southalc / podman Goto Github PK

systemctl start podman.socket
systemctl start --user podman.socket

Error: Facter: Error while resolving custom fact fact='podman', resolution='<anonymous>': can't modify frozen String: "Cannot merge \"/run/podman/podman.sock\":String and \"/run/user/0/podman/podman.sock\":String"

service_flags => {
        'new' => ''
}

returns: Error: accepts 1 arg(s), received 2
Failed to call refresh: 'podman generate systemd  --new '' foo 

  1) role::sflow on debian-8-x86_64 Debian is expected to compile into a catalogue without dependency cycles
     Failure/Error: it { should compile.with_all_deps }
       error during compilation: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Unknown variable: 'requires'. (file: /home/test/env/modules/podman/manifests/container.pp, line: 162, column: 21) (file: /home/test/env/design/profile/manifests/sfacctd_tee.pp, line: 4) on node 8b31bfdca048.home
     # ./spec/classes/role__sflow_spec.rb:9:in `block (4 levels) in <top (required)>'

Exec[verify_container_image_element](provider=shell): Executing check '["/bin/sh", "-c", "if podman container exists element\n  then\n  image_name=$(podman container inspect element --format '{{.ImageName}}')\n  running_digest=$(podman image inspect ${image_name} --format '{{.Digest}}')\n  latest_digest=$(skopeo inspect docker://docker.io/vectorim/element-web |     /opt/puppetlabs/puppet/bin/ruby -rjson -e 'puts (JSON.parse(STDIN.read))[\"Digest\"]')\n  [[ $? -ne 0 ]] && latest_digest=$(skopeo inspect --no-creds docker://docker.io/vectorim/element-web |     /opt/puppetlabs/puppet/bin/ruby -rjson -e 'puts (JSON.parse(STDIN.read))[\"Digest\"]')\n  test -z \"${latest_digest}\" && exit 0     # Do not update if unable to get latest digest\n  test \"${running_digest}\" = \"${latest_digest}\"\nfi\n"]'
Debug: Executing: '/bin/sh -c if podman container exists element
then
image_name=$(podman container inspect element --format '{{.ImageName}}')
running_digest=$(podman image inspect ${image_name} --format '{{.Digest}}')
latest_digest=$(skopeo inspect docker://docker.io/vectorim/element-web |     /opt/puppetlabs/puppet/bin/ruby -rjson -e 'puts (JSON.parse(STDIN.read))["Digest"]')
[[ $? -ne 0 ]] && latest_digest=$(skopeo inspect --no-creds docker://docker.io/vectorim/element-web |     /opt/puppetlabs/puppet/bin/ruby -rjson -e 'puts (JSON.parse(STDIN.read))["Digest"]')
test -z "${latest_digest}" && exit 0     # Do not update if unable to get latest digest
test "${running_digest}" = "${latest_digest}"
fi
'
Debug: /Stage[main]/Main/Podman::Container[element]/Exec[verify_container_image_element]: 'true' won't be executed because of failed check 'unless'

Notice: /Stage[main]/MyModule::Openxpki/Podman::Pod[openxpki_pod]/Exec[create_pod_openxpki_pod]/returns: time="2022-08-26T14:30:03-04:00" level=error msg="XDG_RUNTIME_DIR directory \"/run/user/\" is not owned by the current user"
Error: 'podman pod create  --name 'openxpki_pod'  --publish '8443:443'' returned 1 instead of one of [0]
Error: /Stage[main]/MyModule::Openxpki/Podman::Pod[openxpki_pod]/Exec[create_pod_openxpki_pod]/returns: change from 'notrun' to ['0'] failed: 'podman pod create  --name 'openxpki_pod'  --publish '8443:443'' returned 1 instead of one of [0] (corrective)

podman::pod { 'openxpki_pod':
    user    => openxpki,
    flags   => {
        publish  =>  [
            #'8080:80',
            '8443:443',
        ],
    },
}

$user = 'foo'
$user_home = "/var/lib/${user}"
group { $user: system => true }
user { $user:
    home       => $user_home,
    shell      => '/sbin/nologin',
    system     => true,
    managehome => true,    
    require    => Group[$user]
  }
class { 'podman':
    nodocker                 => absent,
    podman_docker_pkg_ensure => absent,
    manage_subuid            => true,
  }
  podman::rootless { $user: }

