Skip to content

Commit d4acc08

Browse files
pouprycpoupryc
committed
Add libpod API support for Podman via LIBPOD_* environment variables
1 parent 746ca65 commit d4acc08

5 files changed

Lines changed: 203 additions & 3 deletions

File tree

‎Dockerfile‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,32 @@ ENV ALLOW_RESTARTS=0 \
5858
SYSTEM=0 \
5959
TASKS=0 \
6060
VERSION=1 \
61-
VOLUMES=0
61+
VOLUMES=0 \
62+
LIBPOD_ALLOW_PAUSE=0 \
63+
LIBPOD_ALLOW_POD_PAUSE=0 \
64+
LIBPOD_ALLOW_POD_RESTARTS=0 \
65+
LIBPOD_ALLOW_POD_START=0 \
66+
LIBPOD_ALLOW_POD_STOP=0 \
67+
LIBPOD_ALLOW_POD_UNPAUSE=0 \
68+
LIBPOD_ALLOW_RESTARTS=0 \
69+
LIBPOD_ALLOW_START=0 \
70+
LIBPOD_ALLOW_STOP=0 \
71+
LIBPOD_ALLOW_UNPAUSE=0 \
72+
LIBPOD_CONTAINERS=0 \
73+
LIBPOD_EVENTS=0 \
74+
LIBPOD_EXEC=0 \
75+
LIBPOD_GENERATE=0 \
76+
LIBPOD_IMAGES=0 \
77+
LIBPOD_INFO=0 \
78+
LIBPOD_MANIFESTS=0 \
79+
LIBPOD_NETWORKS=0 \
80+
LIBPOD_PING=1 \
81+
LIBPOD_PLAY=0 \
82+
LIBPOD_PODS=0 \
83+
LIBPOD_SECRETS=0 \
84+
LIBPOD_SYSTEM=0 \
85+
LIBPOD_VERSION=1 \
86+
LIBPOD_VOLUMES=0
6287

6388
# add local files
6489
COPY root/ /

‎Dockerfile.aarch64‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,32 @@ ENV ALLOW_RESTARTS=0 \
5858
SYSTEM=0 \
5959
TASKS=0 \
6060
VERSION=1 \
61-
VOLUMES=0
61+
VOLUMES=0 \
62+
LIBPOD_ALLOW_PAUSE=0 \
63+
LIBPOD_ALLOW_POD_PAUSE=0 \
64+
LIBPOD_ALLOW_POD_RESTARTS=0 \
65+
LIBPOD_ALLOW_POD_START=0 \
66+
LIBPOD_ALLOW_POD_STOP=0 \
67+
LIBPOD_ALLOW_POD_UNPAUSE=0 \
68+
LIBPOD_ALLOW_RESTARTS=0 \
69+
LIBPOD_ALLOW_START=0 \
70+
LIBPOD_ALLOW_STOP=0 \
71+
LIBPOD_ALLOW_UNPAUSE=0 \
72+
LIBPOD_CONTAINERS=0 \
73+
LIBPOD_EVENTS=0 \
74+
LIBPOD_EXEC=0 \
75+
LIBPOD_GENERATE=0 \
76+
LIBPOD_IMAGES=0 \
77+
LIBPOD_INFO=0 \
78+
LIBPOD_MANIFESTS=0 \
79+
LIBPOD_NETWORKS=0 \
80+
LIBPOD_PING=1 \
81+
LIBPOD_PLAY=0 \
82+
LIBPOD_PODS=0 \
83+
LIBPOD_SECRETS=0 \
84+
LIBPOD_SYSTEM=0 \
85+
LIBPOD_VERSION=1 \
86+
LIBPOD_VOLUMES=0
6287

6388
# add local files
6489
COPY root/ /

‎Dockerfile.riscv64‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,32 @@ ENV ALLOW_RESTARTS=0 \
5858
SYSTEM=0 \
5959
TASKS=0 \
6060
VERSION=1 \
61-
VOLUMES=0
61+
VOLUMES=0 \
62+
LIBPOD_ALLOW_PAUSE=0 \
63+
LIBPOD_ALLOW_POD_PAUSE=0 \
64+
LIBPOD_ALLOW_POD_RESTARTS=0 \
65+
LIBPOD_ALLOW_POD_START=0 \
66+
LIBPOD_ALLOW_POD_STOP=0 \
67+
LIBPOD_ALLOW_POD_UNPAUSE=0 \
68+
LIBPOD_ALLOW_RESTARTS=0 \
69+
LIBPOD_ALLOW_START=0 \
70+
LIBPOD_ALLOW_STOP=0 \
71+
LIBPOD_ALLOW_UNPAUSE=0 \
72+
LIBPOD_CONTAINERS=0 \
73+
LIBPOD_EVENTS=0 \
74+
LIBPOD_EXEC=0 \
75+
LIBPOD_GENERATE=0 \
76+
LIBPOD_IMAGES=0 \
77+
LIBPOD_INFO=0 \
78+
LIBPOD_MANIFESTS=0 \
79+
LIBPOD_NETWORKS=0 \
80+
LIBPOD_PING=1 \
81+
LIBPOD_PLAY=0 \
82+
LIBPOD_PODS=0 \
83+
LIBPOD_SECRETS=0 \
84+
LIBPOD_SYSTEM=0 \
85+
LIBPOD_VERSION=1 \
86+
LIBPOD_VOLUMES=0
6287

