Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

https://github.com/szwendacz99/containersworkspace

Various useful and useless Containerfiles, often experimental and work in progress
https://github.com/szwendacz99/containersworkspace

containers docker dockerfile dockerfiles linux podman

Last synced: about 2 months ago
JSON representation

Various useful and useless Containerfiles, often experimental and work in progress

Awesome Lists containing this project

README 

        
# Containers-Workspace

Various useful and useless Dockerfiles, often experimental and work in progress



## jupyter



This is a custom image with jupyterlab and notebook installed.



Jupyter is running under root, for better possibilities of integration with

hardware (gpu, etc..) and for easier additional resources management

(dnf5 install, etc...)



There is also lsp environment prepared, with various lsp servers.



```bash

podman run --rm -it \

    -e JUPYTER_TOKEN=my-secret-token \

    -v /some/path/conf:/root/.jupyter:z,rw \

    -v /some/path/data:/jupyter/data:z,rw \

    --name jupyter \

        jupyter:latest

```



## system-toolbox



Fedora based container wih preinstalled many usefull tools for various debug and problem searching purposes

run help-toolbox to show what can you do in there



Typical container run options that allows for host data access:

```bash

podman run --rm -it --privileged \

    --network host --pid host --ipc host --no-hosts --ulimit host \

    --userns host \

        --name toolbox toolbox

```



## cloud-toolbox



Sounds huge, but it is just set of tools for cloud-based stuff,

like openstack-cli, rclone, openshift cli, etc...



Also contains `fzf` and bash-completion. Mount your bash_history for

best experience.



```bash

podman run --rm -it \

    -v "$HOME/.bash_history:/root/.bash_history" \

    --security-opt label:disable \

        cloud-toolbox:latest

```



## gui-container



gui-container is an experiment for apps with GUI



how to run with default, permissive options:



```bash

podman run --privileged -it \

    -e XDG_RUNTIME_DIR=/runtime_dir \

    -e WAYLAND_DISPLAY="$WAYLAND_DISPLAY" \

    -e DISPLAY="$DISPLAY" \

    -v /tmp/.X11-unix:/tmp/.X11-unix:rw \

    -v $HOME/.Xauthority:/root/.Xauthority:ro \

    -v "$XDG_RUNTIME_DIR:/runtime_dir:rw" \

    --entrypoint bash \

    --name "gui_container" \

        gui-container:latest

```



Minimal permissions example (for wayland).  Mounting just the display server socket, there will be no sound or anything else:

```bash

podman run -it --security-opt label:disable \

    -e XDG_RUNTIME_DIR=/runtime_dir\

    -e WAYLAND_DISPLAY="$WAYLAND_DISPLAY" \

    -v "$XDG_RUNTIME_DIR/wayland-0:/runtime_dir/wayland-0:rw" \

    --entrypoint bash --name "gui_container" \

        gui-container:latest

```



starting dbus:



```bash

export $(dbus-launch)

```



allowing podman to connect to X display as "non-network local connections"



```bash

xhost +"local:podman@"

```



unsetting `WAYLAD_DISPLAY` or `DISPLAY` can force apps to use the other one



```bash

unset DISPLAY

# or

unset WAYLAD_DISPLAY

```



to mage Qt-based apps work:



```bash

export QT_QPA_PLATFORM=wayland

```



## rathole



Compiled from source [rathole](https://github.com/rapiz1/rathole) image.



## snowflake



Compiled from source [torproject snowflake](https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake) image.



## Tor relay/bridge node



```bash

# prepare

cd tor/;

podman build -t tornode .;

chmod 777 ./data ./logs;



# run (network host for easy port bind on ipv6)

podman run -d --read-only --network host \

    -v "/home/user/torrc.conf:/torrc:rw,Z" \

    -v "/home/user/tor/logs:/var/log:Z,rw" \

    -v "/home/user/tor/data:/var/lib/tor:Z,rw" \

    --name tornode tornode:latest



# prepare systemd service for reboot persistence

podman generate systemd --new --name tornode > /etc/systemd/system/tornode.service;

restorecon -v /etc/systemd/system/tornode.service;

systemctl daemon-reload;

systemctl enable --now tornode.service;



# view nyx dashboard

podman exec -it tornode nyx

```



## Wireguard



Simple container that will setup wireguard interface according to

`/data/wg0.conf` and then replace process with pid 1 to `sleep infinity`.

MASQUERADE required for accessing external networks is done by nftables, so

it should work with nftables kernel modules, iptables-only modules can

be missing.



Before seting up the wg interface, entrypoint will execute files in

`/setup.d/` if any.



`PostUp` and `PostDown` in network interface config should look like this:



```bash

PostUp = nft add table inet filter; nft add chain inet filter forward { type filter hook forward priority 0 \; }; nft add rule inet filter forward iifname "%i" accept; nft add rule inet filter forward oifname "%i" accept; nft add table inet nat; nft add chain inet nat postrouting { type nat hook postrouting priority 100 \; }; nft insert rule inet nat postrouting tcp flags syn / syn,rst counter tcp option maxseg size set rt mtu; nft add rule inet nat postrouting oifname "eth*" masquerade

PostDown = nft delete table inet filter; nft delete table inet nat;

```

The `nft insert rule inet nat postrouting tcp flags syn / syn,rst counter tcp option maxseg size set rt mtu` is optional, but recommended if on client side there are virtual networks from which discovering the MTU of whole path can be difficult.



Example run (requires root and privileged for nftables setup)



```bash

podman run --privileged --name wireguard -d \

    -v './config:/data:ro' \

    -v './setup:/setup.d:ro' \

    -wireguard:latest

```



## zabbix-agent



Very simple alpine-based zabbix-agent image providing additioanl deps

required for SMART monitoring.



