Podman is a better container runtime.
Podman is a free and open source tool for running containers. Podman uses the same image format as Docker, so our IO image (ghcr.io/agentio/io) can be run with Podman. But Podman goes beyond Docker and adds Quadlets to allow containers to be easily run with systemd. Using some simple configuration, we can easily set up a Linux machine to run an IO on startup and to automatically restart its IO if it ever exits.
I've been doing this on desktop machines, on Raspberry Pis in a test cluster, on droplets on Digital Ocean, and on a couple of laptops, all running Ubuntu. Having IO running on all of these systems is great because I can write programs that use IO to call remote services without secrets (IO handles those) and I can run my client programs on any machine where I have an appropriately-configured IO.
Here's how I run IO with Podman.
Podman supports "rootless" operation, allowing containers to be run as non-root users, but for now I run my IO instances as root so they can easily bind to low numbered ports (I know there are other ways to do this, but this is simplest). I've embraced quadlets and run my host IO using Podman and systemd.
First I need Podman. If you don't have it installed, get it on Ubuntu with sudo apt-get install podman.
Then to set up your IO, put this in /etc/containers/systemd/io.container:
[Unit]
Description=Your Friendly Neighborhood Proxy
After=network-online.target
[Container]
Image=ghcr.io/agentio/io:latest
ContainerName=io
Network=host
Volume=/opt/io:/io:rw,z
Pull=newer
[Service]
Restart=always
[Install]
WantedBy=default.target
This tells Podman to mount /opt/io as /io inside the container. That's the IO run directory. Create this if it doesn't exist already.
Your IO needs a license and keys for ssh users. To add these, put your license.hcl and users.hcl in /opt/io and directly run IO once to import these files. You can do that with this podman command:
sudo podman run -v /opt/io:/io ghcr.io/agentio/io -c /io/license.hcl -c /io/users.hcl -x
That runs IO to load the configuration into the IO database and immediately exits.
Now you can configure systemd to run your IO:
sudo systemctl daemon-reload
sudo systemctl start io
From here on, IO will run when your system boots.
On Ubuntu, IO logs are written to /var/log/syslog:
tail -f /var/log/syslog
To only see logs from IO, use the journalctl tool. Here's an example that adds the -f option to follow the IO log:
sudo journalctl CONTAINER_NAME=io -f
For more, read the Podman documentation for podman-systemd.unit.
How I could run IO rootless.
I'm not currently using this, but I've verified that the recommendations in this discussion can allow a non-root IO to bind to low ports, specifically after making this configuration change on the host:
sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80
Update (running IO rootless)
I'm now using this configuration to run IO with rootless podman on one of my laptops.
With podman installed from apt, I saved this configuration as /etc/containers/systemd/users/1000/io.container:
[Unit]
Description=Your Friendly Neighborhood Proxy
After=network-online.target
[Container]
Image=ghcr.io/agentio/io:latest
ContainerName=io
Network=host
Volume=/home/tim/.local/share/io:/io:rw,z
Pull=newer
[Service]
Restart=always
[Install]
WantedBy=default.target
This keeps my IO configration in my home directory in the default location defined by XDG.
After updating my configuration with
systemctl --user daemon-reload
I start IO with
systemctl --user start io
One easy way to see the IO logs now is with journalctl:
journalctl --user -xeu io.service
No sudo anywhere... except for the configuration change I made above to allow IO to bind to low-numbered ports.
I noticed that my port setting resets on reboot. I configured it to be applied on startup by creating /etc/sysctl.d/99-rootless-ports.conf with the following:
net.ipv4.ip_unprivileged_port_start=80
To apply the change without rebooting, just do this:
sudo sysctl --system