- Iziqukathi zabelana nge-kernel ne-host, ngakho-ke ukuhlukaniswa kwazo kuncike ezindaweni zamagama, amaqembu, kanye nokuqina kwesistimu.
- I-Podman inikeza ukuphepha okwengeziwe uma kuqhathaniswa ne-Docker yakudala ngokugwema i-daemon yempande ephakathi nokwenza kube lula ukusebenza okungenazimpande.
- Amanethiwekhi ebhuloho, i-host, kanye ne-rootless (slirp4netns, paste) ku-Podman akuvumela ukuthi ulungise ibhalansi phakathi kokuxhumana kanye nokuhlukaniswa.
- Ukuhlanganisa i-KVM, izitsha kanye nemikhuba emihle kakhulu (i-rootless, i-MAC, i-seccomp, ukuskena izithombe) kunikeza ipulatifomu eqinile yokukhiqiza.
Uma uqala ukusetha indawo engathi sína yeziqukathi ku-Linux, umbuzo ofanayo uphakama ngokushesha: kuphephile kangakanani ukuthembela kuphela kuziqukathi, futhi kunini lapho kunconywa khona ukuthuthukela ku-KVM noma kuma-micro-VM? Ezindaweni zezinkampani, lapho imishini ebonakalayo ye-Docker, i-Podman, i-LXC, i-KVM, kanye nama-hypervisor ahlukahlukene exutshwe khona, ukuqonda okuqinile kwemodeli yokuzihlukanisa kubalulekile ekugwemeni amaphutha.
Ngaphezu kwalokho, izimo eziyinkimbinkimbi kancane azivamile, njengokuzama ukusebenzisa i-Docker Desktop noma i-Podman ngaphakathi komshini obonakalayo ku-VirtualBox noma i-KVM , lapho amazinga amaningana e-virtualization (afakwe noma angafakiwe) eqala ukusebenza, futhi kulula ukuhlangana namaphutha afana nokuthi "i-KVM ayisebenzi ku-host." Ake sihlele zonke lezi zingcezu—iziqukathi, ama-VM, i-Podman, i-KVM, ukuxhumana, kanye nokuphepha—futhi sibone ukuthi singazihlanganisa kanjani ukuze sifinyelele i-virtualization ephephile futhi engokoqobo.
Ukwenziwa kwe-virtualization okuvamile nge-KVM kanye nemishini ebonakalayo
Isisekelo salokhu kusethwa konke sihlala siwukwenziwa kwe -virtualization okuphelele kwezinhlelo zokusebenza kusetshenziswa ama-hypervisor afana ne-KVM, i-Xen, noma i-ESXi . Lapha, ihadiwe ebonakalayo isebenzisa i-hypervisor enesibopho "sokuhlukanisa" umshini ube yimishini eminingana ezimele ebonakalayo.
Kulo modeli, umshini ngamunye obonakalayo uvula isistimu yawo yokusebenza ye-kernel kanye neyesivakashi , ehlukene ngokuphelele ne-host. I-hypervisor (isibonelo, i-KVM, ehlanganiswe ne-kernel ye-Linux) isebenza njengomlindi wesango phakathi kwehadiwe nama-VM, futhi inesibopho sokuhlukaniswa okuqinile phakathi kwawo.
Ngokuvamile sikhuluma ngezinhlobo ezimbili zama-hypervisor: Uhlobo 1 noma ama-hypervisor ensimbi engenalutho, asebenza ngqo kwi-hardware, kanye nama-hypervisor ohlobo 2, aphethwe phezu kwesistimu yokusebenza ekhona. I-VirtualBox noma i-VMware Workstation ingaba Uhlobo 2 , kuyilapho i-KVM ephethwe yi-libvirt kuseva ye-Linux iseduze nesimo se-Type 1, yize yabelana ngesikhala ne-host uqobo.
Inzuzo enkulu yale ndlela ukuthi i-VM ngayinye ine-stack yayo ephelele: i-kernel, isikhala somsebenzisi, izinsizakalo, inethiwekhi, kanye nesitoreji . Lokhu kunikeza ukuguquguquka okukhulu kanye nekhono lokusebenzisa izinhlelo zokusebenza ezahlukene kanye nezinguqulo ze-kernel emshinini ofanayo ongokoqobo.
Ukuze uphathe lawa mapulatifomu e-virtualized ku-GNU/Linux, i-libvirt cishe isetshenziswa njalo njenge-orchestration API , lapho amathuluzi ezithombe kanye nomugqa womyalo asekelwa khona, noma amaphrojekthi amakhulu njenge-OpenStack, eyakha amafu aphelele ngokuhlanganisa ama-VM, insimbi engenalutho kanye neziqukathi.