$user = Deferred(FUNCTION,[OPTION])
 $pw = Deferred(FUNCTION,[OPTION])
$cred = {
  creds => Sensitive(Deferred(sprintf, ['%s:%s', $user, $pw]))
}
podman::image { 'foo':
  ensure => present,
  image => 'REGISTRY/REPO/IMAGE:TAG',
  flags   => $cred
}

Debug: Exec[podman_create_volume_plausible](provider=posix): Executing check 'podman volume inspect plausible'
Debug: Executing with uid=plausible: 'podman volume inspect plausible'
Debug: /Stage[main]/Podman/Podman::Volume[plausible]/Exec[podman_create_volume_plausible]/unless: Error: could not get runtime: error generating default config from memory: cannot mkdir /run/user/0/libpod: mkdir /run/user/0/libpod: permission denied
Debug: Exec[podman_create_volume_plausible](provider=posix): Executing 'podman volume create  plausible'
Debug: Executing with uid=plausible: 'podman volume create  plausible'
Notice: /Stage[main]/Podman/Podman::Volume[plausible]/Exec[podman_create_volume_plausible]/returns: Error: could not get runtime: error generating default config from memory: cannot mkdir /run/user/0/libpod: mkdir /run/user/0/libpod: permission denied
Error: 'podman volume create  plausible' returned 125 instead of one of [0]
Error: /Stage[main]/Podman/Podman::Volume[plausible]/Exec[podman_create_volume_plausible]/returns: change from 'notrun' to ['0'] failed: 'podman volume create  plausible' returned 125 instead of one of [0] (corrective)

  podman:
    containers: {}
    pods: {}
    volumes:
      plausible:
        user: plausible
        homedir: "/home/plausible"
        ensure: present

  accounts:
    group_defaults:
      system: true
    group_list:
      admins: {}
      users: {}
    user_defaults:
      groups:
      - users
      managehome: true
      system: false
    user_list:
      plausible:
        comment: Plausible user
        shell: "/bin/bash"
        groups:
        - users

# @param manage_subuid
#   Should the module manage the `/etc/subuid` and `/etc/subgid` files (default is true)

Boolean $manage_subuid                                = false

---
podman::containers:
  primary-solace:
    image: 'solace/solace-pubsub-standard'
    flags:
      publish:
        - '8080:8080'
        - '50000:50000'
        - '8080:8080'
        - '55555:55555'
        - '55443:55443'
        - '55556:55556'
        - '55003:55003'
        - '2222:2222'
        - '8300:8300'
        - '8301:8301'
        - '8302:8302'
        - '8741:8741'
        - '8303:8303'
      env:
       - 'username_admin_globalaccesslevel="admin"'
       - 'username_admin_password="admin"'
      shm-size:
       - '1g'
    service_flags:
      timeout: '60'

Notice: /Stage[main]/Podman/Podman::Container[primary-solace]/Exec[verify_container_flags_primary-solace]/returns: executed successfully
Notice: /Stage[main]/Podman/Podman::Container[primary-solace]/Exec[verify_container_image_primary-solace]/returns: executed successfully
Notice: /Stage[main]/Podman/Podman::Container[primary-solace]/Exec[podman_remove_container_primary-solace]/returns: Failed to stop podman-primary-solace.service: Unit podman-primary-solace.service not loaded.
 found: no such containeran/Podman::Container[primary-solace]/Exec[podman_remove_container_primary-solace]/returns: Error: no container with name or ID primary-solace
Notice: /Stage[main]/Podman/Podman::Container[primary-solace]/Exec[podman_remove_container_primary-solace]/returns: Error: failed to evict container: "": failed to find container "primary-s found: no such containertainer with name or ID primary-solace
Error: /Stage[main]/Podman/Podman::Container[primary-solace]/Exec[podman_remove_container_primary-solace]: Failed to call refresh: 'systemctl  stop podman-primary-solace || podman container stop --time 60 primary-solace
podman container rm --force primary-solace
' returned 1 instead of one of [0]
Error: /Stage[main]/Podman/Podman::Container[primary-solace]/Exec[podman_remove_container_primary-solace]: 'systemctl  stop podman-primary-solace || podman container stop --time 60 primary-solace
podman container rm --force primary-solace
' returned 1 instead of one of [0]
Notice: /Stage[main]/Podman/Podman::Container[primary-solace]/Exec[podman_remove_image_primary-solace]: Dependency Exec[podman_remove_container_primary-solace] has failures: true
Warning: /Stage[main]/Podman/Podman::Container[primary-solace]/Exec[podman_remove_image_primary-solace]: Skipping because of failed dependencies
Warning: /Stage[main]/Podman/Podman::Container[primary-solace]/Exec[podman_create_primary-solace]: Skipping because of failed dependencies
Warning: /Stage[main]/Podman/Podman::Container[primary-solace]/Exec[podman_generate_service_primary-solace]: Skipping because of failed dependencies
Warning: /Stage[main]/Podman/Podman::Container[primary-solace]/Service[podman-primary-solace]: Skipping because of failed dependencies

