Molecule: Buildah/Podman/CRI-O Virtualization Driver

[ekultails]

Issue Type

• Feature request

Molecule and Ansible details

Ansible 2.7
Molecule 2.19

Molecule installation method (one of):

• pip

Ansible installation method (one of):

• OS package

Desired Behavior

Similar to how the docker driver is setup for creating the virtualized environment using containers, Buildah (or even possibly Podman) support could provide the same functionality without the need of root privileges or the docker daemon via the use of CRI-O.

$ molecule init role --role-name example --driver-name buildah

https://docs.ansible.com/ansible/2.7/plugins/connection/buildah.html

[webknjaz]

cc @TomasTomecek

[webknjaz]

@ekultails seek for ideas @ https://github.com/TomasTomecek/ansible-bender :)

[TomasTomecek]

Related: https://github.com/ansible/ansible/pull/47519

[qinqon]

Hello I am looking to work into this, is someone already doing it ?

[webknjaz]

@qinqon probably not. Feel free to take a crack on it :)

[6sossomons]

Anyone started working on this?

[S1SYPHOS]

This would be highly appreciated!

[ekultails]

Based on some talks in the TripleO community, the CRI-O virtualization driver would actually probably use podman instead of buildah. Both utilize CRI-O instead of docker. The current road block is a wait on a few more Ansible modules to be finished/polished to better support management operations for podman containers.

[ssbarnea]

When implementing this we may want to consider a fallback mecanisms regarding which container virtualization engine to be used. It would be very useful to be able to tell molecule to "use podman if available but fallback to docker if not", especially as availability varies a lot across various platforms.

As far as I know, nobody is working in adding this now which means that we would welcome any help towards this direction.

[sshnaidm]

I created POC for podman support in #2098 and it even works: https://paste.fedoraproject.org/paste/xmcf-jA99t6alKQTQ2S49Q
This patch still requires polish like removing docker-leftovers.
Also you may have problem with ansible podman plugin connection, it may fail because of "permission denied" so you can use my patch to ansible to fix it: https://github.com/ansible/ansible/pull/57741
The question is - do we want to wait until ansible has podman fully supported, or at least the main functionality? Or it's fine to go with this POC path and then to change podman CLI commands step by step as they are introduced in ansible?
Please comment, thanks.

P.S. for using podman you need to specify

driver:
  name: podman

in your molecule playbook.

[ssbarnea]

I tested the above change and seems to be working.