
##Requirements
30
29
31
-
1. Create the user _test_ if it does not yet exist.
32
-
```
33
-
$ sudo useradd test
34
-
```
35
-
2. Check the UID of the user _test_
36
-
```
37
-
$ id -u test
38
-
1000
39
-
```
40
-
3. Create the directory _/home/test/nginx_conf_d_
41
-
4. Create the file _/home/test/nginx_conf_d/default.conf_ with the contents
42
-
```
43
-
server {
44
-
listen 80;
45
-
server_name localhost;
46
-
location / {
47
-
root /usr/share/nginx/html;
48
-
index index.html index.htm;
49
-
}
50
-
error_page 500 502 503 504 /50x.html;
51
-
location = /50x.html {
52
-
root /usr/share/nginx/html;
53
-
}
54
-
}
55
-
```
56
-
The file contents were created with the command
57
-
```
58
-
podman run --rm docker.io/library/nginx /bin/bash -c 'cat /etc/nginx/conf.d/default.conf | grep -v \# | sed /^[[:space:]]*$/d' > default.conf
59
-
```
60
-
4. Create the file _/home/test/nginx_conf_d/apache-example-com.conf_ with the contents
61
-
```
62
-
server {
63
-
listen 80;
64
-
server_name apache.example.com;
65
-
location / {
66
-
proxy_pass http://apache-container:80;
67
-
}
68
-
}
69
-
```
70
-
5. Create the file _/home/test/nginx_conf_d/caddy-example-com.conf_ with the contents
71
-
```
72
-
server {
73
-
listen 80;
74
-
server_name caddy.example.com;
75
-
location / {
76
-
proxy_pass http://caddy-container:80;
77
-
}
78
-
}
79
-
```
80
-
6. Create the file _/etc/systemd/system/example4.service_ with the contents
Result: Success. The nginx reverse proxy fetched the output from the caddy container.
197
94
198
-
#### discussion about service dependencies
95
+
##Discussion about service dependencies
199
96
200
97
systemd does not support having dependencies between _systemd system services_ and _systemd user services_.
201
-
Because of that we need to make sure that _example4-nginx.socket_ is started after
98
+
Because of that we need to make sure that _example4.service_ is started after
202
99
203
100
* podman has created the network _systemd-example4-net_
204
-
* podman has started _apache-container_ and _caddy-container_
101
+
* podman has started _apache-container_(_apache.service_) and _caddy-container_ (_caddy.service_)
205
102
206
103
A possible future modification to Example 4 could be to also run the backend web servers inside _systemd system services_ with `User=`.
207
104
Then it would be possible to configure dependencies between the services by adding `After=`, `Depends=`, `Requires=` directives.
208
-
209
-
#### references
210
-
211
-
See also the article "_How to create multidomain web applications with Podman and Nginx_" https://www.redhat.com/sysadmin/podman-nginx-multidomain-applications
212
-
It describes a similar setup but neither systemd system service with `User=` nor socket activation is used.
213
-
To be able to bind to port 80, the following command is used:
0 commit comments