X11Docker is a nice command line tool that allows you to run graphical

applications inside podman or docker by passing them to xpra or your wayland

socket. To do this you first need a Containerfile or Dockerfile to build an

image with the application you want to run. In this example I'm going to run

telegram-desktop.

Building a Container Image

FROM ubuntu:latest

RUN apt-get update
RUN apt-get install -y telegram-desktop

CMD ["telegram-desktop"]

Running the Application with X11Docker

We build this image with podman build . -t telegram and wait for it to

install our packages. When it's done we can simply run it with `x11docker

localhost/telegram` and it starts Telegram in Xpra.

Running with Wayland

If we wanted to start it under Wayland instead, we could run `x11docker

--wayland localhost/telegram` however the package for Telegram on Ubuntu

doesn't seem to have support for Wayland when I tried it.

This should work for any graphical software, even that which isn't in the

repositories. You can even install more than one piece of software in a single

image. Then you pass the CMD as an argument to x11docker like so `x11docker

localhost/telegram telegram-desktop`.

Podman[^1] has a nice feature called generate that lets you generate

different kinds of configuration files for starting pods. One that I use often

is podman generate systemd which generates a new user service that can be

started with systemctl --user start container-yourcontainer.service or

enabled.

Auto-Updating Containers

If you want your container to auto update you can simply pass it the flag

--label "io.containers.autoupdate=registry" when you're creating it. The

systemd service will automatically pull the latest versions of containers

before starting them. You can manually update your container images now using

podman auto-update.

If you want to update your images on a schedule you can enable the

podman-auto-update.timer using `systemctl --user enable --now

podman-auto-update.timer` which will auto update your containers every Monday

morning.[^2]

Kubernetes YAML Generation

You can also generate a Kubernetes YAML configurations using `podman generate

kube`. This can then be loaded in Kubernetes to run your containers.

[^1]: https://podman.io

[^2]: https://fedoramagazine.org/auto-updating-podman-containers-with-systemd/

Podman[^1] is a container management software similar to Docker that can run

OCI containers as regular users (not root) by using container management

libraries such as crun or runc, and cgroups v1 or v2. It can be used as a

drop-in replacement for Docker and supports docker-compose using

podman-compose.

Unfortunately for some distributions after installing podman the operating

system defaults to cgroups v1 and runc, not cgroups v2 and crun. As was the

case on Rocky Linux for me.

Switching to crun

First we can switch to crun instead of runc by installing crun with our package

manager. It was already installed for me, but on Fedora you would use `sudo dnf

install crun`

Then you can edit the file /usr/share/containers/containers.conf and change

the line runtime = "runc" to runtime = "crun". Now you can verify that

you're using crun with podman info | grep crun.

name: crun
package: crun-0.20.1-1.module+el8.4.0+643+525e162a.x86_64
path: /usr/bin/crun
  crun version 0.20.1

Enabling cgroups v2

Now the harder part was enabling cgroups v2. Luckily I found a

comment

on a GitHub issue outlining the steps you need to complete to get cgroups v2 to

work.

First we can enable it in the kernel with

sudo grubby --update-kernel=ALL --args="systemd.unified_cgroup_hierarchy=1"

Then we can enable linger. This will also allow our containers to remain

running after logging out.

sudo loginctl enable-linger codebam

Then the last step which made everything work for me is to set the

pid_limit=0. For me it was in /usr/share/containers/containers.conf instead

of /etc/containers/.

Verification

Now you can reboot. podman info | grep cgroup should say

cgroupControllers: []
cgroupManager: systemd
cgroupVersion: v2

Now we're using cgroups v2 and crun.

[^1]: https://podman.io