@tamorgen said in Advice reqeusted to migrate MSR from Bare Metal to Container:
Any advice?
I know nothing about Podman and can't provide much help there, but I can tell you how the Docker images are built, and you can probably use that info to help with building your own Podman images.
The biggest structural difference between bare-metal and the docker image is that all of the writable subdirectories are moved to /var/reactor
within the image. They do not live under the Reactor install directory as they do in a bare-metal system. This is done by setting the REACTOR_DATA_PREFIX
environment variable within the image to /var/reactor
. Reactor will apply this prefix when it goes hunting for those data directories: config
, storage
, logs
, ext
, and locales
. In the case of docker, it's then easy to bind this /var/reactor
directory inside the image to a user directory on the real user file system outside the image (a thing docker does). The goal is that no writable directory lives inside the eventual container, and this is important, because the container is temporary — it is destroyed and recreated when the image is updated, and possibly even when the container is stopped, and if your writable data was in there, you'd lose your entire configuration and states every time. When a docker user installs Reactor, they create a directory (usually in their home directory) to house all this data. They configure the container to map /var/reactor
inside the container to this data directory outside the container, so whenever Reactor writes to configuration or storage, it ends up writing to files inside that data directory. If the container is deleted and recreated, that data isn't lost because it's now living outside the container.
Reactor runs as root
inside the Docker container. This is a legacy docker-ism. Containers exist so that things could be run as root
but still be... well, contained... prevented from fully exercising root
's (absolute) power over other things in the host system. Within the docker container, Reactor runs as root
but it's only going to be able to manipulate things inside the container. It can't stop other system processes, take over system devices that haven't been configured for it, or go mad infecting or deleting files outside the container. Podman apparently likes to run tasks in user land (i.e. as a user other than root
), and this is something you'll need to research how to handle. That may also determine where inside the image you choose to put the Reactor build itself.
Under docker specifically, Reactor is aware that it's running in a container, because I manipulate data inside the image so it will know that, but it's just informational. It doesn't modify its behavior in any meaningful way, so you won't need to change anything else about Reactor, I think.
I think the long pole here is that you're going to have to create your own image to use with Podman. I don't think it will use docker images directly. There is some suggestion that you can run a docker container inside a Podman container or something to that effect, but that sounds to me like it will complicate your configuration and therefore your troubleshooting when things aren't going well, and I don't recommend it. Your Podman image/container will need to have all of the same dependencies resolved as a bare-metal install, so the image needs to have a good version of nodejs (LTS, 20+) and all of the npm
package dependencies installed. You will likely need to configure some kind of virtual network interface that the running container will use internally to access the network externally, etc. (this is simpler than it sounds, but necessary for LAN and WAN access).
A key consideration before you venture forth may be this: I don't use or support Podman, and am not likely to. I have enough work handling the configurations I do support. You would be making yourself the subject matter expert in this community for Podman. That could be very good if you're the kind of person who loves to dig in themselves when things aren't working and figure it out, build up a knowledge base, and start using it to help others, track to my build releases and keep your images fresh. But otherwise, you could end up in the "I used a bunch of Google search/AI results full of commands I don't understand to build something complicated that I don't understand, and it has been working since _______ but doesn't work today; WAF is low" mode, and your only paths forward would be (a) more Google/AI spelunking, or (b) fall back to one of the supported configurations.