[DEMO] A Podman Unit (Quadlet/SystemD) example

[jyxjjj]

说明

当前OpenList镜像未发布，请等待发布后使用，此处仅为demo。

Pull=never 需要手动更新镜像

其他配置带#部分仅供参考

更多文档： https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html

Demo

[Unit]
Description=OpenList Container
StartLimitInterval=30s
StartLimitBurst=3
# After=mariadb.service

[Container]
ContainerName=OpenList
# Image=openlistteam/openlist:v*
Pull=never

Timezone=Etc/GMT-8
Environment=TZ=Etc/GMT-8
Environment=PGID=0
Environment=PUID=0
Environment=UMASK=022

# Volume=/www/server/mariadb/data/mysql.sock:/tmp/mysql.sock
Volume=/www/server/openlist/:/opt/openlist/data/
# Volume=/NAS/:/data/:ro

Network=podman
NetworkAlias=openlist
HostName=openlist
# IP=10.88.0.4

HealthCmd=none

StopTimeout=10

AddHost=al.nn.ci:169.254.0.1
AddHost=alist.nn.ci:169.254.0.1
AddHost=alistgo.com:169.254.0.1
AddHost=api-my-api-5hw5ou-b810d8-80-75-218-107.traefik.me:169.254.0.1
AddHost=api.nn.ci:169.254.0.1
AddHost=api-cf.nn.ci:169.254.0.1
AddHost=api.xhofe.top:169.254.0.1
AddHost=contrib.nn.ci:169.254.0.1
AddHost=jsd.nn.ci:169.254.0.1
AddHost=musl.nn.ci:169.254.0.1


Sysctl=net.ipv6.conf.all.disable_ipv6=1
Sysctl=net.ipv6.conf.default.disable_ipv6=1
Sysctl=net.ipv6.conf.lo.disable_ipv6=1
Sysctl=net.ipv4.conf.all.rp_filter=0
Sysctl=net.ipv4.conf.default.rp_filter=0
Sysctl=net.ipv4.conf.default.arp_announce=2
Sysctl=net.ipv4.conf.lo.arp_announce=2
Sysctl=net.ipv4.conf.all.arp_announce=2
Sysctl=net.ipv4.tcp_max_tw_buckets=5000
Sysctl=net.ipv4.tcp_syncookies=1
Sysctl=net.ipv4.tcp_max_syn_backlog=2048
Sysctl=net.core.somaxconn=51200
Sysctl=net.ipv4.tcp_synack_retries=2
Sysctl=net.ipv4.tcp_fastopen=3

Ulimit=nofile=65535:65535

CgroupsMode=enabled

UIDMap=0:1001:1
GIDMap=0:1001:1
UIDMap=1000:1000:1
GIDMap=1000:1000:1

[Service]
User=root
Group=root
Restart=always
RestartSec=5s
TimeoutStartSec=15

[Install]
WantedBy=multi-user.target

[jyxjjj]

这个UIDMap在新版(截止今天Beta)会有问题。
理论上应该0永远映射0，1001映射执行用户的。
目前在老版本出现无法pipe新的bash的问题。
于是才改了今天的beta。

[jyxjjj]

Update:

Warning:

CgroupsMode=enabled

May cause dependent services to fail during system shutdown. Container processes can be terminated through independent libpod scopes before dependent services finish stopping, despite correct systemd ordering dependencies.

Recommendation: Use CgroupsMode=split (the Quadlet default) to keep container processes within the service's cgroup hierarchy and avoid this shutdown ordering issue.