{"id":23622385,"url":"https://github.com/cub0n/raspberrypi-and-container-configurations","last_synced_at":"2026-04-17T03:02:18.605Z","repository":{"id":64952703,"uuid":"449233160","full_name":"Cub0n/RaspberryPI-and-Container-configurations","owner":"Cub0n","description":"RaspberryPI and Containers","archived":false,"fork":false,"pushed_at":"2023-05-19T08:30:47.000Z","size":74,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-12-27T20:19:04.777Z","etag":null,"topics":["armv7","configuration","container","docker","podman","podman-systemd","raspberry-pi","raspberrypi"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Cub0n.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-01-18T10:09:50.000Z","updated_at":"2022-12-19T10:02:43.000Z","dependencies_parsed_at":"2024-12-27T20:19:06.692Z","dependency_job_id":"766b2977-757d-4c52-b577-04ef6c08b3e1","html_url":"https://github.com/Cub0n/RaspberryPI-and-Container-configurations","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cub0n%2FRaspberryPI-and-Container-configurations","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cub0n%2FRaspberryPI-and-Container-configurations/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cub0n%2FRaspberryPI-and-Container-configurations/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cub0n%2FRaspberryPI-and-Container-configurations/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Cub0n","download_url":"https://codeload.github.com/Cub0n/RaspberryPI-and-Container-configurations/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239516142,"owners_count":19651902,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["armv7","configuration","container","docker","podman","podman-systemd","raspberry-pi","raspberrypi"],"created_at":"2024-12-27T20:19:03.345Z","updated_at":"2025-11-07T02:30:51.081Z","avatar_url":"https://github.com/Cub0n.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Contribution rules\n\nIf you want to contribute to this list, create a PR (Pull Request) with description what you are adding. The following rules should be addressed:\n\n* Clear description\n* Keep it simple and stupid (KISS)\n* Only use active open-source software and images\n* Configuration/Enhancements have to be tested or should be annotated as **NOT TESTED**\n\n**This is an ongoing work and is not yet finished!!**\n\n# Topics\n* [Operating systems for RaspberryPi](#os)\n* [Configuration and Tweaks](#config)\n* [Security](#sec)\n* [PaaS](#paas)\n* [Images and Container](#container)\n\n# \u003ca id=\"os\"\u003eOperating systems\u003c/a\u003e\nThe operating system should be leightweight: No GUI (\"headless\"), no multimedia stuff, no \"fat\" applications or services. A good overview is [here](https://www.makeuseof.com/tag/lightweight-operating-systems-raspberry-pi/).\n\n# \u003ca id=\"config\"\u003eConfiguration for OS'es\u003c/a\u003e\n## Raspbian / Debian / DietPI\n* In file */boot/cmdline.txt* add *cgroup_enable=cpuset cgroup_enable=memory cgroup_memory=1* into the end of the file. (see: https://www.padok.fr/en/blog/raspberry-kubernetes)\n* For Apparmor insert *lsm=apparmor* to */boot/cmdline.txt* (https://forums.raspberrypi.com/viewtopic.php?t=66748#p1834603)\n* For better IRQ handling install *irqbalance* (see: https://www.howtouselinux.com/post/linux-performance-irqbalance-service and https://openwrt.org/docs/guide-user/services/irqbalance)\n* Remove unnecessary packages (Desktop) in Raspbian (https://virtualzone.de/posts/raspberry-pi-os-remove-packages/)\n* Installation and configuration of one resolver in the OS is necessesary (systemd-resolved or resolvconf)\n\n# \u003ca id=\"sec\"\u003eSecurity\u003c/a\u003e\n## OS\n\n### AppArmor\n* https://forums.raspberrypi.com/viewtopic.php?t=66748\n* https://wiki.debian.org/AppArmor/HowToUse\n* https://help.ubuntu.com/community/AppArmor\n* https://wiki.archlinux.org/title/AppArmor \n\n### SELinux\n**NOT TESTED**\n\n## Firewall\n### iptables/netfilter\n### ufw\n### firewalld\n### apf (**NOT TESTED**)\n\n# \u003ca id=\"paas\"\u003ePaaS\u003c/a\u003e\n## Runtime Plattforms\n\n### Docker\nInstallation on various OS (https://docs.docker.com/engine/install/). Often included in distribution package repositories.\n\n### k3s / k3d\n* https://rancher.com/docs/k3s/latest/en/quick-start/, needs at minimum RaspberryPI 3\n* Installation is done via shell script (https://k3d.io/v5.2.2/#installation). Works on RaspberryPI 2 too, but very slow.\n\n### minikube / kubernetes (k8s)\nInstallation is done via shell script (https://minikube.sigs.k8s.io/docs/start/). Works only on ARM64 (RaspberryPI 4) systems.\n\n### MicroK8s\nUbuntu's own minikube (https://ubuntu.com/tutorials/how-to-kubernetes-cluster-on-raspberry-pi)\n\n### Podman\nInstallation on various OS (https://podman.io/getting-started/installation). Often included in distribution package repositories.