Container Awareness with Externally Managed Groups in Podman
In this article, we'll discuss how to use Podman's --groups-add and --keep-groups options to manage container groups, taking into account groups that are managed externally.
Podman and Container Groups
Podman (https://podman.io/) is an open-source tool for managing containers, images, and container networks. Containers can be organized into groups for easier management, scaling, and resource allocation. A container group in Podman is a logical collection of containers that share the same network namespace and can communicate with each other over the loopback interface.
Externally Managed Groups
In some cases, you might want to manage container groups externally (e.g., LDAP or an orchestration tool) instead of relying on Podman to manage them. With externally managed groups, you can utilize Podman's container orchestration capabilities while maintaining group management in a centralized location.
Container Awareness with --groups-add and --keep-groups
Podman provides the --groups-add and --keep-groups options to manage container groups externally. With these options, you can add containers to external groups and retain group membership after a container is restarted.
--groups-add
The --groups-add option allows you to add a container to a group at runtime:
$ podman run --groups-add my-external-group my-image
--keep-groups
The --keep-groups option instructs Podman to retain group membership for a container when it's restarted:
$ podman run --keep-groups --groups-add my-external-group my-image
Real-World Use Case
Consider a scenario where you have an LDAP server that manages container groups. You can create container groups in LDAP and then utilize Podman's --groups-add and --keep-groups options to add containers to these groups and retain group membership after container restarts:
$ podman run --keep-groups --groups-add "CN=my-external-group,DC=example,DC=com" my-image
- Podman supports container group management through the
--groups-addand--keep-groupsoptions - These options are useful when managing container groups externally, such as with LDAP or an orchestration tool
- Containers can be added to external groups at runtime and retain group membership after restart