配置storage.conf文件

1./etc/containers/storage.conf
2.$HOME/.config/containers/storage.conf

在普通用户中/etc/containers/storage.conf的一些字段将被忽略

[root@localhost ~]# vim /etc/containers/storage.conf
# Default Storage Driver, Must be set for proper operation.
driver = "overlay"  //此处改为overlay
mount_program = "/usr/bin/fuse-overlayfs" //取消注释
如果版本为8以下，则需要做以下操作：
[root@localhost ~]# sysctl user.max_user_namespaces=15000  
或者
[root@localhost ~]# vim /etc/sysctl.conf 	
user.max_user_namepaces=15000			

在普通用户中这些字段默认

[root@localhost ~]# vim /etc/containers/storage.conf
# Temporary storage location
runroot = "/run/containers/storage"

# Primary Read/Write location of container storage
graphroot = "/var/lib/containers/storage"

registries.conf
配置按此顺序读入,这些文件不是默认创建的,可以从/usr/share/containers或复制文件/etc/containers并进行修改。

1./etc/containers/registries.conf
2./etc/containers/registries.d/*
3.HOME/.config/containers/registries.conf

授权文件

此文件里面写了docker账号的密码，以加密方式显示

[root@localhost ~]# podman login
Username: lvnanhai66
Password: 
Login Succeeded!
[root@localhost ~]# cat /run/user/0/containers/auth.json 
{
        "auths": {
                "docker.io": {
                        "auth": "bHZuYW5oYWk2NjoxOTk5MzI0cXdlcnQxMjM0"
                }
        }
}

普通用户是无法看见root用户的镜像的

[root@localhost ~]# podman images
REPOSITORY               TAG         IMAGE ID      CREATED       SIZE
docker.io/library/nginx  latest      605c77e624dd  7 months ago  146 MB
[root@localhost ~]# su - lnh
Last login: Wed Aug 17 11:28:29 CST 2022 on pts/0
[lnh@localhost ~]$ podman images
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE
[lnh@localhost ~]$ podman ps -a
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES

卷

容器与root用户一起运行，则root容器中的用户实际上就是主机上的用户。
UID GID是在/etc/subuid和/etc/subgid等中用户映射中指定的第一个UID GID。
如果普通用户的身份从主机目录挂载到容器中，并在该目录中以根用户身份创建文件，则会看到它实际上是你的用户在主机上拥有的。

使用卷

[lnh2@localhost ~]$ mkdir /home/lnh2/data
[lnh2@localhost ~]$ podman run -dit --name web -v /home/lnh2/data/:/data:Z -p 8080:80 httpd
Resolving "httpd" using unqualified-search registries (/etc/containers/registries.conf)
Trying to pull docker.io/library/httpd:latest...
Getting image source signatures
Copying blob dcc4698797c8 done  
Copying blob d982c879c57e done  
Copying blob a2abf6c4d29d done  
Copying blob 41c22baa66ec done  
Copying blob 67283bbdd4a0 done  
Copying config dabbfbe0c5 done  
Writing manifest to image destination
Storing signatures
b8d77d3d51351a8de4d2ae1eaada927230db901184bac7463b62db24d256d272
[lnh2@localhost ~]$ podman exec -it web /bin/bash
root@b8d77d3d5135:/usr/local/apache2# cd
root@f0eb826145ed:~# cd /
root@f0eb826145ed:/# ls
bin   data  etc   lib    media  opt   root  sbin  sys  usr
boot  dev   home  lib64  mnt    proc  run   srv   tmp  var
root@f0eb826145ed:/# cd data/
root@f0eb826145ed:/data# touch 123
root@f0eb826145ed:/data# ls -l
total 0
-rw-r--r--. 1 root root 0 Aug 17 10:06 123

在主机上查看

[root@localhost ~]# su - lnh2
Last login: Wed Aug 17 18:03:07 CST 2022 on pts/0
[lnh2@localhost ~]$ cd /home/lnh2/data/
[lnh2@localhost data]$ ls
123
[lnh2@localhost data]$ echo "hello lnh" >> 123
[lnh2@localhost data]$ cat 123
hello lnh

容器里查看

root@f0eb826145ed:/data# ls
123
root@f0eb826145ed:/data# cat 123
hello lnh

将容器中的目录和文件的属主和属组修改为lnh2