\n\n### nerdctl (**NOT TESTED**)\nhttps://github.com/containerd/nerdctl\n\n### DOKKU\nsee https://github.com/dokku/dokku. Some Buildpacks are not working on RaspberryPi2 (e.g. Herokuish)\n\n### Caprover\nsee https://caprover.com/. SideNote: Caprover will not work properly if it is started in (rootless-)_podman_\n\n## Rootless Container\nsee https://rootlesscontaine.rs/\n\n### Docker (**NOT TESTED**)\nDocker Rootless is not supported or available as package in Raspbian. Therefore you have to install and configure it manually:\n* https://docs.docker.com/engine/security/rootless/\n* https://linuxhandbook.com/rootless-docker/\n* https://thenewstack.io/how-to-run-docker-in-rootless-mode/\n* https://mohitgoyal.co/2021/04/14/going-rootless-with-docker-and-containers/\n\n### Podman (on Debian 12 Bookworm)\n* Remove all Podman and/or Container related packages from your installation (*apt purge podman slirp4netns crun runc buildah*), if you have already installed some from other (non Debian, e.g. https://software.opensuse.org/download.html?project=devel%3Akubic%3Alibcontainers%3Astable\u0026package=podman) sources. Otherwise you will encounter some problems if you mix the packages from the repos.\n\n* Install *podman* package and other packages from the repository (should also install overlay-fuse, netavark)\n```bash\n$ sudo apt install podman\n```\n\n* Install *uidmap* from the repo\n```bash\n$ sudo apt install uidmap\n```\n\n* Add a new user for rootless container. Username and groupname should be identical (otherwise it leads to some problems for subuid and subgid). Create the user with **no** password and **no** valid shell! DO NOT add the user to sudo group or to other system groups. The subuids and subgids should automatically be generated. If not, see https://rootlesscontaine.rs/getting-started/common/subuid/\n```bash\n$ sudo apt install adduser\n$ sudo addgroup $GROUP\n$ sudo adduser --home /home/$USER --shell /bin/nologin --ingroup $GROUP --disabled-password --disabled-login $USER\n```\n\n* Keep the daemons alive\n```bash\n$ sudo loginctl enable-linger $USER\n```\n\n* login to new $USER\n```bash\n$ sudo su --shell /bin/bash --login $USER\n```\n\n* Add BUS and XDG via systemctl (https://unix.stackexchange.com/questions/368730/starting-a-dbus-session-application-from-systemd-user-mode):\n```bash\n$ systemctl --user set-environment XDG_RUNTIME_DIR=/run/user/$UID\n$ systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=\"unix:path=${XDG_RUNTIME_DIR}/bus\"\n```\n\n* Enable podman socket for the current user\n```bash\n$ systemctl --user --now enable podman.socket\n```\n\n* Daemon restart\n```bash\n$ systemctl --user daemon-reload\n```\n\n* Test the unix socket and expect OK as reponse\n```bash\n$ curl --unix-socket /run/user/$UID/podman/podman.sock http://localhost/_ping\n```\n\n* If you have an older images, you have to migrate them to the new runtime (default is _crun_ on Debian)\n```bash\n$ podman system migrate --new-runtime crun\n```\n\n* If the containers will not start after migration, one trick is to delete all images and pull them again\n```bash\n$ podman system prune --all\n```\n\n* Logout from $USER\n```bash\n$ exit\n```\n\n* If there are still some problems, review your configuration in _~/.config/containers/_ (if you have already one for $USER) or under _/etc/containers/_ and _/etc/containers/networks/_\n\n#### Configuration\n* Copy the container and storage configuration to the $USER _~/.config_ directory\n```bash\n$ cp /usr/share/containers/containers.conf ~/.config/containers/\n$ cp /usr/share/containers/storage.conf ~/.config/containers/\n```\n\n* Configure _containers.conf_ with\n  * network_backend = \"netavark\" (the default container network stack)\n  * runtime = \"crun\" (default runtime)\n  * cgroup_manager = \"systemd\" (for usage with systemd)\n\n* Configure _storage.conf_\n  * driver = \"overlay\" (Default Storage Driver)\n  * runroot = \"/run/user/$UID/containers\" (Temporary storage location)\n  * mount_program = \"/usr/bin/fuse-overlayfs\" (Path to an helper program to use for mounting the file system, programm will be installed automatically by apt)\n\n#### Migrate from podman start to systemd start\nRunning podman containers can be started/stopped with systemd. To enable this, some commands have to be done for every container. This [script](https://github.com/Cub0n/RaspberryPI-and-Container-configurations/blob/main/migrateToSystemd.sh) makes it a little bit more automatic.\n* https://linuxhandbook.com/autostart-podman-containers/\n\n#### Automatic Updates of containers\nEvery container (which should be automatically updated) needs a _label=\"io.containers.autoupdate=registry\"_.\n* https://blog.arrogantrabbit.com/net/podman/\n* https://linuxhandbook.com/update-podman-containers/\n* or manually, see https://github.com/Cub0n/RaspberryPI-and-Container-configurations/blob/main/updateContainers.sh\n\n### Further Documentation\n* https://www.imaginarycloud.com/blog/podman-vs-docker/\n* https://calinradoni.github.io/pages/210327-podman-systemd.html\n* https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md\n* https://linoxide.com/install-podman-on-debian/\n* https://wiki.archlinux.org/title/Podman#Rootless_Podman\n* https://developers.redhat.com/blog/2020/09/25/rootless-containers-with-podman-the-basics\n* https://linuxhandbook.com/rootless-podman/\n* https://www.tutorialworks.com/podman-rootless-volumes/\n* https://howtoforge.com/how-to-install-podman-on-debian-11/\n* https://blog.while-true-do.io/podman-encrypted-images/\n\n# \u003ca id=\"container\"\u003eImages/Container and settings\u003c/a\u003e\nTODO\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcub0n%2Fraspberrypi-and-container-configurations","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcub0n%2Fraspberrypi-and-container-configurations","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcub0n%2Fraspberrypi-and-container-configurations/lists"}