62 lines
1.8 KiB
YAML
62 lines
1.8 KiB
YAML
---
|
|
# Podman runtime preparation: rootless container support for the admin user.
|
|
|
|
- name: Enable Podman socket activation
|
|
ansible.builtin.systemd:
|
|
name: podman.socket
|
|
enabled: true
|
|
state: started
|
|
when: enable_podman_socket | bool
|
|
|
|
- name: Enable user lingering for rootless containers
|
|
ansible.builtin.command: loginctl enable-linger {{ admin_user }}
|
|
changed_when: false
|
|
when: podman_enable_linger | bool
|
|
|
|
- name: Ensure subuid range for the admin user
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/subuid
|
|
regexp: '^{{ admin_user }}:'
|
|
line: "{{ admin_user }}:{{ podman_subuid_start }}:65536"
|
|
when: podman_manage_subuid | bool
|
|
|
|
- name: Ensure subgid range for the admin user
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/subgid
|
|
regexp: '^{{ admin_user }}:'
|
|
line: "{{ admin_user }}:{{ podman_subgid_start }}:65536"
|
|
when: podman_manage_subgid | bool
|
|
|
|
- name: Persist kernel modules for container networking
|
|
ansible.builtin.copy:
|
|
dest: /etc/modules-load.d/containers.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: "overlay\nbr_netfilter\n"
|
|
|
|
- name: Load overlay kernel module
|
|
ansible.builtin.command: modprobe overlay
|
|
changed_when: false
|
|
|
|
- name: Load br_netfilter kernel module
|
|
ansible.builtin.command: modprobe br_netfilter
|
|
changed_when: false
|
|
|
|
- name: Enable IPv4 forwarding persistently
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/sysctl.d/99-podman.conf
|
|
create: true
|
|
regexp: '^net\.ipv4\.ip_forward'
|
|
line: "net.ipv4.ip_forward = 1"
|
|
mode: "0644"
|
|
|
|
- name: Apply IPv4 forwarding
|
|
ansible.builtin.command: sysctl -w net.ipv4.ip_forward=1
|
|
changed_when: false
|
|
|
|
- name: Configure Podman storage driver
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/containers/storage.conf
|
|
regexp: '^driver\s*='
|
|
line: 'driver = "{{ podman_storage_driver }}"' |