Introduction

X11Docker is a nice command line tool that allows you to run graphical applications inside podman or docker by passing them to xpra or your wayland socket. To do this you first need a Containerfile or Dockerfile to build an image with the application you want to run. In this example I’m going to run telegram-desktop.

Building a Container Image

FROM ubuntu:latest

RUN apt-get update
RUN apt-get install -y telegram-desktop

CMD ["telegram-desktop"]

Running the Application with X11Docker

We build this image with podman build . -t telegram and wait for it to install our packages. When it’s done we can simply run it with x11docker localhost/telegram and it starts Telegram in Xpra.

Running with Wayland

If we wanted to start it under Wayland instead, we could run x11docker --wayland localhost/telegram however the package for Telegram on Ubuntu doesn’t seem to have support for Wayland when I tried it.

This should work for any graphical software, even that which isn’t in the repositories. You can even install more than one piece of software in a single image. Then you pass the CMD as an argument to x11docker like so x11docker localhost/telegram telegram-desktop.

Introduction

Podman^1 has a nice feature called generate that lets you generate different kinds of configuration files for starting pods. One that I use often is podman generate systemd which generates a new user service that can be started with systemctl --user start container-yourcontainer.service or enabled.

Auto-Updating Containers

If you want your container to auto update you can simply pass it the flag --label "io.containers.autoupdate=registry" when you’re creating it. The systemd service will automatically pull the latest versions of containers before starting them. You can manually update your container images now using podman auto-update.

If you want to update your images on a schedule you can enable the podman-auto-update.timer using systemctl --user enable --now podman-auto-update.timer which will auto update your containers every Monday morning.^2

Kubernetes YAML Generation

You can also generate a Kubernetes YAML configurations using podman generate kube. This can then be loaded in Kubernetes to run your containers.

Introduction

Podman^1 is a container management software similar to Docker that can run OCI containers as regular users (not root) by using container management libraries such as crun or runc, and cgroups v1 or v2. It can be used as a drop-in replacement for Docker and supports docker-compose using podman-compose.

Unfortunately for some distributions after installing podman the operating system defaults to cgroups v1 and runc, not cgroups v2 and crun. As was the case on Rocky Linux for me.

Switching to crun

First we can switch to crun instead of runc by installing crun with our package manager. It was already installed for me, but on Fedora you would use sudo dnf install crun

Then you can edit the file /usr/share/containers/containers.conf and change the line runtime = "runc" to runtime = "crun". Now you can verify that you’re using crun with podman info | grep crun.

name: crun
package: crun-0.20.1-1.module+el8.4.0+643+525e162a.x86_64
path: /usr/bin/crun
  crun version 0.20.1

Enabling cgroups v2

Now the harder part was enabling cgroups v2. Luckily I found a comment on a GitHub issue outlining the steps you need to complete to get cgroups v2 to work.

First we can enable it in the kernel with

sudo grubby --update-kernel=ALL --args="systemd.unified_cgroup_hierarchy=1"

Then we can enable linger. This will also allow our containers to remain running after logging out.

sudo loginctl enable-linger codebam

Then the last step which made everything work for me is to set the pid_limit=0. For me it was in /usr/share/containers/containers.conf instead of /etc/containers/.

Verification

Now you can reboot. podman info | grep cgroup should say

cgroupControllers: []
cgroupManager: systemd
cgroupVersion: v2

Now we’re using cgroups v2 and crun.