Izidingo zehadiwe nezinkinga ezivamile nge-KVM
Ngaphambi kokusebenzisa i-KVM noma ukusebenzisa izixazululo ezincike kuyo (njengezinye izilungiselelo ze-Docker Desktop noma i-micro-VM), udinga ukuqinisekisa ukuthi iprosesa isekela i-hardware virtualization (VT-x ku-Intel noma i-SVM/AMD-V ku-AMD) nokuthi ivuliwe ku-BIOS/UEFI.
Ku-Linux, sinokuhlola okusheshayo: uma umyalo othi `grep -E 'svm|vmx' /proc/cpuinfo` ungabuyisi lutho, noma inketho isakhutshaziwe ku-firmware, i-KVM ngeke isebenze. Ngaphezu kwalokho, ezimweni lapho sizosebenzisa khona ama-VM ngaphakathi kwenye i-VM (i-nested virtualization), i-hypervisor yezinga eliphezulu kumele iveze ngokusobala lezo zandiso kusivakashi.
Uma kukhona okungahambi kahle, kuvela imiyalezo evamile, njenge-popup ye-Docker Desktop edumile ku-RHEL 9 ngaphakathi kwe-VirtualBox: “I-KVM ayisebenzi ku-host .” Inkinga lapha ayikho nge-Docker noma i-RHEL ngqo, kodwa kunalokho ukuthi i-VirtualBox VM ayitholi izandiso ze-virtualization ezidingekayo ukuze isebenzise i-KVM ngaphakathi kwayo.
Imiyalo efana ne -`modprobe kvm` noma i-`modprobe kvm_amd / kvm_intel` kufanele ilayishe amamojula e-kernel ngaphandle kwemiyalezo yamaphutha. Uma i-`dmesg` ingakhombisi lutho olufanele, noma i-`lsmod | grep kvm` ikhombisa kuphela i-`kvm` engenalutho kanye ne-`irqbypass`, futhi amamojula athile e-CPU engekho, kungenzeka kakhulu ukuthi i-hardware virtualization ayivezwa ohlelweni lwezivakashi noma ikhutshaziwe ku-firmware.
Kulezi zimo, noma ngabe zonke izici ezingenzeka zivuliwe ngaphakathi kwesivakashi, uma i-VirtualBox inganikeli nge-virtualization ehlanganisiwe noma ingalungiselelwanga kahle, i-KVM ngeke isebenze . Isixazululo sihilela ukubuyekeza ukucushwa kwe-host hypervisor (i-VirtualBox, i-VMware, njll.) kanye nokuvumela i-virtualization ehlanganisiwe uma ikhona.
Iziqukathi: i-virtualization elula ezingeni lesistimu yokusebenza
Ngokungafani nama-VM endabuko, izitsha zinikeza indlela ehlukile: azilingisi yonke ihadiwe, kodwa kunalokho zisebenzisa kabusha i-kernel yomphathi futhi zihlukanise izinqubo nezinsiza zisebenzisa imisebenzi ye-kernel ye-Linux.
Isitsha empeleni siyiqoqo lezinqubo ezihlanganiswe kusetshenziswa izikhala zamagama kanye nama-cgroups . Ngaphakathi kwale "ndawo," uhlelo lokusebenza lukholelwa ukuthi lusebenza emshinini walo, ngesistimu yalo yamafayela, izixhumi zenethiwekhi, nama-PID, kodwa empeleni, labelana nge-kernel ne-host.
Iziqukathi zinikeza ukusebenza okuseduze nendawo ngoba akukho kernel yesibili ehilelekile futhi akukho ukulingisa okugcwele kwehadiwe . Izindleko zincane kakhulu: zanele ukufaka izikhala zamagama, ukukhawulela izinsiza ngama-cgroups, kanye nokuphoqelela izinqubomgomo zokuphepha (seccomp, AppArmor, SELinux, njll.).
Kodwa-ke, lo mklamo unemiphumela ebalulekile: yonke imisebenzi ihlanganyela i-kernel efanayo ebonakalayo . Ubuthakathaka obukhulu kuleyo kernel bungaba yi-escape vector engaba khona yazo zonke izitsha ezisebenza kuleyo node.
