Setting run user with oci containers and systemd

Help
1

Hello,
I want to add a podman container to my systemd. I want that systemd run the container like the user podmanager. I write this code:

{
  virtualisation.oci-containers = {
    backend = "podman";
    containers = {
      hass = {
        image = "homeassistant/home-assistant:0.117.5";
        user = "podmanager";
        workdir = "/home/podmanager";
        ports = ["8123:8123"];
        volumes = [
          "/etc/localtime:/etc/localtime:ro"
          "/home/podmanager/hass/config:/config"
        ];
      };
    };
  };

All is ok and that script has generated this service at systemd:

$ systemctl cat podman-hass.service 
# /nix/store/w4g2m286m0rsrgqjzvssz4g93lfsm5rv-unit-podman-hass.service/podman-hass.service
[Unit]

[Service]
Environment="LOCALE_ARCHIVE=/nix/store/1xpr86xg998h5acn4zqrx58xjdjqnnds-glibc-locales-2.31/lib/locale/locale-archive"
Environment="PATH=/nix/store/rvkw22lalr8chf85kjg2js64n11d8nyq-podman-wrapper-2.1.1/bin:/nix/store/w9wc0d31p4z93cbgxijws03j5s2c4gyf-coreutils-8.31/bin:/nix/store/aja0dim>
Environment="TZDIR=/nix/store/xg8nmhp28a5xf6ifgg8n93nrwbp8ghvm-tzdata-2019c/share/zoneinfo"



ExecStart=/nix/store/klgmdymkkp0axbhc1dqfs6p5gcrfabfz-system-path/bin/podman run \
  --rm \
  --name=hass \
  --log-driver=journald \
  -p '8123:8123' \
  -u 'podmanager' \
  -v '/etc/localtime:/etc/localtime:ro' \
  -v '/home/podmanager/hass/config:/config' \
  -w '/home/podmanager' \
  homeassistant/home-assistant:0.117.5
ExecStartPre=/nix/store/5dldd2wpqzqn7mycy9zgrk23k0gn6ail-unit-script-podman-hass-pre-start/bin/podman-hass-pre-start
ExecStop=/nix/store/2jysm3dfsgby5sw5jgj43qjrb5v79ms9-bash-4.4-p23/bin/sh -c "[ $SERVICE_RESULT = success ] || podman stop hass"
ExecStopPost=/nix/store/srwjxljchpbsd1yizkf5faa3d3svxf9z-unit-script-podman-hass-post-stop/bin/podman-hass-post-stop
Restart=always
StandardError=null
StandardOutput=null
TimeoutStartSec=0
TimeoutStopSec=12

This result doesn’t run podmam like user podmanager. For this I need at secion [Service] the field ‘User’. Is there any way to achieve this?

Thank you in advance

1 Like
2

I think adding something like:

systemd.services.podman-hass.serviceConfig.User = "podmanager";

to your configuration should work.

3

Thanks, that is working!

4

hy chanilino,

can you share your settings for the user podmanager please?

EDIT: ore better the complete podman setting with the home-assistant example, that would help everyone becouse the documentation about this topic is not the best i think…

1 Like
5

Hello,
I follow this example to create my configuration: Running Isso on NixOS in a Docker container . My final configuration doesn’t use the nix module for containers. I was having problems with reboots (I think is related with rootless podman).

I can share some of my actual configuration. I have on my configuration.nix:

...
  virtualisation.podman.enable = true;
  users.users.podmanager = {   
    isNormalUser = true;
  };
 imports = [
       ../services/hass.nix
  ];
...

On services/hass.nix:

{ config, pkgs, ... }:
{

  systemd.services.podman-hass = {
    enable = true;
    wantedBy = [ "default.target" ]; 
    after = [ "network.target" ];
    description = "Home Assistant pod";
    serviceConfig = 
    let 
      podmancli = "${config.virtualisation.podman.package}/bin/podman";
      hass_version = "0.118.0";
      podname = "hass";
    in
    {
      User = "podmanager";
      ExecStartPre= [ 
        "${podmancli} stop -i ${podname}"
        "${podmancli} rm -i ${podname}"
      ];
      ExecStart = "${podmancli} run " +
        "--rm " +
        "--name=${podname} " +
        "--log-driver=journald " +
        "-p '50000:8123' " +
        "-v '/etc/localtime:/etc/localtime:ro' " +
        "-v '/home/podmanager/hass/config:/config' " +
        "homeassistant/home-assistant:${hass_version}"; 
        
      ExecStop = "${podmancli} stop ${podname}";
      ExecStopPost = "${podmancli} rm -i ${podname}";
      Restart = "always";
      TimeoutStopSec = 15;
    };
  };
}
3 Likes
6

If you are interested on my old configuration. (It has issues on reboot). It was on services/hass.nix:

  virtualisation.oci-containers = {
    backend = "podman";
    containers = {
      hass = {
        image = "homeassistant/home-assistant:0.117.5";
        ports = ["50000:8123"];
        volumes = [
          "/etc/localtime:/etc/localtime:ro"
          "/home/podmanager/hass/config:/config"
        ];
      };
    };
  };
  systemd.services.podman-hass.serviceConfig.User = "podmanager";
  systemd.services.podman-hass.wantedBy = [ "default.target" ]
7

Thank you for sharing your Config!

i don’t know if it would change anything about your error, if you add:

systemd.services.podman-hass.after = [ "network.target" ];

to your old config. Because you define it in your actual configuration.

8

Hello @kreativmonkey,

I get the config working well now!
I have added control of process by sdnotify. By this by its own, dont solve the problem.
Finally I get it working calling podman with a login shell. Now it is working like a charm after reboot.

  systemd.services.podman-hass = {
    enable = true;
    wantedBy = [ "default.target" ]; 
    after = [ "network.target" ];
    description = "Home Assistant pod";
    serviceConfig = 
    let 
      podmancli = "${pkgs.bash}/bin/bash -l -c \"${config.virtualisation.podman.package}/bin/podman";
      endpodmancli = "\"";
      hass_version = "0.118.0";
      podname = "hass";
      cleanup_pod = [
        "${podmancli} stop -i ${podname} ${endpodmancli}"
        "${podmancli} rm -i ${podname} ${endpodmancli}"
      ];
    in
    {
      User = "podmanager";
      WorkingDirectory = "/home/podmanager";
      ExecStartPre = cleanup_pod;
      ExecStart = "${podmancli} run " +
        "--rm " +
        "--name=${podname} " +
        "--sdnotify=conmon " +
        "--log-driver=journald " +
        "-p '50000:8123' " +
        "-v '/etc/localtime:/etc/localtime:ro' " +
        "-v '/home/podmanager/hass/config:/config' " +
        "homeassistant/home-assistant:${hass_version} ${endpodmancli}"; 

      Type = "notify";
      NotifyAccess = "all";
      ExecStop = "${podmancli} stop ${podname} ${endpodmancli}";
      ExecStopPost = cleanup_pod;
      Restart = "always";
      TimeoutStopSec = 15;
    };
  };
2 Likes
9

Hi, guys

need help, i’m trying to do the same (podman rootless user and systemd) but that does not work anymore in 22.11.

10

What error do you get?

11

I did something similar. I needed to enable linger for the user and reboot to get it to work. Not pretty, would like to know a better more clean way.

12

i finaly found a working solution. That was a journey but everythings ok

13

Do you mind sharing what solution worked for you? I’m curious…