6388
# add local files
6489
COPY root/ /

‎readme-vars.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,24 @@ full_custom_readme: |
6969
* To see the versions of the API your Docker daemon and client support, use `docker version` and check the `API version`.
7070
* [Read the docs](https://docs.docker.com/engine/api/) for the API version you are using for an explanation of all the available endpoints.
7171
72+
### Podman / libpod API
73+
74+
Podman exposes two API groups on the same socket: the Docker-compatible API (controlled by the existing env vars above) and the libpod-native API prefixed with `/libpod/`. The `LIBPOD_*` environment variables control access to the libpod endpoints independently of their Docker-compat equivalents.
75+
76+
For example, to use [prometheus-podman-exporter](https://github.com/containers/prometheus-podman-exporter), enable:
77+
78+
```yaml
79+
- LIBPOD_CONTAINERS=1
80+
- LIBPOD_INFO=1
81+
- LIBPOD_NETWORKS=1
82+
- LIBPOD_PODS=1
83+
- LIBPOD_VOLUMES=1
84+
- LIBPOD_IMAGES=1
85+
- LIBPOD_EVENTS=1
86+
```
87+
88+
Point the exporter at `tcp://socket-proxy:2375` using `CONTAINER_HOST`. `LIBPOD_PING` and `LIBPOD_VERSION` are enabled by default (like their Docker-compat counterparts `PING` and `VERSION`).
89+
7290
## Read-Only Operation
7391
7492
This image can be run with a read-only container filesystem. For details please [read the docs](https://docs.linuxserver.io/misc/read-only/).
@@ -120,6 +138,31 @@ full_custom_readme: |
120138
- TZ=Etc/UTC #optional
121139
- VERSION=1 #optional
122140
- VOLUMES=0 #optional
141+
- LIBPOD_ALLOW_PAUSE=0 #optional
142+
- LIBPOD_ALLOW_POD_PAUSE=0 #optional
143+
- LIBPOD_ALLOW_POD_RESTARTS=0 #optional
144+
- LIBPOD_ALLOW_POD_START=0 #optional
145+
- LIBPOD_ALLOW_POD_STOP=0 #optional
146+
- LIBPOD_ALLOW_POD_UNPAUSE=0 #optional
147+
- LIBPOD_ALLOW_RESTARTS=0 #optional
148+
- LIBPOD_ALLOW_START=0 #optional
149+
- LIBPOD_ALLOW_STOP=0 #optional
150+
- LIBPOD_ALLOW_UNPAUSE=0 #optional
151+
- LIBPOD_CONTAINERS=0 #optional
152+
- LIBPOD_EVENTS=0 #optional
153+
- LIBPOD_EXEC=0 #optional
154+
- LIBPOD_GENERATE=0 #optional
155+
- LIBPOD_IMAGES=0 #optional
156+
- LIBPOD_INFO=0 #optional
157+
- LIBPOD_MANIFESTS=0 #optional
158+
- LIBPOD_NETWORKS=0 #optional
159+
- LIBPOD_PING=1 #optional
160+
- LIBPOD_PLAY=0 #optional
161+
- LIBPOD_PODS=0 #optional
162+
- LIBPOD_SECRETS=0 #optional
163+
- LIBPOD_SYSTEM=0 #optional
164+
- LIBPOD_VERSION=1 #optional
165+
- LIBPOD_VOLUMES=0 #optional
123166
volumes:
124167
- /var/run/docker.sock:/var/run/docker.sock:ro
125168
restart: unless-stopped
@@ -164,6 +207,31 @@ full_custom_readme: |
164207
-e TZ=Etc/UTC `#optional` \
165208
-e VERSION=1 `#optional` \
166209
-e VOLUMES=0 `#optional` \
210+
-e LIBPOD_ALLOW_PAUSE=0 `#optional` \
211+
-e LIBPOD_ALLOW_POD_PAUSE=0 `#optional` \
212+
-e LIBPOD_ALLOW_POD_RESTARTS=0 `#optional` \
213+
-e LIBPOD_ALLOW_POD_START=0 `#optional` \
214+
-e LIBPOD_ALLOW_POD_STOP=0 `#optional` \
215+
-e LIBPOD_ALLOW_POD_UNPAUSE=0 `#optional` \
216+
-e LIBPOD_ALLOW_RESTARTS=0 `#optional` \
217+
-e LIBPOD_ALLOW_START=0 `#optional` \
218+
-e LIBPOD_ALLOW_STOP=0 `#optional` \
219+
-e LIBPOD_ALLOW_UNPAUSE=0 `#optional` \
220+
-e LIBPOD_CONTAINERS=0 `#optional` \
221+
-e LIBPOD_EVENTS=0 `#optional` \
222+
-e LIBPOD_EXEC=0 `#optional` \
223+
-e LIBPOD_GENERATE=0 `#optional` \
224+
-e LIBPOD_IMAGES=0 `#optional` \
225+