Yingakho kuvame ukuthiwa ukuhlukaniswa kweziqukathi akusikho "okuphelele" njengomshini obonakalayo . Uma umuntu ekwazi ukusebenzisa i-kernel bug ebalulekile, izikhala zamagama azibe yisivimbelo esisebenzayo, futhi imingcele phakathi kweziqukathi nama-host ingaphulwa.
Izikhala zamagama namaqembu: isisekelo sokuhlukaniswa kwesitsha
Ku-Linux, ukuhlukaniswa kweziqukathi kwakhiwe phezu kwezinsika ezimbili eziyinhloko: izikhala zamagama zokuhlukanisa ukubukwa kwesistimu kanye namaqembu e-c ukuze kukhawulelwe futhi kulandiswe izinsiza.
Izikhala zamagama zihlukanisa izinto ezifana nama-PID, inethiwekhi, amaphuzu okukhweza, i-IPC, i-hostname (UTS), kanye ne- users . Ngale ndlela, inqubo "ibona" kuphela izinqubo, izixhumi zenethiwekhi, uhlelo lwefayela, kanye ne-hostname yesikhala sayo samagama, okwenza kube nomuzwa wokuthi isesimweni esihlukile.
Ngokwawo, ama-cgroup akuvumela ukuthi ucacise ukuthi ingakanani i-CPU, imemori, i-disk I/O, inani lezinqubo, njll., isitsha esingazisebenzisa . Lokhu kuvimbela umthwalo ongalawuleki ukuthi ungagcwalisi wonke umphathi, okubalulekile lapho kwabelwana ngama-node phakathi kwamaqembu noma amaphrojekthi.
Kodwa-ke, kubalulekile ukuqonda ukuthi izikhala zamagama kanye nama-cgroups kuphela akuzona izinhlelo zokuphepha eziphelele . Azivimbeli ukusetshenziswa kobuthakathaka be-kernel, ukuhlunga izingcingo zesistimu, noma ukuphatha izinqubomgomo zokufinyelela ezihlanganisiwe. Ziyisisekelo, kodwa zidinga ukuqiniswa.
Indlela enengqondo yokuqinisa imvelo ukuhlanganisa izihlungi ze-syscall ne-seccomp, izinqubomgomo ze-MAC (i-AppArmor noma i-SELinux) kanye nokunciphisa okukhulu kwamakhono enqubo, okungcono kakhulu kanye nezikhala zamagama zomsebenzisi kanye nemodi engenazimpande ukuze kuncishiswe umonakalo uma othile ephumelela ukuphunyuka esitsheni.
Izinsongo zokuphepha ezinkundleni zamakhonteyina
Epulatifomu yangempela yesitsha, indawo yokuhlasela isakazeke ezingqimbeni eziningana: i-kernel kanye nesikhathi sokusebenza (i-runc, i-container, i-CRI-O), uchungechunge lokuhlinzekwa kwesithombe, ukucushwa kwesitsha/i-orchestrator, kanye nengqalasizinda engaphansi (ifu, isitoreji, i-IAM, inethiwekhi).
Ama-vector avamile okuhlasela afaka phakathi ubuthakathaka besofthiwe esikhathini sokusebenza se-kernel noma se-container, kusetshenziswa izithombe ezingavikelekile noma ezinganakekelwa, okwenza amaphutha okucushwa ku-Kubernetes noma ku-Docker (iziqukathi ezinelungelo, ama-host mounts ayingozi, amamodi enethiwekhi avuleke kakhulu), kanye namaphutha okuphepha kuma-registry noma kumapayipi e-CI/CD.
Ezimweni eziningi zangempela, akukho "iphutha lomlingo" elilodwa, kodwa kunalokho inhlanganisela yobuthakathaka obaziwayo kanye nokucushwa kwe-lax : iziqukathi ezisebenza njengempande, ukusetshenziswa kwefulegi le--privileged, ukufaka uhlelo lwefayela lomsingathi ngaphakathi kwesiqukathi, kanye nokungabikho kwe-seccomp noma i-MAC.
Okunye okungeziwe kukho konke lokhu yinkinga yochungechunge lokuhlinzeka: izithombe zomphakathi zivame ukuba nama-CVE, amaphakheji aphelelwe yisikhathi, kanye nokuncika okungalawulwa kahle . Kulula kakhulu ukuthi i-malware ingene noma umtapo wolwazi osengozini uhlale ungasebenzi kuze kube yilapho izimo zilungile ukuthi usebenze.
