Ideas about how to run panel with rootless podman and quadlet

[eriksjolund]

I haven't succeeded running panel with rootless podman and quadlets but I have some ideas about how it could be done:

Use the following design

• run the containers in a custom network. Do not use any pods.
• run the http reverse proxy with socket activation to get support for preserved source IP address in TCP connections from the internet. For example Caddy, Traefik and Nginx support socket activation. (Nginx has no official support for socket activation but it should work none the less by setting an environment variable)
• name the containers with ContainerName=
• let the containers connect to each other by using the names defined by ContainerName=. Podman provides has an internal DNS server (aardvark-dns) that can look up the IP address for us

supervisord is used in the docker image https://github.com/pterodactyl/panel/blob/1.0-develop/.github/docker/supervisord.conf

Just a sketchy idea: Maybe it's possible to skip using supervisord and instead run the programs in separate containers? In other words, using the same Image= but different Exec= and possibly different User= and possible different Volume=?

So the idea is to use a custom network and containers without using any pods.

To learn more about the container image I ran

podman network create mynet
podman run --rm --network mynet --name mariadb --env MYSQL_ROOT_PASSWORD=secret  --env MYSQL_PASSWORD=secret docker.io/library/mariadb

and in another shell

podman run --rm --network mynet --name panel --env DB_PASSWORD=secret --env DB_HOST=mariadb ghcr.io/pterodactyl/panel:latest

and in another shell

$ podman exec -ti panel /bin/sh
/app # netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:9000          0.0.0.0:*               LISTEN      22/php-fpm.conf)
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      21/nginx -g daemon 
/app # 

127.0.0.1:9000 will not work when running separate containers in a custom network if another container needs to connect to the port. That would need to be reconfigured to

0.0.0.0:9000

Here are some links about running a http reverse proxy with socket activation and rootless podman:

• https://github.com/eriksjolund/podman-networking-docs?tab=readme-ov-file#http-reverse-proxy-examples
• https://github.com/eriksjolund/podman-caddy-socket-activation
• https://github.com/eriksjolund/podman-nginx-socket-activation
• https://github.com/eriksjolund/podman-traefik-socket-activation

See also the discussion:
Is there any way to retain the source IP addresses in rootless Podman with a created network?
https://www.reddit.com/r/podman/comments/1q2ern3/is_there_any_way_to_retain_the_source_ip/