Podman section for documentation

[Tronde]

There seems to be some interest in a Podman section for the documentation. With this PR I'd like to provide one to close #1874.

[ArthurHoaro]

That's really nice!
Maybe it could benefit a small mention in Installation.md?

[nodiscc]

Sorry for the delay, this is still on my radar, I think my last attempt to deploy it with the updated instructions/podman unshare was successful, I will have another look and check if there is a simpler method.

[nodiscc]

Hi, I now have a working Shaarli deployment using rootless podman. Most of what is documented in this PR is correct but could be simplified.

In short, there are 4 possible ways [1] [2] [3] [4] [5] [6] to run podman containers:

• root outside the container/root inside the container
• root outside the container/non-root inside the container
• non-root outside the container/root inside the container
• non-root outside the container/non-root inside the container`

We are obviously aiming for the last solution which provides the most isolation/security.

A non-root user will not have privileges to run chown to alter permissions for the data/cache directory and make them r/w by nginx/php-fpm inside the container, hence the use of podman unshare to accomplish this through user namespaces/UID remapping. However I'd like the user running the container to be a dedicated user account (e.g. shaarli-podman) instead of the interactive user account I'm using to administrate the server - and sudo -u shaarli-podman podman unshare fails as podman unshare cannot be run through sudo (even when sudoing to an unprivileged user...). The alternative would be creating directories on the host, and sudo chown them as 100:101 on the host - but this is not ideal, as it gives 100:101 on the host r/w access to these directories in the container. Once I find how to overcome this limitation I will be able to document a clean and easy way to run Shaarli in rootless podman. I will try to get it working soon.

Also I did a bit of refactoring on the documentation in #2025 (migration to sphinx + reorganization and cleanup). I'd like to merge https://shaarli.readthedocs.io/en/master/Docker.html into https://shaarli.readthedocs.io/en/master/Installation.html as it's just another installation method, and it can be shortened. Once this is done, and as Podman setup steps are extremely similar to Docker, I'd like the podman documentation to also be found on the Installation page. So I'll provide the required changes on top of this PR.

Keeping this open until then.

[Tronde]

Hi @nodiscc,
It has been a while since your last update on this PR.
Are you still working on it?
Is there something you could use a helping hand with? Something to test or verify, mabe?

[nodiscc]

Hi @Tronde, I did a bit of work on this some time ago, made a crude ansible role excerpt here to install a shaarli instance using podman, mostly based on your instructions, I think it was mostly working, so I'd say it's almost good to merge.

What needs to be done here, is merging the podman documentation with the docker one, so that we don't end up with two pages that are 90% duplicates of each other.

I had started working on this a while ago but my draft seems to have been lost 😭 . If you want, you can have a go at it in this PR. The https://shaarli.readthedocs.io/en/master/Docker.html page has a lot of extra (and possibly outdated) information, don't be afraid of removing/cleaning up things.

[Tronde]

What needs to be done here, is merging the podman documentation with the docker one, so that we don't end up with two pages that are 90% duplicates of each other.

…If you want, you can have a go at it in this PR. The https://shaarli.readthedocs.io/en/master/Docker.html page has a lot of extra (and possibly outdated) information, don't be afraid of removing/cleaning up things.

Hi @nodiscc,
I need to think about it. My experience with docker is not as good as with podman. So it could be tricky for me to merge the pages. So please don't wait for me. Anyway when I have some spare time I will look into it. But here we are talking month rather than weeks. :-/