Ngakho-ke, ekukhiqizeni akuyona into ongayikhetha: kufanele uskene izithombe ukuze uthole ubuthakathaka ngamathuluzi afana ne-Trivy, Clair noma i-Grype , ulawule ukuthi yimaphi amarejista asetshenziswayo (i-Harbor, i-Quay, i-GHCR enezinqubomgomo) bese usayina/uqinisekisa izithombe ngaphambi kokuzisebenzisa eqenjini.
I-Docker vs Podman: Umthelela kumodeli yosongo
Ngaphakathi kwezwe leziqukathi zohlelo lokusebenza, i-Docker ne-Podman zihlanganisa imisebenzi efanayo, kodwa ukwakheka kwazo kuhluke kakhulu, futhi lokho kushintsha imodeli yokuphepha esisebenza ngayo ku-host.
I-Docker, kwimodi yayo yakudala ye-rootful, ithembele ku -daemon ephakathi (i-dockerd) esebenza njenge-root . I-CLI ixhumana nale daemon nge-/var/run/docker.sock noma nge-TCP, futhi yile nqubo enelungelo edala futhi ibhubhise izitsha, iphatha izithombe, amanethiwekhi kanye namavolumu, futhi ixhumana namarejista.
Lokhu kusho ukuthi noma ubani onokufinyelela ku-Docker socket cishe unokufinyelela kwezimpande ku-host , ngoba angavula izitsha ezinelungelo, afake izinhlelo zamafayela ezingahleliwe, futhi ashintshe ukucushwa okubucayi. I-daemon iba iphuzu elilodwa lokwehluleka.
Ngakolunye uhlangothi, uPodman wazalwa enomqondo wokuba yinjini yesitsha esingenayo i-daemon "evela" ku-Linux ngangokunokwenzeka . Ayikho inqubo ephakathi ehlala njalo; izitsha zilawulwa ngumsebenzisi noma yi-systemd, futhi ukuhlanganiswa nalokhu kokugcina kuvumela izitsha ukuthi zilawulwe ngamayunithi esevisi.
Le ndlela ihambisana kangcono nemodeli ye-Unix yokuthi "inqubo ngayinye ingeyomsebenzisi oyiqalisayo" futhi igwema ukuthembela ku-daemon enelungelo eliphezulu . Ngaphezu kwalokho, i-Podman inikeza ukuhambisana nemiyalo ye-Docker, okwenza kube lula ukufuduka (ungabiza ngisho ne-alias `docker=podman` ezindaweni lapho ungafuni ukufaka i-Docker CE).
Imodi engenazimpande kanye nezikhala zamagama zomsebenzisi
Enye yezindlela ezinkulu ezisebenzayo zokunciphisa umthelela we-escape engaba khona yesitsha yimodi engenazimpande ehlanganiswe nezikhala zamagama zomsebenzisi . Umbuzo okuhloswe ukuwuphendula yilona: "Kwenzekani uma isitsha siphunyuka?"
Izikhala zamagama zomsebenzisi zikuvumela ukuthi uphinde uthayiphe i-UID 0 yesitsha ku-UID engenamalungelo ku-host . Ngamanye amazwi, ngaphakathi kwesitsha uhlelo lokusebenza lukholelwa ukuthi luyimpande, kodwa ngokombono we-host, leyo nqubo empeleni ingumsebenzisi ojwayelekile onobubanzi be-subuid/subgid obunikeziwe.
Ngale ndlela, noma ngabe umhlaseli uthola amalungelo ezimpande ngaphakathi kwesitsha futhi ekwazi ukuxhumanisa i-kernel noma i-runtime exploit, lapho ebuyela kumphathi wenza kanjalo njengomsebenzisi ongenamalungelo . Abakwazi ukubhala ngaphezulu ama-root binaries, ukufaka izinhlelo zamafayela ezizwelayo, noma ukulawula amadivayisi lapho bengenawo amalungelo adingekayo.
I-Podman yaklanywa kusukela ekuqaleni inalolu hlobo engqondweni: ukuhlanganiswa kwe-rootless ngokuzenzakalelayo noma nini lapho kungenzeka , ukusetshenziswa kwe-SELinux/AppArmor kanye nama-cgroups ngisho noma kungekho root, kanye nokugcizelela okukhulu ekunciphiseni amalungelo okwakha.
I-Docker manje inikeza nemodi ye-rootless yangempela , lapho i-dockerd kanye neziqukathi zihlala ngaphakathi kwesikhala segama lomsebenzisi, ngokungafani ne-userns-remap endala lapho i-daemon yahlala khona iyi-root. Ngokombono wokuphepha, lokhu kuvimbela i-exploit against dockerd ekunikezeni ukufinyelela kwe-root okuzenzakalelayo kumphathi.
