The podman_service daemon auto-creates a socket on startup, along with
parent directory, and is always run as root. It is often useful to have
another proxy like haproxy or nginx provide more sophisticated security,
and these daemons do not need root privileges.
Details
Details
- use podman_service instead of podman daemon (thanks arrowd)
- rename all the vars accordingly
- PORTREVISION++ again to ensure we are past reverted commit
try this:
# /etc/rc.conf.d/podman_service podman_service_enable=YES podman_service_flags='--time 0' podman_service_api_user=$YOU podman_service_api_group=$GROUP
Diff Detail
Diff Detail
- Lint
Lint Skipped - Unit
Tests Skipped - Build Status
Buildable 70914 Build 67797: arc lint + arc unit
Event Timeline
Comment Actions
Thanks for fixing the style nits. For group ownership, I have a slight preference for wheel but operator would also be reasonable. The permission of 0770 suggested by arrowd@ will work but I don't think we need execute permissions so perhaps 0660 instead?
Comment Actions
If I understand it correctly, we need "7" to be set on podman_service_rundir to allow listing its contents. Client programs usually first check for socket existence which requires the ability to list dir's contents.
Comment Actions
frustratingly the var names I've chosen conflict with existing rc.subr ones :-( I need to rework these *again*