# @summary manage podman container and register as a systemd service
#
# @param image
#   Container registry source of the image being deployed.  Required when
#   `ensure` is `present` but optional when `ensure` is set to `absent`.
#
# @param user
#   Optional user for running rootless containers.  For rootless containers,
#   the user must also be defined as a puppet resource that includes at least
#   'uid', 'gid', and 'home' attributes.
#
# @param flags
#   All flags for the 'podman container create' command are supported via the
#   'flags' hash parameter, using only the long form of the flag name.  The
#   container name will be set as the resource name (namevar) unless the 'name'
#   flag is included in the flags hash.  If the flags for a container resource
#   are modified the container will be destroyed and re-deployed during the
#   next puppet run.  This is achieved by storing the complete set of flags as
#   a base64 encoded string in a container label named `puppet_resource_flags`
#   so it can be compared with the assigned resource state.
#   Flags that can be used more than once should be expressed as an array.  For
#   flags which take no arguments, set the hash value to be undef. In the
#   YAML representation you can use `~` or `null` as the value.
#
# @param service_flags
#   When a container is created, a systemd unit file for the container service
#   is generated using the 'podman generate systemd' command.  All flags for the
#   command are supported using the 'service_flags" hash parameter, again using
#   only the long form of the flag names.
#
# @param command
#   Optional command to be used as the container entry point.
#
# @param ensure
#   Valid values are 'present' or 'absent'
#
# @param enable
#   Status of the automatically generated systemd service for the container.
#   Valid values are 'running' or 'stopped'.
#
# @param update
#   When `true`, the container will be redeployed when a new container image is
#   detected in the container registry.  This is done by comparing the digest
#   value of the running container image with the digest of the registry image.
#   When `false`, the container will only be redeployed when the declared state
#   of the puppet resource is changed.
#
# @example
#   podman::container { 'jenkins':
#     image         => 'docker.io/jenkins/jenkins',
#     user          => 'jenkins',
#     flags         => {
#                      publish => [
#                                 '8080:8080',
#                                 '50000:50000',
#                                 ],
#                      volume  => 'jenkins:/var/jenkins_home',
#                      },
#     service_flags => { timeout => '60' },
#   }
#
define podman::container (
  String $image       = '',
  String $user        = '',
  Hash $flags         = {},
  Hash $service_flags = {},
  String $command     = '',
  String $ensure      = 'present',
  Boolean $enable     = true,
  Boolean $update     = true,
){
  #require podman::install

  # Add a label of base64 encoded flags defined for the container resource
  # This will be used to determine when the resource state is changed
  $flags_base64 = base64('encode', inline_template('<%= @flags.to_s %>')).chomp()

  # Add the default name and a custom label using the base64 encoded flags
  if has_key($flags, 'label') {
    $label = [] + $flags['label'] + "puppet_resource_flags=${flags_base64}"
    $no_label = $flags.delete('label')
  } else {
    $label = "puppet_resource_flags=${flags_base64}"
    $no_label = $flags
  }

  # If a container name is not set, use the Puppet resource name
  $merged_flags = merge({ name => $title, label => $label}, $no_label )
  $container_name = $merged_flags['name']

  # A rootless container will run as the defined user
  if $user != '' {
    ensure_resource('podman::rootless', $user, {})
    $systemctl = 'systemctl --user '

    # The handle is used to ensure resources have unique names
    $handle = "${user}-${container_name}"

    # Set default execution environment for the rootless user
    $exec_defaults = {
      path        => '/sbin:/usr/sbin:/bin:/usr/bin',
      environment => [
        "HOME=${User[$user]['home']}",
        "XDG_RUNTIME_DIR=/run/user/${User[$user]['uid']}",
      ],
      cwd         => User[$user]['home'],
      user        => $user,
    }
    $requires = [
      Podman::Rootless[$user],
      Service['systemd-logind'],
    ]
    $service_unit_file ="${User[$user]['home']}/.config/systemd/user/podman-${container_name}.service"