Amanethiwekhi esiqukathi ane-Podman: i-bridge, i-host, i-macvlan, kanye ne-rootless interfaces
Esinye isici esibalulekile sokuphepha nokusebenza okusebenzayo ungqimba lwenethiwekhi yesitsha . I-Podman inikeza izindlela ezahlukahlukene zokuhlinzeka ngokuxhumana, ikakhulukazi izimo ezingenazimpande.
I-Podman 4 yethule i-netavark, umshayeli wenethiwekhi olandela imodeli ye-CNI ukuze anikeze izitsha amakheli e-IP kumanethiwekhi ebhuloho, ama-macvlans, njll. Nge-netavark, izitsha ze-rootful zivame ukuxhuma ngokuzenzakalelayo kunethiwekhi ebizwa ngokuthi “i-podman” ehlotshaniswa nebhuloho le-Linux (podman0) ku-host, enekheli elithi 10.88.0.0/16.
Le nethiwekhi yebhuloho ezenzakalelayo inikeza ukuxhumana okuyisisekelo kwe-inthanethi ngemithetho ye-SNAT futhi ikuvumela ukuthi uveze ama-port esiqukathi kumphathi usebenzisa i-`-po --publish`, ekhiqiza imithetho ye-DNAT kuma-iptables/nftables. Ukuze kuhambisane ne-Docker, le nethiwekhi ayisebenzisi iseva yangaphakathi ye-DNS.
Singakha futhi amanethiwekhi ebhuloho achazwe ngumsebenzisi , ahlukanisa amaqembu eziqukathi komunye nomunye futhi ahlinzeke nge-DNS yangaphakathi. Lokhu kuvumela iziqukathi ukuthi zixazulule ngamagama ngaphakathi kwenethiwekhi yazo yangasese, kwenza kube lula ukuhlukanisa izinsizakalo okungafanele zikwazi ukubonana, futhi kunikeza ukulawula okwengeziwe ku-MTU, ama-firewall, nezinye izici.
Ezindaweni ezithuthuke kakhulu, kungenzeka ukusebenzisa amanethiwekhi e-macvlan noma e-ipvlan ukuxhuma iziqukathi ngqo kunethiwekhi ebonakalayo yomsingathi. I-Macvlan ivumela iziqukathi ukuthi zikhulumisane, kuyilapho i-ipvlan ivame ukuzihlukanisa kakhulu; lezi yizinketho eziwusizo ekusetshenzisweni lapho isiqukathi ngasinye sidinga ukubonwa njengomsingathi wangempela yinethiwekhi yonke.
Amanethiwekhi angenazimpande: ama-slirp4netns kanye ne-pasta
Uma umsebenzisi engekho impande, izinto ziba nzima: umsebenzisi ongenamalungelo akakwazi ukushintsha ngokukhululekile i-namespace yenethiwekhi yomhlaba wonke noma adale izixhumanisi ezingahleliwe, ngakho-ke i-Podman kufanele isebenzise izixazululo zesikhala somsebenzisi ukuze inikeze ukuxhumana.
Yilapho i-slirp4netns ingena khona , indlela yakudala esetshenziswa yi-Podman rootless . Le phrojekthi idala indawo yenethiwekhi ehlukanisiwe ngaphakathi kwesitsha futhi isebenzisa imodyuli ye-kernel ye-slirp ukwenza ukuhumusha ikheli (i-NAT) nokuvumela isitsha ukuthi sifinyelele i-inthanethi ngenethiwekhi yomsingathi.
Empeleni, i-slirp4netns idala isikhombimsebenzisi se-TAP ngaphakathi kwesikhala segama lenethiwekhi yesitsha (isibonelo, i-tap0 ene-IP 10.0.2.100 kanye nesango 10.0.2.2) futhi ihambisa ithrafikhi nge-TCP/IP stack esetshenziswa esikhaleni somsebenzisi. Iyasebenza, kodwa inezela okunye okungaphezulu kanye nemikhawulo ethile.
Enye yalezi mikhawulo ukuthi abasebenzisi abangenamalungelo abakwazi ukusebenzisa ama-port angaphansi kuka-1024. Ipharamitha ye-sysctl net.ipv4.ip_unprivileged_port_start imaka ukuthi i-port babhekwa "njengabangamalungelo" kusuka kuyiphi (ngokuzenzakalelayo, 1024), yize lokhu kungalungiswa ngokucophelela uma imodeli yokuphepha ivumela.
