podms

Podman containers management with a private runtime directory.

podms setup installs the Podman archive and podcomp below $PODMAN_HOME (default: ~/.local/podman). It does not copy Podman files to /usr or /etc. Set PODMAN_HOME to move the complete runtime elsewhere.

Rootless setup checks util-linux and uidmap. If either is missing, Bash asks before running sudo apt-get install -y util-linux uidmap. It also asks before adding the 100000:65536 mappings to /etc/subuid and /etc/subgid. Declining any required operation stops setup.

On hosts that restrict unprivileged user namespaces (Ubuntu 24.04 and newer set kernel.apparmor_restrict_unprivileged_userns=1), rootless Podman fails with failed to reexec: Permission denied. podms setup rootless then offers to write $PODMAN_HOME/apparmor.d/podman and load it with sudo apparmor_parser -r. That grants the private podman binary the userns permission; the profile lives inside $PODMAN_HOME like every other file. AppArmor policy is held in memory only, so on such hosts the profile has to be loaded again after each reboot, before podms.service starts.

Usage

podms setup <root|rootless>    # Setup the private Podman runtime

podms boot                     # Install podms.service and start redis and postgres

podms boot copies this directory's service files into $PODMAN_HOME/service, renders service/podms.service with the resolved paths and installs the result as a systemd unit:

• rootless installs (the private root is writable by the current user) use the user instance, ~/.config/systemd/user/podms.service, with linger enabled so it also starts without a login session;
• everything else uses the system instance, /etc/systemd/system/podms.service, installed with sudo.

The unit is a Type=oneshot service with RemainAfterExit=yes: boot.bash runs once, brings the containers up detached and the unit stays active, so systemd never treats the one-shot script as a process to restart. systemctl --user restart podms re-runs the boot script (which recreates the containers), systemctl --user stop podms runs podcomp down, and a host reboot starts everything again through the enabled unit. Failed starts are retried at most three times in five minutes, then the unit stays failed instead of looping.

After setup, load the generated environment explicitly when needed:

source "$PODMAN_HOME/podman-env.bash"