I would like to enhance the AIO compatibility with podman. Are the some development docs about the mastercontainer?

[aanno]

Hello,

I looked into the problems of AIO with podman a bit. I've got the impression that adding --add-host <your-nextcloud-aio-fq-domain>:host-gateway would improve things substantial.

However I'm new to the AIO mastercontainer and its PHP code. AFAIK, the mastercontainer controls starting the other containers by using docker unix socket.

I would like to interfere here and test my idea. Is there some docs about mastercontainer development? Where is the place where the PHP code starts new containers?

Kind regards, aanno

[szaimen]

Hi,

However I'm new to the AIO mastercontainer and its PHP code. AFAIK, the mastercontainer controls starting the other containers by using docker unix socket.

Yes, this is how AIO works.

Is there some docs about mastercontainer development? Where is the place where the PHP code starts new containers?

The code is here: https://github.com/nextcloud/all-in-one/tree/main/php#php-docker-controller. There you can also find some info on how to run this from source.

I would like to enhance the AIO compatibility with podman.

However, one of the main problems with podman currently is, that the included watchtower container which updates the mastercontainer is not compatible with podman. So this is one of the things that would need to be fixed. See containrrr/watchtower#1060.

And even after fixing this, I am personally against adding support for podman, since, as stated in the docs, this would add another platform that we would need to test against. So you still have the option to either use docker rootless, use the manual-install https://github.com/nextcloud/all-in-one/tree/main/manual-install or follow #3487 which is not supported by us though.

[aanno]

Dear @szaimen ,

thank you for prompt answer. I completely understand that there a no plans to get podman official supported. However, I really think that AIO is just very near to unofficially run on podman right now.

Podman has evolved substantially over the years. And it certainly supports the docker engine API out of the box, even in rootless mode. The following lines start the socket:

# start socket in rootless mode
systemctl --user restart podman.socket
# check if socket is up
curl -H "Content-Type: application/json" \
        --unix-socket /run/user/$UID/podman/podman.sock \
    http://localhost/_ping
export DOCKER_SOCKET=/run/user/$UID/podman/podman.sock
export DOCKER_HOST=unix://$DOCKER_SOCKET
echo "export DOCKER_SOCKET=$DOCKER_SOCKET"
echo "export DOCKER_HOST=$DOCKER_HOST"

The socket is not at /var/run/docker.sock. But apart from that it is up and kicking. In my experiments the watchtower container has not been a problem.

However 'self reference' is still a bit difficult.

[apparle]

@aanno I'd like to help too and have some minor AIO development experience.

I recently migrated my server to a newer OS and also migrated all my containers to podman user-space instead of docker. So far, with the user's docker.sock mapped, it seems to just work at a high level for basic functionality. So far I haven't reached the point of testing the backups or updates etc.
Few things:

1. While restoring from a backup, the redis volume is restored as empty volume but as owned by the root user. Post restore when I start using nextcloud, the redis container launches with uid 999 which doesn't have write access to that volume. Consequently, the nextcloud's main container spikes CPU usage to the moon. I had to manually chown the directory to correct uid after which it just worked. @szaimen how is this not a problem for a regular docker save and restore (on a different machine) ?
2. After machine reboot, podman doesn't restart the user-space containers. So I've manually create a systemd unit to start the containers. This makes sense for the mastercontainer since I wrote the compose file, but then it only starts the mastercontainer. I've to open the AIO UI and click on Start containers to actually start Nextcloud. It'd be much nicer to have some way to just start containers directly.
3. I don't use Collabara or Talk, so haven't yet noticed the issue you highlighted in how to run aio image using podman (docker replacement) #5090 (reply in thread) . Does the container try to reach itself over the network by its own name? Can you explain what's the expected behavior in docker?

@szaimen I know your hesitation about supporting one more platform, but podman has been making steady progress and I think it's getting to a point where it can completely replace docker, which IMO is a good thing given it's architecture. How about we take a stab at identifying & fixing the issues as long as they don't break anything with regular docker or require dramatically different code? At that point it can remain a "it works but isn't officially supported state" until someone officially steps in to maintain it. Since I've migrated my personal setup to podman, I'm highly motivated to fix the basic functionality for myself at least :-)

[szaimen]

• While restoring from a backup, the redis volume is restored as empty volume but as owned by the root user. Post restore when I start using nextcloud, the redis container launches with uid 999 which doesn't have write access to that volume. Consequently, the nextcloud's main container spikes CPU usage to the moon. I had to manually chown the directory to correct uid after which it just worked. @szaimen how is this not a problem for a regular docker save and restore (on a different machine) ?

This seems to be a different behaviour between docker and podman. Docker does the chown automatically afaik.

• After machine reboot, podman doesn't restart the user-space containers. So I've manually create a systemd unit to start the containers. This makes sense for the mastercontainer since I wrote the compose file, but then it only starts the mastercontainer. I've to open the AIO UI and click on Start containers to actually start Nextcloud. It'd be much nicer to have some way to just start containers directly.

Also a different behaviour between docker and podman. Since docker runs as a daemon it starts the containers automatically upon reboot because the restart policy unless-stopped is applied to most of the containers.

• I don't use Collabara or Talk, so haven't yet noticed the issue you highlighted in how to run aio image using podman (docker replacement) #5090 (reply in thread) . Does the container try to reach itself over the network by its own name? Can you explain what's the expected behavior in docker?

It needs to reach the domain from inside the container. Usually hairpin-nat or split-brain dns solves this.

@szaimen I know your hesitation about supporting one more platform, but podman has been making steady progress and I think it's getting to a point where it can completely replace docker, which IMO is a good thing given it's architecture. How about we take a stab at identifying & fixing the issues as long as they don't break anything with regular docker or require dramatically different code? At that point it can remain a "it works but isn't officially supported state" until someone officially steps in to maintain it. Since I've migrated my personal setup to podman, I'm highly motivated to fix the basic functionality for myself at least :-)

Feel free to go ahead fixing the basic functionality so that it works better on podman. Nothing against it :)