Ku-Podman 5, i-slirp4netns ithathelwa indawo yi- pasta njengendlela ezenzakalelayo engenazimpande . I-Pasta isebenza ngokuphelele endaweni yomsebenzisi, kodwa ngenxa yesikhombikubona sokuthepha kanye namasu okukopisha, ifinyelela ukusebenza kwenethiwekhi okuseduze nendawo, kunciphisa umthelela ekubambezelekeni nasekuphumeni kwayo uma kuqhathaniswa ne-slirp4netns.
Amanethiwekhi okuhlanganisa kanye nokusingatha ezitsheni ezingenazimpande
Ngisho noma sisebenza kwimodi engeyona eyezimpande, singaxhumanisa izitsha ezingenazimpande kunethiwekhi yebhuloho ye-"podman" ezenzakalelayo sisebenzisa i-`--network=podman`. Lokhu kusizakala ngamakhono e-netavark futhi kumepha ama-ports ku-host nge-`-p`, njengakwimodi ye-rootful.
Kungenzeka futhi ukudala amanethiwekhi ebhuloho achazwe ngumsebenzisi ezindaweni ezingenazimpande . Kulesi simo, amabhuloho namadivayisi ahlobene awadalwanga esikhaleni segama lenethiwekhi yomhlaba wonke yomsingathi, kodwa esikhaleni segama lomsebenzisi, ngakho-ke lezi zixhumanisi ngeke zibonakale kumsingathi ngomyalo olula we-`sudo ip a`.
Ukuze kuhlolwe la mabhuloho angenazimpande, i-Podman inikeza umyalo othi `podman unshare --rootless-netns` , ovula igobolondo endaweni yegama lenethiwekhi yomsebenzisi. Ukusuka lapho, amabhuloho angaphakathi angabonakala, futhi ukuxhumana okuqondile ezitsheni kungaqinisekiswa.
Lokhu kuzihlukanisa kunomphumela omangalisayo: Kungase kungabikho ukuxhumana okuqondile kusuka ku-host kuya kuma-IP alezo ziqukathi ezingenazimpande.kodwa iyasebenza nama-port afakwe kumephu yekheli le-IP lomsingathi, asebenza njengendawo yokungena kule nsizakalo.
Ukuze kuxhunyaniswe phakathi kweziqukathi, iseva ye-DNS ehlanganiswe kunethiwekhi yebhuloho echazwe ngumsebenzisi ivumela ukuthi ikhulume ngamagama, okwenza kube lula kakhulu ukucushwa kwezinhlelo zokusebenza ezisatshalaliswayo.
Ngakolunye uhlangothi kukhona inethiwekhi yomsingathi (--network=host) , lapho isitsha sabelana khona nge-network stack ne-host ngaphandle kwekheli layo le-IP. Kule modi, uma isitsha esingenazimpande siqala iseva ku-port 8080/tcp, isevisi izotholakala ngqo ku-port 8080 ye-host, ilondoloze imephu ye-port kodwa inciphise ukuhlukaniswa.
Ideskithophu ye-Podman, amathuluzi okuthwebula izithombe kanye nokuhlelwa kwendawo
Kulabo abathanda into ebonakalayo kakhulu, i-Podman Desktop inikeza indawo enezithombe zokuphatha izitsha, ama-pod, izithombe, kanye nokucushwa kwenethiwekhi emishinini yokuthuthukisa, esebenza njengendlela ehlukile eqondile esikhundleni se-Docker Desktop kodwa ithembele enjinini engena-daemon.
Izithombe zitholakala kusetshenziswa i-`podman pull`, elanda kusuka kumarejista achazwe ku-`/etc/containers/registries.conf` . Uma isithombe sicacisiwe ngaphandle kwegama lerejista, i-Podman izama ukusithola ngaphakathi kwe-oda lerejista elihleliwe, isebenzisa ithegi ethi `yakamuva` ngokuzenzakalelayo.
Ngaphezu kwe-Podman CLI, singasebenzisa i-skopeo njengethuluzi elizinikele lokuphatha, ukuhlola, nokukopisha izithombe phakathi kwamarejista kanye nama-repository endawo. Imiyalo efana nokukopisha, ukususa, kanye nokuvumelanisa isivumela ukuthi sikwazi ukuvumelanisa ngokuzenzakalelayo phakathi kwama-repository, simake izithombe zokuqoqwa kukadoti, futhi sihambise izinto zobuciko phakathi kwezindawo.
