docker: add podman as container runtime for Buster

roles/base/tasks/apt.yml

@@ -65,7 +65,6 @@
       - rsync
       - git
       - python-pip
-      - python-docker
       - ntp
       - openssl
       - curl
@@ -77,16 +76,6 @@
       - restic
       - runcron
 
-# With the default credentials handler 'docker login' stops working with:
-# error getting credentials - err: exit status 1, out: Cannot autolaunch
-# D-Bus without X11 $DISPLAY
-# See also https://bugs.debian.org/910823
-- name: Fix docker login on Buster
-  file:
-    state: absent
-    path: /usr/bin/docker-credential-secretservice
-  when: float_debian_dist == 'buster'
-
 - name: Install Stretch packages
   apt:
     name: "{{ packages }}"
@@ -95,6 +84,7 @@
     packages:
       - apt-transport-https
       - liblz4-tool
+      - python-docker
   when: float_debian_dist == 'stretch'
 
 - name: Install Buster packages

roles/docker/defaults/main.yml

@@ -3,6 +3,8 @@
 docker_registry_url: ""
 docker_registry_username: ""
 docker_registry_password: ""
+
+# The following options are not used on >= Buster
 docker_daemon_config:
   log-driver: "local"
   log-opts:

roles/docker/files/registries.conf

+# Dummy file to mute podman's warning
+# WARN[0000] unable to find /etc/containers/registries.conf. some podman (image shortnames) commands may be limited

roles/docker/tasks/buster_upgrade.yml

+- name: Remove docker.com GPG key
+  apt_key:
+    id: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
+    url: https://download.docker.com/linux/debian/gpg
+    state: absent
+
+- name: Remove docker.com package repository
+  apt_repository:
+    repo: "deb [arch=amd64] {% if apt_proxy is defined %}http://{{ apt_proxy }}/HTTPS/{% else %}https:{% endif %}//download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
+    state: absent
+
+- name: Remove docker packages
+  apt:
+    name: "{{ packages }}"
+    state: absent
+  vars:
+    packages:
+      - docker-ce
+      - systemd-docker
+
+- name: Remove docker files
+  file:
+    dest: "{{ item }}"
+    state: absent
+  with_items:
+    - /etc/docker
+    - /usr/local/bin/docker-cleanup
+    - /etc/cron.d/docker-cleanup

roles/docker/tasks/docker.yml

+# TODO: switch to keyserver once the apt_key --no-tty bug in Ansible is fixed.
+- name: Install docker.com GPG key
+  apt_key:
+    id: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
+    url: https://download.docker.com/linux/debian/gpg
+    state: present
+
+- name: Install docker.com package repository
+  apt_repository:
+    repo: "deb [arch=amd64] {% if apt_proxy is defined %}http://{{ apt_proxy }}/HTTPS/{% else %}https:{% endif %}//download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
+    state: present
+
+- file:
+    path: "/etc/docker"
+    state: directory
+
+- name: Configure docker daemon
+  template:
+    src: daemon.json.j2
+    dest: /etc/docker/daemon.json
+  notify:
+    - restart docker
+
+- name: Install docker packages
+  apt:
+    name: "{{ packages }}"
+    state: present
+  vars:
+    packages:
+      - docker-ce
+      - systemd-docker
+

roles/docker/tasks/main.yml

 ---
 
-# TODO: switch to keyserver once the apt_key --no-tty bug in Ansible is fixed.
-- name: Install docker.com GPG key
-  apt_key:
-    id: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
-    url: https://download.docker.com/linux/debian/gpg
-    state: present
-
-- name: Install docker.com package repository
-  apt_repository:
-    repo: "deb [arch=amd64] {% if apt_proxy is defined %}http://{{ apt_proxy }}/HTTPS/{% else %}https:{% endif %}//download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
-    state: present
+- set_fact:
+    container_runtime: "podman"
 
-- file:
-    path: "/etc/docker"
-    state: directory
+- set_fact:
+    container_runtime: "docker"
+  when: "float_debian_dist == 'stretch'"
 
-- name: Configure docker daemon
-  template:
-    src: daemon.json.j2
-    dest: /etc/docker/daemon.json
-  notify:
-    - restart docker
-
-- name: Install docker packages
-  apt:
-    name: "{{ packages }}"
-    state: present
-  vars:
-    packages:
-      - docker-ce
-      - systemd-docker
+- include_tasks: buster_upgrade.yml
+  when: "float_debian_dist == 'buster'"
+
+- include_tasks: docker.yml
+  when: "container_runtime == 'docker'"
+
+- include_tasks: podman.yml
+  when: "container_runtime == 'podman'"
 
