2 Podman

Caffeine Fueled edited this page 2025-10-01 19:19:06 +00:00

Table of Contents

• Example Healthcheck
• Limit resources from host system
• Hardening

Example Healthcheck

podman run -d --name web \
  --health-cmd='curl "http://192.168.250.250:3001/api/push/FHahMOAw7p?status=up&msg=OK&ping=" || exit 1' \
  --health-interval=60s \
  --health-timeout=3s \
  --health-retries=3 \
  nginx:alpine

---

Limit resources from host system

    --cpus=0.3 \
    --memory=2g \
    --memory-swap=2.5g \
    --cpu-shares=512 \

---

Hardening

    --read-only \
    --security-opt no-new-privileges \
    --cap-drop ALL \
    --cap-add=CHOWN \
    --cap-add=NET_BIND_SERVICE \
    --cap-add=SETGID \
    --cap-add=SETUID \

Tempfs examples

    --tmpfs /tmp:rw,size=256m \
    --tmpfs /var/cache/fontconfig:rw,size=32m \
    --tmpfs /usr/share/tessdata:rw,size=256m \
    --tmpfs /configs:rw,size=16m \
    --tmpfs /customFiles:rw,size=64m \
    --tmpfs /logs:rw,size=64m \
    --tmpfs /pipeline:rw,size=128m \
    --tmpfs /home/stirlingpdfuser:rw,size=32m \