Works with podman

[MarDiehl]

these changes make the file compatible with podman compose, which allows to run NOMAD without root.

commands are

podman system service -t 0 unix:///tmp/podman.sock &
podman-compose up -d
curl localhost:8080/nomad-oasis/alive

Changes are minimal and easy to understand. However, I believe that most changes are not compatible with docker.

[blueraft]

Thanks for the PR. Since this is draft, I guess this is not ready for review yet?

However, I believe that most changes are not compatible with docker.

Can you say why these are not compatible with docker?

[MarDiehl]

Thanks for the PR. Since this is draft, I guess this is not ready for review yet?

However, I believe that most changes are not compatible with docker.

Can you say why these are not compatible with docker?

The changes are required because Docker requires root, Podman not.

• userns_mode: "keep-id:uid=1000,gid=1000": Not sure if Docker knows userns_mode. In any case, it is a fix for UID=1000 and would need to be parameterized to use the UID of the current user. If Docker ignores the option and there is the possibility to automatically use the correct UID, the fix would IMHO be reasonable.
• "${DOCKER_SOCKET:-/tmp/podman.sock}:/var/run/docker.sock:rw": The default socket is not created with Podman. Either use a common socket name for podman and Docker (e.g. /tmp/nomad-${UID}) or make sure that DOCKER_SOCKET is set when invoking docker compose.
• port remapping: ports < 1024 require root permissions. Using higher ports would also work for Docker, but that would change the behavior and require to explicitly give the port for https connections.
• x-podman: This is Podman specific, so should not be controversial

[MarDiehl]

I read a little bit about user remapping and think that it can be used for a solution that works with Podman and Docker and even make it unnecessary to change the permission of .volumes. I'm not yet clear about the syntax, but conceptually it suffices to map the nomad user ID (1000) to that of the user running ... compose up -d (probably root in the case of Docker).