Podman

The kabactl image is a standard OCI image, so it runs under Podman the same way it runs under Docker. This page covers the Podman-specific parts: rootless volumes and systemd integration.

Note

The image is built and tested with Docker. The commands here are the Podman equivalents for the same image.

Run rootless

The container runs as UID 10001. With rootless Podman, map that user to yours so the volume is writable:

podman volume create kaba-data

podman run -d --name kabactl \
  --userns=keep-id:uid=10001,gid=10001 \
  -v kaba-data:/home/kaba/.config \
  -p 127.0.0.1:28832:28832 \
  -p 127.0.0.1:28833:28833 \
  git.djcas9.com/kaba-labs/kabactl/kabactl:latest

On SELinux systems, add :Z to bind mounts of host directories:

-v $HOME/kaba-data:/home/kaba/.config:Z

podman logs -f kabactl
curl -k https://localhost:28832/health

kabactl detects Podman through /run/.containerenv and skips its refuse-to-run-as-root check.

Run commands

podman exec kabactl kabactl doctor
podman exec kabactl kabactl cluster invite --name laptop
podman exec kabactl kabactl cluster join kaba_invite_…

Keep it running with systemd

With Podman 4.4 or newer, describe the container in a Quadlet file and let systemd manage it.

~/.config/containers/systemd/kabactl.container:

[Unit]
Description=Kaba Control
After=network-online.target
Wants=network-online.target

[Container]
Image=git.djcas9.com/kaba-labs/kabactl/kabactl:latest
ContainerName=kabactl
UserNS=keep-id:uid=10001,gid=10001
Volume=kaba-data.volume:/home/kaba/.config
PublishPort=127.0.0.1:28832:28832
PublishPort=127.0.0.1:28833:28833

[Service]
Restart=on-failure
RestartSec=5

[Install]
WantedBy=default.target

~/.config/containers/systemd/kaba-data.volume:

[Volume]

systemctl --user daemon-reload
systemctl --user start kabactl
loginctl enable-linger "$USER"   # keep it running after you log out

Podman as the sandbox back end

On macOS and Windows, kabactl’s tool sandbox talks to a Docker-compatible daemon. Podman’s Docker-compatible socket can serve that role:

podman machine start

On Linux, kabactl uses an OCI runtime directly (runsc, youki, crun or runc) and does not need Docker or Podman for the sandbox. Podman installs crun or runc, so a host with Podman installed usually already has what the sandbox needs.

[todo: confirm Podman socket compatibility for the sandbox on macOS and Windows and document the required DOCKER_HOST setting.]