    # Reload systemd when service files are updated
    ensure_resource('Exec', "podman_systemd_${user}_reload", {
        path        => '/sbin:/usr/sbin:/bin:/usr/bin',
        command     => "${systemctl} daemon-reload",
        refreshonly => true,
        environment => [
          "HOME=${User[$user]['home']}",
          "XDG_RUNTIME_DIR=/run/user/${User[$user]['uid']}",
        ],
        cwd         => User[$user]['home'],
        provider    => 'shell',
        user        => $user,
      }
    )
    $_podman_systemd_reload = Exec["podman_systemd_${user}_reload"]
  } else {
    $systemctl = 'systemctl '
    $handle = $container_name
    $service_unit_file = "/etc/systemd/system/podman-${container_name}.service"
    $exec_defaults = {
      path        => '/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin',
    }

    # Reload systemd when service files are updated
    ensure_resource('Exec', 'podman_systemd_reload', {
        path        => '/sbin:/usr/sbin:/bin:/usr/bin',
        command     => "${systemctl} daemon-reload",
        refreshonly => true,
      }
    )
    $requires = []
    $_podman_systemd_reload = Exec['podman_systemd_reload']
  }

  case $ensure {
    'present': {
      if $image == '' { fail('A source image is required') }

      # Detect changes to the defined podman flags and re-deploy if needed
      Exec { "verify_container_flags_${handle}":
        command  => 'true',
        provider => 'shell',
        unless   => @("END"/$L),
                   if podman container exists ${container_name}
                     then
                     saved_resource_flags="\$(podman container inspect ${container_name} \
                       --format '{{.Config.Labels.puppet_resource_flags}}' | tr -d '\n')"
                     current_resource_flags="\$(echo '${flags_base64}' | tr -d '\n')"
                     test "\${saved_resource_flags}" = "\${current_resource_flags}"
                   fi
                   |END
        # notify   => Exec["podman_remove_container_${handle}"],
        require  => $requires,
        *        => $exec_defaults,
      }

      # Re-deploy when $update is true and the container image has been updated
      if $update {
        Exec { "verify_container_image_${handle}":
          command  => 'true',
          provider => 'shell',
          unless   => @("END"/$L),
            if podman container exists ${container_name}
              then
              image_name=\$(podman container inspect ${container_name} --format '{{.ImageName}}')
              running_digest=\$(podman image inspect \${image_name} --format '{{.Digest}}')
              latest_digest=\$(skopeo inspect docker://\${image_name} | \
                /opt/puppetlabs/puppet/bin/ruby -rjson -e 'puts (JSON.parse(STDIN.read))["Digest"]')
              [[ $? -ne 0 ]] && latest_digest=\$(skopeo inspect --no-creds docker://\${image_name} | \
                /opt/puppetlabs/puppet/bin/ruby -rjson -e 'puts (JSON.parse(STDIN.read))["Digest"]')
              test -z "\${latest_digest}" && exit 0     # Do not update if unable to get latest digest
              test "\${running_digest}" = "\${latest_digest}"
            fi
            |END
          # notify   => [
          #   Exec["podman_remove_image_${handle}"],
          #   Exec["podman_remove_container_${handle}"],
          # ],
          require  => $requires,
          *        => $exec_defaults,
        }
      } else {
        # Re-deploy when $update is false but the resource image has changed
        Exec { "verify_container_image_${handle}":
          command  => 'true',
          provider => 'shell',
          unless   => @("END"/$L),
            if podman container exists ${container_name}
              then
              running=\$(podman container inspect ${container_name} --format '{{.ImageName}}' | awk -F/ '{print \$NF}')
              declared=\$(echo "${image}" | awk -F/ '{print \$NF}')
              available=\$(skopeo inspect docker://${image} | \
                /opt/puppetlabs/puppet/bin/ruby -rjson -e 'puts (JSON.parse(STDIN.read))["Name"]')
              test -z "\${available}" && exit 0     # Do not update update if unable to get the new image
              test "\${running}" = "\${declared}"
            fi
            |END
          notify   => [
            Exec["podman_remove_image_${handle}"],
            Exec["podman_remove_container_${handle}"],
          ],
          require  => $requires,
          *        => $exec_defaults,
        }
      }

