Convert Podman Quadlet deployment from rootful to rootless - #4
Open
pablomh wants to merge 20 commits into
Open
Conversation
pablomh
force-pushed
the
rootless_2
branch
4 times, most recently
from
February 25, 2026 23:25
fb6289a to
f109267
Compare
this is now needed to solve:
An error occurred while installing fiddle (1.1.8), and Bundler cannot continue.
In Gemfile:
gettext_i18n_rails_js was resolved to 1.4.0, which depends on
gettext was resolved to 3.5.2, which depends on
locale was resolved to 2.1.5, which depends on
fiddle
As `fiddle` needs `libffi-devel` to build.
pablomh
force-pushed
the
rootless_2
branch
2 times, most recently
from
February 26, 2026 18:43
ee54c1f to
f86be44
Compare
Introduces the rootless_user role and base configuration for running Foreman services as an unprivileged user instead of root. Key changes: - New rootless_user role: Creates dedicated foremanctl user with proper UID/GID mapping for container namespaces - Enable systemd user lingering: Ensures services persist across reboots - Subuid/subgid verification: Validates namespace mapping configuration - Base variable definitions: Defines foremanctl_user, paths, and XDG_RUNTIME_DIR This provides the foundation for rootless Podman container deployment. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Modifies certificate issuance to support rootless user context, ensuring certificates are accessible within the unprivileged user's namespace. Key changes: - Generate certificates in user-accessible paths - Update certificate ownership for rootless user - Adjust certificate permissions for container access - Document rootless certificate handling Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updates PostgreSQL role to run as rootless container under the foremanctl user with proper namespace mapping and permissions. Key changes: - Run PostgreSQL container as unprivileged user - Use systemd in user mode for service management - Map data directories to container UID/GID via podman unshare - Configure XDG_RUNTIME_DIR for rootless operations - Add service reload handlers Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updates Redis role to run as rootless container under the foremanctl user with proper namespace mapping. Key changes: - Run Redis container as unprivileged user - Use systemd in user mode for service management - Map data directories to container UID/GID - Configure XDG_RUNTIME_DIR for rootless operations - Add service reload handlers Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updates Candlepin role to run as rootless container under the foremanctl user, including Artemis message broker configuration. Key changes: - Run Candlepin container as unprivileged user - Use systemd in user mode for service management - Configure Artemis broker for rootless context - Update certificate paths for user namespace - Add service reload handlers Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updates Pulp role to run all Pulp services (API, content, workers) as rootless containers under the foremanctl user. Key changes: - Run Pulp containers as unprivileged user - Use systemd in user mode for service management - Map data directories to container UID/GID - Configure worker service templates for rootless context - Add service reload handlers Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updates Foreman role to run as rootless container under the foremanctl user, including sidekiq and recurring task services. Key changes: - Run Foreman containers as unprivileged user - Use systemd in user mode for service management - Configure dynflow-sidekiq workers for rootless context - Set up recurring task timers in user scope - Add service reload handlers - Update HTTP/HTTPS ports for rootless access Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updates Foreman Proxy role to run as rootless container under the foremanctl user with proper certificate and configuration access. Key changes: - Run Foreman Proxy container as unprivileged user - Use systemd in user mode for service management - Update certificate paths for user namespace - Configure proxy settings for rootless context - Add service reload handlers Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updates systemd_target role to create foreman.target in user scope for managing all Foreman services as a unit. Key changes: - Create foreman.target in user systemd directory - Configure target dependencies for rootless services - Use systemd in user mode for target management Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Provides automated migration from existing rootful Foreman deployments to rootless mode, preserving all data and configuration. Key features: - Stop and backup rootful deployment - Transfer volume ownership using podman unshare - Remove rootful systemd units and Quadlets - Deploy rootless configuration - Verify services are running correctly - Generate migration report with rollback instructions Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updates all deployment playbooks to include rootless_user role and configure proper execution context. Key changes: - Add rootless_user role to deployment sequence - Update pull-images playbook for rootless context - Configure development playbooks for rootless mode - Ensure proper ordering of rootless setup Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Allow Python 3.9 to open text/x-python files in /var/tmp/ to fix Ansible module execution issues with fapolicyd enabled.
Updates all test fixtures and assertions to work with rootless container deployment. Key changes: - Add user fixture to provide foremanctl_user context - Update service status checks to query user systemd - Modify container inspection to use rootless Podman - Adjust path expectations for user-scoped resources - Update test helpers for XDG_RUNTIME_DIR context Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updates GitHub Actions workflow to pass rootless user context to tests and use proper systemctl invocation for user services. Key changes: - Pass --user=foremanctl to pytest for rootless test context - Use systemctl --machine=foremanctl@ --user for service control - Ensure tests run against rootless deployment Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
These packages provide the network stack, DNS resolution, and improved port forwarding required for custom networks in rootless Podman deployments. - netavark: Modern network stack for Podman 4+ - aardvark-dns: DNS server for container name resolution - passt: High-performance port forwarding alternative to slirp4netns
Tests verify: - Network packages installation (netavark, aardvark-dns, pasta) - Podman using netavark backend - Rootless user can create private networks - DNS resolution between containers via aardvark-dns
Provides a reusable role to create custom Podman networks in rootless deployments. Supports configuration of: - Network driver and topology - Custom subnets and gateways - DNS servers - Internal-only networks - IPv6 support - Network options and labels Networks enable container-to-container communication via DNS names provided by aardvark-dns.
Tests verify: - Network creation via the role - Network properties (driver, DNS enabled) - Container-to-container connectivity using DNS names - Multi-network container support - Network isolation between separate networks - Custom subnet and gateway configuration All tests are designed for rootless mode and handle cleanup.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enables Foreman deployment using rootless Podman containers, improving security by eliminating root privileges for container operations while maintaining full functionality of the Foreman/Katello stack.
What this achieves:
New capabilities:
This change modernizes the deployment model to follow container security best practices while maintaining backward compatibility through the migration playbook.