Uma isithombe sesilandiwe, i-`podman run` ikuvumela ukuthi uqale izitsha ngokucacisa ukuthutha kanye nendlela (ngokuzenzakalelayo, i-Docker transport kanye nokusesha kurejista elungiselelwe). Izinketho ezivamile (-d, -p, --name, --pod, njll.) zihlanganisa zombili izimo zelebhu kanye nokusetshenziswa okungathi sína.
Ukuphathwa kwansuku zonke kuqedwa nge -`podman ps` ukuze kufakwe ohlwini lweziqukathi, `podman stop/start` ukuze kumiswe noma kuqalwe izimo ezikhona, kanye ne-`podman rm` ukuze kususwe iziqukathi ezimisiwe . Uma isiqukathi sishintshiwe futhi sifuna ukusiguqula sibe isithombe esisha, i-`podman commit` igcina lezo zinguquko ngaphansi kwegama elisha.
Ama-Pod namamodeli okusebenza athuthukisiwe ane-Podman
Iphefumulelwe yi-Kubernetes, i-Podman ikuvumela ukuthi uqoqe izitsha zibe ama-pod abelana nge-network stack efanayo kanye nezinsiza ezithile . Kuyiphethini ephelele yezinto ezifana ne-database kanye neklayenti layo, noma ama-microservice amaningi adinga ukuxhumana ngokubambezeleka okuphansi.
Umyalo othi `podman pod create` udala i-pod entsha bese ubuyisela i-ID yayo, kodwa ngokuzenzakalelayo i-pod ihlala imile kuze kube yilapho isitsha esihlobene siqalwa noma siqaliswa ngokucacile nge-`podman pod start`.
Ukuze ubone ukuthi yimaphi ama-pod akuhlelo, sebenzisa i-`podman pod ls` , ezophinde ibhale isitsha se-INFRA esihlotshaniswa nesinye nesinye. Lesi sitsha esikhethekile sigcina inethiwekhi nezinye izinsiza ezabiwe ze-pod zisebenza, ngakho inani lezitsha alikaze libe yi-zero.
I-Podman inikeza imiyalo ethile yokuqala, ukumisa, noma ukuqala kabusha wonke ama-pod (i-podman pod start/stop/restart) , kodwa futhi singasebenza kuphela esitsheni esithile ngaphakathi kwe-pod ngaphandle kokushintsha okunye, sigcine ukuhlukaniswa kwenqubo ezingeni lesicelo.
Ukuze wengeze ezinye izitsha ku-pod ekhona, sebenzisa i-`podman run --pod POD_NAME` , ulandela i-syntax efanayo neyezitsha ngazinye. Awukwazi ukususa isitsha ku-pod ngaphandle kokusibhubhisa, njengoba ubulungu be-pod buboshelwe emjikelezweni waso wokuphila.
Ukuqapha kuqedwa nge -podman ps –pod noma imiyalo ethile yokuqapha izinqubo zazo zonke izitsha kuzo zonke izitsha , kutholakale ngokushesha ukuthi yikuphi okungokwaliphi iqembu nokuthi izinsizakalo zisatshalaliswa kanjani.
Iziqukathi, i-LXC, kanye nokwenza ngcono uhlelo lokusebenza
Nakuba i-Docker ne-Podman zilawula ingxoxo, akuzona zodwa izinketho zokufaka ama-container ku-GNU/Linux . Izixazululo ezifana ne-LXC/LXD, i-systemd-nspawn, kanye ne-Kata Containers zixazulula inkinga ngezindlela ezahlukene kancane.
I-LXC inikeza izitsha zesistimu ezilula kakhulu, ezinegama lazo lokusingatha, ikheli le-IP, uhlelo lwefayela, kanye nohlelo oluphelele lwe-init . Ihlanganiswe ne-LXD, esebenza njenge-hypervisor yezitsha nama-VM, inikeza ulwazi olusondele kakhulu ekubeni nemishini eminingi elula esebenza kahle kakhulu.
Ngenkathi i-Docker/Podman igxila ezitsheni zesicelo ezihambisana ne-OCI , i-LXC iyakhanya lapho kudingeka izindawo eziqhubekayo ezinezinsizakalo nezinqubo eziningi, ziziphatha njenge-VM kodwa zingenazo izindleko eziningi kanye nokuhlanganiswa kwemvelo kakhulu ne-Linux kernel.
Ngokombono wokusebenza, i-LXC ingasebenzisa izinhlelo zokusebenza zebhizinisi ezidinga idatha eningi ngaphandle kwesijeziso , okwenza kube ukukhetha okunamandla kwemithwalo yemisebenzi ebucayi ekubambezelekeni engadingi ukuhlukaniswa okuqinile kwe-VM yendabuko.