      # Exec { "podman_remove_image_${handle}":
      #   # Try to remove the image, but exit with success regardless
      #   provider    => 'shell',
      #   command     => "podman rmi ${image} || exit 0",
      #   refreshonly => true,
      #   notify      => Exec["podman_create_${handle}"],
      #   require     => [ $requires, Exec["podman_remove_container_${handle}"]],
      #   *           => $exec_defaults,
      # }

      # Exec { "podman_remove_container_${handle}":
      #   # Try nicely to stop the container, but then insist
      #   provider    => 'shell',
      #   command     => @("END"/L),
      #                  ${systemctl} stop podman-${container_name} || podman container stop --time 60 ${container_name}
      #                  podman container rm --force ${container_name}
      #                  |END
      #   refreshonly => true,
      #   notify      => Exec["podman_create_${handle}"],
      #   require     => $requires,
      #   *           => $exec_defaults,
      # }

      # Convert $merged_flags hash to usable command arguments
      $_flags = $merged_flags.reduce('') |$mem, $flag| {
        if $flag[1] =~ String {
          "${mem} --${flag[0]} '${flag[1]}'"
        } elsif $flag[1] =~ Undef {
          "${mem} --${flag[0]}"
        } else {
          $dup = $flag[1].reduce('') |$mem2, $value| {
            "${mem2} --${flag[0]} '${value}'"
          }
          "${mem} ${dup}"
        }
      }

      # Convert $service_flags hash to command arguments
      $_service_flags = $service_flags.reduce('') |$mem, $flag| {
        "${mem} --${flag[0]} '${flag[1]}'"
      }

      Exec { "podman_create_${handle}":
        command => "podman container create ${_flags} ${image} ${command}",
        unless  => "podman container exists ${container_name}",
        notify  => Exec["podman_generate_service_${handle}"],
        require => $requires,
        *       => $exec_defaults,
      }

      if $user != '' {
        Exec { "podman_generate_service_${handle}":
          command     => "podman generate systemd ${_service_flags} ${container_name} > ${service_unit_file}",
          refreshonly => true,
          notify      => Exec["service_podman_${handle}"],
          require     => $requires,
          *           => $exec_defaults,
        }

        # Work-around for managing user systemd services
        if $enable { $action = 'start'; $startup = 'enable' }
          else { $action = 'stop'; $startup = 'disable'
        }
        Exec { "service_podman_${handle}":
          command => @("END"/L),
                     ${systemctl} ${startup} podman-${container_name}.service
                     ${systemctl} ${action} podman-${container_name}.service
                     |END
          unless  => @("END"/L),
                     ${systemctl} is-active podman-${container_name}.service && \
                       ${systemctl} is-enabled podman-${container_name}.service
                     |END
          require => $requires,
          *       => $exec_defaults,
        }
      }
      else {
        Exec { "podman_generate_service_${handle}":
          path        => '/sbin:/usr/sbin:/bin:/usr/bin',
          command     => "podman generate systemd ${_service_flags} ${container_name} > ${service_unit_file}",
          refreshonly => true,
          notify      => Service["podman-${handle}"],
        }

        # Configure the container service per parameters
        if $enable { $state = 'running'; $startup = 'true' }
          else { $state = 'stopped'; $startup = 'false'
        }
        Service { "podman-${handle}":
          ensure => $state,
          enable => $startup,
        }
      }
    }

    'absent': {
      Exec { "service_podman_${handle}":
        command => @("END"/L),
                   ${systemctl} stop podman-${container_name}
                   ${systemctl} disable podman-${container_name}
                   |END
        onlyif  => @("END"/$L),
                   test "\$(${systemctl} is-active podman-${container_name} 2>&1)" = "active" -o \
                     "\$(${systemctl} is-enabled podman-${container_name} 2>&1)" = "enabled"
                   |END
        notify  => Exec["podman_remove_container_${handle}"],
        require => $requires,
        *       => $exec_defaults,
      }

      Exec { "podman_remove_container_${handle}":
        # Try nicely to stop the container, but then insist
        command => "podman container rm --force ${container_name}",
        unless  => "podman container exists ${container_name}; test $? -eq 1",
        notify  => Exec["podman_remove_image_${handle}"],
        require => $requires,
        *       => $exec_defaults,
      }

      Exec { "podman_remove_image_${handle}":
        # Try to remove the image, but exit with success regardless
        provider    => 'shell',
        command     => "podman rmi ${image} || exit 0",
        refreshonly => true,
        require     => [ $requires, Exec["podman_remove_container_${handle}"]],
        *           => $exec_defaults,
      }

