mgoltzsche/podman repository overview

⁠podman container image

Provides alpine-based podman image variants for nested and rootless containerization scenarios.
The project is maintained at https://github.com/mgoltzsche/podman-static⁠.

⁠Available tags

⁠Contained binaries / other projects

The image provides the following statically linked binaries (without systemd support):

• podman⁠
• crun⁠
• runc⁠
• conmon⁠
• fuse-overlayfs⁠ and libfuse⁠
• Netavark⁠: container network stack and default in podman 5 or later
  • passt/pasta⁠
  • aardvark-dns⁠
• catatonit⁠

⁠Usage

Run podman in docker (or podman):

docker run --device=/dev/fuse -u podman:podman mgoltzsche/podman:minimal docker run alpine:latest echo hello from nested container

Within the container docker is linked to podman to support applications that use the docker command.

To allow the container to write to a shared volume using your host UID, add the --userns=keep-id option.

To be able to build images within a nested container, mount a volume at the storage directory, e.g. --tmpfs /podman/.local/share/containers/storage:mode=1777. (This is because fuse-overlayfs file systems cannot be nested.)

If you want the nested containers to run with stronger isolation, you must use the regular (non-minimal) podman image and sacrifice the outer container's isolation by running it in --privileged mode:

docker run --privileged -u podman:podman mgoltzsche/podman:latest docker run alpine:latest echo hello from nested container

By default containers are run as user root. However the podman (uid/gid 1000) user can be used instead for which also a subuid/gid mapping is configured with the image (/etc/subuid, /etc/subgid).