Kanye nalokhu, ubuchwepheshe obuqondiswe kuma-micro-VM kanye nokuhlukaniswa okuthuthukisiwe nakho kuthole ukudonswa, njenge-Kata Containers , evula i-pod ngayinye ngaphakathi komshini omncane obonakalayo one-kernel yayo, noma i-gVisor, efaka "i-kernel sandbox" ebhalwe ku-Go between application kanye ne-Linux. Zombili zinciphisa ukuncika ku-kernel eyabiwe futhi zisondela kumodeli yokuphepha yama-VM ngenkathi zigcina ubungane bokusebenzisa ama-container.
Izindlela ezinhle kakhulu zokuqinisa i-Docker ne-Podman
Ngazo zonke lezi zinto ezingenhla, indlela efanelekile yesikhulumi se-container esiqinile ukusebenza ngezendlalelo: ukuhlukaniswa ngezikhala zamagama/ama-cgroup, izinqubomgomo zokuhlunga nge-seccomp kanye ne-MAC, kanye nokuvinjelwa kwamalungelo okwakheka ngemodi ye-rootless.
Empeleni, kuyalulekwa ukusebenzisa umkhuba ojwayelekile wokusebenzisa izitsha kwimodi engeyona eyezimpande noma nini lapho kungenzeka , ikakhulukazi ezindaweni ezinabantu abaningi noma ngaphakathi kwamafu abiwe. I-Podman yenza lokhu kube lula ngokuzenzakalelayo, kanti i-Docker rootless ihlanganisa ifilosofi efanayo lapho kudingeka ukuhambisana.
I-kernel yomsingathi kumele ihlale inolwazi olusha ngama-patches okuphepha . Ubungozi obufana ne-Dirty COW, i-Dirty Pipe, nezinye kubhekwana nazo ngezibuyekezo okumele zisetshenziswe ngokushesha uma singafuni ukushiya umnyango uvulekile ukuze kuphunywe esitsheni.
Esinye isinyathelo esisebenza kahle kakhulu ukusebenzisa ukusatshalaliswa okungaguquki, okugxile esitsheni, njenge-openSUSE MicroOS noma i-Flatcar Linux . Uhlelo lwabo lokuvuselela impande kanye ne-atomic lokufunda kuphela lunciphisa kakhulu indawo yokuhlasela futhi lwenze kube lula ukuhlehlisa uma kukhona okungahambi kahle ngemva kokuphamba.
Ngokuphathelene nokucushwa: azikho izitsha ezinelungelo ekukhiqizweni ngaphandle kwasezimweni ezilawulwa kakhulu , ungasebenzisi izinhlelo zokusebenza njengezimpande ngaphakathi kwesitsha, sebenzisa izinhlelo zamafayela zokufunda kuphela noma nini lapho kungenzeka, futhi ukhawulele amakhono okungenani. Amaphrofayili e-SELinux/AppArmor kanye ne-seccomp aklanyelwe izingcingo zangempela zohlelo lokusebenza cishe ayimpoqo.
Okokugcina, akumelwe sikhohlwe isici sokuqapha isikhathi sokusebenza . Amathuluzi afana ne-Falco, i-Sysdig Secure, noma i-Aqua asiza ekutholeni okungavamile, imizamo yokubaleka (njengokufinyelela okungajwayelekile ku-/proc noma ku-/sys), ithrafikhi yenethiwekhi engajwayelekile, noma imiyalo esolisayo, enikeza isikhathi sokusabela ngaphambi kokuba ukuhlaselwa kubambe.
Ngokuhlanganisa i-virtualization yakudala ne-KVM, izitsha eziphethwe yi-Podman (ikakhulukazi kwimodi engenazimpande), amanethiwekhi ahlukaniswe kahle, kanye nemikhuba eqinile yokuqinisa, kungakhiwa ipulatifomu ye-virtualization eguquguqukayo kakhulu futhi ephephile. Ukuqonda ukuthi i-kernel eyabiwe yiphuzu elibaluleke kakhulu, ukuthembela kuma-VM noma ama-micro-VM lapho ubungozi noma ukuhambisana nomthetho kudinga lokho, nokuphatha ngokucophelela uchungechunge lokuhlinzekwa kwesithombe kwenza umehluko omkhulu phakathi kwendawo yelebhu kanye nengqalasizinda elungele ukukhiqizwa.