 - name: Login to the Docker registry
   command: docker login -u "{{ docker_registry_username }}" -p "{{ docker_registry_password }}" "{{ docker_registry_url }}"

roles/docker/tasks/podman.yml

+---
+
+# TODO: switch to keyserver once the apt_key --no-tty bug in Ansible is fixed.
+- name: Install project atomic PPA GPG key
+  apt_key:
+    id: 018BA5AD9DF57A4448F0E6CF8BECF1637AD8C79D
+    url: 'https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x8becf1637ad8c79d'
+    state: present
+
+- name: Install project atomic PPA repository
+  apt_repository:
+    repo: "deb http://ppa.launchpad.net/projectatomic/ppa/ubuntu disco main"
+    state: present
+
+- name: Install podman packages
+  apt:
+    name: "{{ packages }}"
+    state: present
+  vars:
+    packages:
+      - podman
+
+- name: Symlink podman to docker
+  file:
+    src: /usr/bin/podman
+    dest: /usr/bin/docker
+    state: link
+
+- name: Install podman registries.conf
+  copy:
+    dest: /etc/containers/registries.conf
+    src: registries.conf

roles/docker/tasks/start.yml

@@ -59,6 +59,13 @@
         name: "{{ container.image }}"
         force: true
       register: docker_image
+      when: "container_runtime == 'docker'"
+
+    - name: Pull the Docker image {{ container.image }}
+      # Ansible >= 2.8 ships with podman_image
+      command: "podman pull {{ container.image }}"
+      register: podman_image
+      when: "container_runtime == 'podman'"
 
     - name: Start the systemd unit {{ systemd_service }}
       systemd:

roles/docker/templates/run.sh.j2

@@ -55,7 +55,29 @@ for gid in $(id -G {{ container_user }}); do
 done
 {% endif %}
 
+{% if container_runtime == 'podman' %}
+# Remove 'created' (but never started) and 'exited' containers to avoid name conflicts
+podman ps --quiet --all \
+  --filter status=created \
+  --filter name={{ service.name }}-{{ container.name }} \
+  | xargs --no-run-if-empty podman rm
+
+podman ps --quiet --all \
+  --filter status=exited \
+  --filter name={{ service.name }}-{{ container.name }} \
+  | xargs --no-run-if-empty podman rm
+
+exec /usr/bin/podman run --env-host \
+  --cgroup-manager=cgroupfs \
+  --cgroup-parent /system.slice/{{ systemd_service }} \
+  --rm --name {{ service.name }}-{{ container.name }} \
+  $opts \
+  {{ container.image }} {{ container.get('args', '') }}
+{% endif %}
+
+{% if container_runtime == 'docker' %}
 exec /usr/bin/systemd-docker --env run \
   --rm --name {{ service.name }}-{{ container.name }} \
   $opts \
   {{ container.image }} {{ container.get('args', '') }}
+{% endif %}

roles/docker/templates/systemd.j2

 [Unit]
 Description={{ service.name }}/{{ container.name }}
+{% if container_runtime == 'docker' %}
 After=docker.service
 Requires=docker.service
+{% endif %}
 
 [Service]
 EnvironmentFile=-/etc/default/{{ service.name }}-{{ container.name }}
@@ -22,4 +24,5 @@ CPUQuota={{ 100 * container.resources.cpu }}%
 LimitNOFILE=65535
 
 [Install]
-WantedBy=multi-user.target docker.service
+WantedBy=multi-user.target {{ 'docker.service' if container_runtime == 'docker' else '' }}
+Alias={{ service.name }}-{{ container.name }}

test/integration-test-docker.yml

@@ -13,6 +13,11 @@
       docker_image:
         name: registry.git.autistici.org/ai3/float:integration-test
         force: true
+      when: "float_debian_dist == 'stretch'"
+
+    - name: Setup test Docker image
+      command: "podman pull registry.git.autistici.org/ai3/float:integration-test"
+      when: "float_debian_dist != 'stretch'"
 
     - name: Run tests
-      command: docker run --mount type=bind,source=/tmp/test-config.yml,destination=/test-config.yml registry.git.autistici.org/ai3/float:integration-test
+      command: docker run --net host --mount type=bind,source=/tmp/test-config.yml,destination=/test-config.yml registry.git.autistici.org/ai3/float:integration-test