      File { $service_unit_file:
        ensure  => absent,
        require => [
          $requires,
          Exec["service_podman_${handle}"],
        ],
        notify  => $_podman_systemd_reload,
      }
    }

    default: {
      fail('"ensure" must be "present" or "absent"')
    }
  }
}

 # container-52fc759bdd6b25e3a22cb34d6071cace0adda6ae40dce292867321f4f7aaef9d.service
# autogenerated by Podman 4.2.0
# Tue Mar 21 08:07:05 CET 2023

[Unit]
Description=Podman container-52fc759bdd6b25e3a22cb34d6071cace0adda6ae40dce292867321f4f7aaef9d.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
TimeoutStopSec=70
ExecStartPre=/bin/rm -f %t/%n.ctr-id
ExecStart=/usr/bin/podman container run \
        --cidfile=%t/%n.ctr-id \
        --cgroups=no-conmon \
        --rm \
        --sdnotify=conmon \
        -d \
        --replace \
        --name keycloak \
        --label io.containers.autoupdate=registry \
        --label puppet_resource_flags=eyJsYWJlbCI9PlsiaW8uY29udGFpbmVycy5hdXRvdXBkYXRlPXJlZ2lzdHJ5
Il0sICJwdWJsaXNoIj0+Ils6OjFdOjgwODA6ODA4MCIsICJlbnYtZmlsZSI9
PiIvdmFyL2xpYi9rZXljbG9hay9lbnYifQ== \
        --publish [::1]:8080:8080 \
        --env-file /var/lib/keycloak/env quay.io/keycloak/keycloak:21.0.0 start \
        --hostname=foo.foo.foo
ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
Type=notify
NotifyAccess=all

[Install]
WantedBy=default.target

systemd[862]: /var/lib/keycloak/.config/systemd/user/podman-keycloak.service:27: Missing '=', ignoring line.
systemd[862]: /var/lib/keycloak/.config/systemd/user/podman-keycloak.service:31: Unknown key name 'PiIvdmFyL2xpYi9rZXljbG9hay9lbnYifQ' in section 'Service', ignoring

2023-03-21T08:07:05+0100 systemd[862]: podman-keycloak.service: Main process exited, code=exited, status=125/n/a
2023-03-21T08:07:05+0100 podman[14918]: Error: error reading CIDFile: open /run/user/990/podman-keycloak.service.ctr-id: no such file or directory

podman::container { 'foo':
      image => ...,
      user  => <NonRootUser>,
      flags => {
       ....
      }

include podman

$user = 'podman'
$user_home = "/var/lib/${user}"

  group { $user:
    ensure => present,
    gid    => '60000'
  }

  user { $user:
    ensure   => present,
    shell    => '/bin/bash',
    uid      => '60000',
    gid      => '60000',
    home     => $user_home,
    require    => Group[$user]
  } 

  file { 'home_user':
    ensure => directory,
    path   => $user_home,
    mode   => '0755',
    owner  => $user,
    group  => $user,
  }

  podman::rootless { $user: }
 
  podman::subuid { $user:
    subuid => 255666,
    count  => 65535,
   }
 
  podman::subgid { $user:
    subgid => 255666,
    count  => 65535,
  }

  podman::network { 'mynetwork':
    user     => $user,
    driver   => 'bridge',
    internal => true,
  }

Error: /Stage[main]/Podman_all::Configure/Podman::Network[mynetwork]/Exec[podman_create_network_mynetwork]/returns: change from 'notrun' to ['0'] failed: 'podman network create mynetwork --driver bridge     --internal    
' returned 1 instead of one of [0]

Debug: Exec[loginctl_linger_weblate](provider=shell): Executing check '["/bin/sh", "-c", "test $(loginctl show-user weblate --property=Linger) == 'Linger=yes'"]'
Debug: Executing: '/bin/sh -c test $(loginctl show-user weblate --property=Linger) == 'Linger=yes''                              
Debug: /Stage[main]/Profile::Weblate::Podman/Podman::Container[weblate]/Podman::Rootless[weblate]/Exec[loginctl_linger_weblate]/unless: /bin/sh: 1: test: Linger=yes: unexpected operator                                                   
Debug: Exec[loginctl_linger_weblate](provider=shell): Executing '["/bin/sh", "-c", "loginctl enable-linger weblate"]'
Debug: Executing: '/bin/sh -c loginctl enable-linger weblate'