-e LIBPOD_INFO=0 `#optional` \
226+
-e LIBPOD_MANIFESTS=0 `#optional` \
227+
-e LIBPOD_NETWORKS=0 `#optional` \
228+
-e LIBPOD_PING=1 `#optional` \
229+
-e LIBPOD_PLAY=0 `#optional` \
230+
-e LIBPOD_PODS=0 `#optional` \
231+
-e LIBPOD_SECRETS=0 `#optional` \
232+
-e LIBPOD_SYSTEM=0 `#optional` \
233+
-e LIBPOD_VERSION=1 `#optional` \
234+
-e LIBPOD_VOLUMES=0 `#optional` \
167235
-v /var/run/docker.sock:/var/run/docker.sock:ro \
168236
--restart unless-stopped \
169237
--read-only \
@@ -208,6 +276,32 @@ full_custom_readme: |
208276
| `-e TZ=Etc/UTC` | `Set container timezone` |
209277
| `-e VERSION=1` | `/version` |
210278
| `-e VOLUMES=0` | `/volumes` |
279+
| **Podman libpod API** | |
280+
| `-e LIBPOD_ALLOW_START=0` | `/libpod/containers/{id}/start` - **This option will work even if `POST=0`** |
281+
| `-e LIBPOD_ALLOW_STOP=0` | `/libpod/containers/{id}/stop` - **This option will work even if `POST=0`** |
282+
| `-e LIBPOD_ALLOW_RESTARTS=0` | `/libpod/containers/{id}/stop`, `/libpod/containers/{id}/restart`, and `/libpod/containers/{id}/kill` - **This option will work even if `POST=0`** |
283+
| `-e LIBPOD_ALLOW_PAUSE=0` | `/libpod/containers/{id}/pause` - **This option will work even if `POST=0`** |
284+
| `-e LIBPOD_ALLOW_UNPAUSE=0` | `/libpod/containers/{id}/unpause` - **This option will work even if `POST=0`** |
285+
| `-e LIBPOD_ALLOW_POD_START=0` | `/libpod/pods/{name}/start` - **This option will work even if `POST=0`** |
286+
| `-e LIBPOD_ALLOW_POD_STOP=0` | `/libpod/pods/{name}/stop` - **This option will work even if `POST=0`** |
287+
| `-e LIBPOD_ALLOW_POD_RESTARTS=0` | `/libpod/pods/{name}/stop`, `/libpod/pods/{name}/restart`, and `/libpod/pods/{name}/kill` - **This option will work even if `POST=0`** |
288+
| `-e LIBPOD_ALLOW_POD_PAUSE=0` | `/libpod/pods/{name}/pause` - **This option will work even if `POST=0`** |
289+
| `-e LIBPOD_ALLOW_POD_UNPAUSE=0` | `/libpod/pods/{name}/unpause` - **This option will work even if `POST=0`** |
290+
| `-e LIBPOD_CONTAINERS=0` | `/libpod/containers` |
291+
| `-e LIBPOD_EVENTS=0` | `/libpod/events` |
292+
| `-e LIBPOD_EXEC=0` | `/libpod/exec` |
293+
| `-e LIBPOD_GENERATE=0` | `/libpod/generate` (systemd/kube YAML generation) |
294+
| `-e LIBPOD_IMAGES=0` | `/libpod/images` |
295+
| `-e LIBPOD_INFO=0` | `/libpod/info` |
296+
| `-e LIBPOD_MANIFESTS=0` | `/libpod/manifests` |
297+
| `-e LIBPOD_NETWORKS=0` | `/libpod/networks` |
298+
| `-e LIBPOD_PING=1` | `/libpod/_ping` |
299+
| `-e LIBPOD_PLAY=0` | `/libpod/play` (kube play) |
300+
| `-e LIBPOD_PODS=0` | `/libpod/pods` (Podman-specific pod management) |
301+
| `-e LIBPOD_SECRETS=0` | `/libpod/secrets` |
302+
| `-e LIBPOD_SYSTEM=0` | `/libpod/system` |
303+
| `-e LIBPOD_VERSION=1` | `/libpod/version` |
304+
| `-e LIBPOD_VOLUMES=0` | `/libpod/volumes` |
211305
| `-v /var/run/docker.sock:ro` | Mount the host docker socket into the container. |
212306
| `--read-only` | Make the container filesystem read-only. |
213307
| `--tmpfs /run` | Mount /run to tmpfs (RAM) to make it writeable. |
@@ -332,6 +426,7 @@ full_custom_readme: |
332426
333427
## Versions
334428
429+
* **13.06.26:** - Add libpod API support for Podman via `LIBPOD_*` environment variables.
335430
* **24.02.26:** - Add `ALLOW_PAUSE` and `ALLOW_UNPAUSE`.
336431
* **26.12.25:** - Rebase to Alpine 3.23.
337432
* **19.08.25:** - Add tzdata for localised logging timestamps.