Setting up such contenerized agent in systemd based system:



```bash

podman run --restart no \

  --network host --pid host --ipc host --no-hosts --ulimit host --userns host \

  --privileged \

  -v "/path/to/custom/config.conf:/etc/zabbix/zabbix_agent2.conf:ro" \

  -v "/sys:/sys:ro" \

  -v "/sys/fs/cgroup:/sys/fs/cgroup:ro" \

  -v "/var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket:rw" \

  --name zabbix-agent \

  -d localhost/zabbix-agent;



podman generate systemd --new --name zabbix-agent > /etc/systemd/system/zabbix-agent.service;

restorecon -v /etc/systemd/system/zabbix-agent.service;

systemctl daemon-reload;

systemctl enable --now zabbix-agent.service;

```



## gitea-runner



An image for running double-container setup - one with podman system service,

and the other with gitea act_runner which will use podman service as

docker runner.



Example uses root, but it should be very similar to setup under non-root user.



Build image (will compile from main branch)

```bash

podman build --no-cache -t gitea-runner \

        ./ContainersWorkspace/gitea-runner/

```



Create dirs for runner config, and for podman socket shared between containers.

```bash

mkdir -p /root/act-runner/{runner,podman}

```



Generate example config

```bash

podman run --rm -it  gitea-runner:latest generate-config > /root/act-runner/runner/config.yaml

```



Update registration file path in config and privileged mode.



```bash

sed -i 's`file: .runner`file: /etc/runner/registration.json`g' /root/act-runner/runner/config.yaml;

sed -i 's`privileged: false`privileged: true`g' /root/act-runner/runner/config.yaml;

sed -i 's`docker_host: ""`docker_host: "-"`g' /root/act-runner/runner/config.yaml;

```

Currently you **need** to set `docker_host: "-"` in "container" section

to make this setup with mounted docker.sock work.



Fix perms on those dirs:



```bash

podman run --rm -it \

    -v /root/act-runner/:/data:z,rw \

    --privileged \

    --entrypoint bash \

    -u root \

        gitea-runner:latest \

            -c "chown -R podman /data"

```



Register runner.  

example value for labels can be `ubuntu-latest:docker://quay.io/podman/stable`.



```bash

podman run --rm -it \

    -v /root/act-runner/runner/:/etc/runner:z,rw \

    --privileged  \

        gitea-runner:latest \

            --config /etc/runner/config.yaml register

```



Start container acting as podman/docker (use `--init` to get rid of zombies):



```bash

podman run --rm -d --privileged --name gitea-podman \

    --init \

    --entrypoint podman \

    -v /root/act-runner/podman:/podman:z,rw \

        gitea-runner:latest  \

            system service --time=0 unix:///podman/docker.sock

```



Now start container with runner



```bash

podman run --rm -d --name gitea-runner \

    -v /root/act-runner/runner/:/etc/runner:rw,Z \

    -v /root/act-runner/podman:/podman:rw,z \

        gitea-runner:latest \

            daemon -c /etc/runner/config.yaml

```



Now generate systemd services for these containers



```bash

podman generate systemd --new --name gitea-podman > /etc/systemd/system/gitea-podman.service;

podman generate systemd --new --name gitea-runner > /etc/systemd/system/gitea-runner.service;

restorecon -v /etc/systemd/system/gitea-podman.service;

restorecon -v /etc/systemd/system/gitea-runner.service;

systemctl daemon-reload;

systemctl enable --now gitea-podman.service;

systemctl enable --now gitea-runner.service;

```



## Podman quadlets examples



This section is about quadlets, rather than specific image, but it is based on

examples.



To enable such container managed by systemd, create `.container` file

at `/etc/containers/systemd/my-container.container`, and then run:

```bash

systemctl daemon-reload;

systemctl enable --now my-container.service

```



### Example host-monitoring purpose quadlets



#### zabbix-agent



```systemd

[Unit]

Description=Zabbix agent 2

After=local-fs.target



[Container]

Image=zabbix-agent

ContainerName=zabbix-agent

LogDriver=journald

Network=host

Pull=newer

ReadOnly=yes

VolatileTmp=true

SecurityLabelDisable=yes

Ulimit=host

Unmask=ALL

AddCapability=SYS_ADMIN

AddCapability=SYS_RAWIO



AutoUpdate=registry



PodmanArgs=--pid=host

PodmanArgs=--ipc=host

PodmanArgs=--no-hosts

PodmanArgs=--device-cgroup-rule='a *:* r'



Volume=/etc/zabbix-agent2.conf:/etc/zabbix/zabbix_agent.conf:ro

Volume=/dev:/dev:ro

Volume=/var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket:rw



[Service]

Restart=always



[Install]

WantedBy=multi-user.target default.target

```



#### node-exporter (Prometheus)



```systemd

[Unit]

Description=Node exporter for Prometheus

After=local-fs.target



[Container]

Image=docker.io/prom/node-exporter:latest

ContainerName=node-exporter

LogDriver=journald

Network=host

Pull=newer

ReadOnly=yes

VolatileTmp=true

SecurityLabelDisable=yes

User=1222

UserNS=host

Ulimit=host

Unmask=ALL



AutoUpdate=registry



# Exec=--help



PodmanArgs=--pid=host

PodmanArgs=--ipc=host

PodmanArgs=--no-hosts



Volume=/proc:/host/proc:ro

Volume=/sys:/host/sys:ro

Volume=/:/rootfs:ro



Exec=--path.procfs=/host/proc --path.rootfs=/rootfs --path.sysfs=/host/sys --collector.filesystem.mount-points-exclude='^/(sys|proc|dev|host|etc)($$|/)'



[Service]

Restart=always



[Install]

# Start by default on boot

WantedBy=multi-user.target default.target

```