sr2c.podman.podman_host role – Prepare a host and its users for rootless Podman

Note

This role is part of the sr2c.podman collection (version 0.0.1).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it use: ansible-galaxy collection install sr2c.podman.

To use it in a playbook, specify: sr2c.podman.podman_host.

Entry point main – Prepare a host and its users for rootless Podman

Synopsis

  • Installs Podman, container-selinux and shadow-utils-subid with dnf, and prepares each user in podman_host_rootless_users to run rootless containers managed by systemd.

  • The users must already exist and have subordinate UID and GID ranges; the role checks this but does not create them.

  • For each user, enables lingering so their services run without a login session, sets XDG_RUNTIME_DIR in ~/.bashrc and ~/.bash_profile, creates ~/.config/containers/systemd for quadlets, points Podman’s TMPDIR at ~/.local/tmp, and enables podman-auto-update.timer.

  • Removes /etc/containers.conf and /etc/containers/containers.conf, so each user’s own containers.conf applies. This affects every Podman user on the host.

  • When podman_host_minimum_unpriv_port is set, sets net.ipv4.ip_unprivileged_port_start to it, at runtime and in /etc/sysctl.d/zzz-podman-unpriv-port.conf. The setting applies to the whole host, so every user can bind ports from that number up.

Parameters

Parameter

Comments

podman_host_minimum_unpriv_port

integer

The lowest port that unprivileged users can bind, from 0 to 65535. Callers that run nginx pass 80 so it can listen on ports 80 and 443.

When not set, the role leaves net.ipv4.ip_unprivileged_port_start as it is.

podman_host_rootless_users

list / elements=string / required

The users to prepare for rootless Podman. Must not be empty or include root.

Authors