‎root/templates/haproxy.cfg‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,19 @@ frontend proxy
3030
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/stop } { env(ALLOW_STOP) -m bool }
3131
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/pause } { env(ALLOW_PAUSE) -m bool }
3232
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/unpause } { env(ALLOW_UNPAUSE) -m bool }
33+
34+
# libpod endpoints
35+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/containers/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) } { env(LIBPOD_ALLOW_RESTARTS) -m bool }
36+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/containers/[a-zA-Z0-9_.-]+/start } { env(LIBPOD_ALLOW_START) -m bool }
37+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/containers/[a-zA-Z0-9_.-]+/stop } { env(LIBPOD_ALLOW_STOP) -m bool }
38+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/containers/[a-zA-Z0-9_.-]+/pause } { env(LIBPOD_ALLOW_PAUSE) -m bool }
39+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/containers/[a-zA-Z0-9_.-]+/unpause } { env(LIBPOD_ALLOW_UNPAUSE) -m bool }
40+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/pods/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) } { env(LIBPOD_ALLOW_POD_RESTARTS) -m bool }
41+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/pods/[a-zA-Z0-9_.-]+/start } { env(LIBPOD_ALLOW_POD_START) -m bool }
42+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/pods/[a-zA-Z0-9_.-]+/stop } { env(LIBPOD_ALLOW_POD_STOP) -m bool }
43+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/pods/[a-zA-Z0-9_.-]+/pause } { env(LIBPOD_ALLOW_POD_PAUSE) -m bool }
44+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/pods/[a-zA-Z0-9_.-]+/unpause } { env(LIBPOD_ALLOW_POD_UNPAUSE) -m bool }
45+
3346
http-request deny unless METH_GET || { env(POST) -m bool }
3447
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/auth } { env(AUTH) -m bool }
3548
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/build } { env(BUILD) -m bool }
@@ -54,5 +67,22 @@ frontend proxy
5467
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/tasks } { env(TASKS) -m bool }
5568
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/version } { env(VERSION) -m bool }
5669
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/volumes } { env(VOLUMES) -m bool }
70+
71+
# libpod endpoints
72+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/containers } { env(LIBPOD_CONTAINERS) -m bool }
73+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/events } { env(LIBPOD_EVENTS) -m bool }
74+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/exec } { env(LIBPOD_EXEC) -m bool }
75+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/generate } { env(LIBPOD_GENERATE) -m bool }
76+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/images } { env(LIBPOD_IMAGES) -m bool }
77+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/info } { env(LIBPOD_INFO) -m bool }
78+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/manifests } { env(LIBPOD_MANIFESTS) -m bool }
79+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/networks } { env(LIBPOD_NETWORKS) -m bool }
80+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/_ping } { env(LIBPOD_PING) -m bool }
81+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/play } { env(LIBPOD_PLAY) -m bool }
82+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/pods } { env(LIBPOD_PODS) -m bool }
83+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/secrets } { env(LIBPOD_SECRETS) -m bool }
84+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/system } { env(LIBPOD_SYSTEM) -m bool }
85+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/version } { env(LIBPOD_VERSION) -m bool }
86+
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/volumes } { env(LIBPOD_VOLUMES) -m bool }
5787
http-request deny
5888
default_backend docker

0 commit comments

Comments
 (0)