Dustin C. Hatch
eb79f6ea83
Podman 4 puts lock files in the configuration directory for [some stupid
reason][0]. There are so many issues here!
* It is now impossible to run `podman` as root with a read-only `/etc`.
* Why does it need the lock file at all when using `--network=host`?
Luckily, we can work around it fairly easily by mounting a tmpfs
filesystem over the directory it wants to put the lock file in. This
pretty much defeats the purpose of having a lock file, but it's likely
not needed anyway.
[0]: 836fa4c493
36 lines
1015 B
Django/Jinja
36 lines
1015 B
Django/Jinja
[Unit]
|
|
Description=Frigate
|
|
|
|
[Service]
|
|
Type=notify
|
|
NotifyAccess=all
|
|
ExecStartPre=-/usr/bin/podman container rm --ignore -f frigate
|
|
ExecStart=/usr/bin/podman run \
|
|
--pull never \
|
|
--sdnotify=conmon --cgroups=no-conmon \
|
|
--rm \
|
|
--network=host \
|
|
--name frigate \
|
|
-v /etc/frigate/frigate.yml:/config/config.yml:ro \
|
|
-v /var/lib/frigate/tmp:/tmp:Z \
|
|
-v /var/lib/frigate:/media/frigate:Z \
|
|
--uidmap 0:{{ frigate_user.uid }}:1 \
|
|
--gidmap 0:{{ frigate_user.group }}:1 \
|
|
--uidmap 1:6000001:1024 \
|
|
--gidmap 1:6000001:1024 \
|
|
--uidmap 65534:6001025:1 \
|
|
--gidmap 65534:6001025:1 \
|
|
{% if frigate_shm_size|d %}
|
|
--shm-size {{ frigate_shm_size }}m \
|
|
{% endif %}
|
|
docker.io/blakeblackshear/frigate:{{ frigate_image_tag }}
|
|
ProtectSystem=full
|
|
{% if ansible_distribution == 'Fedora' and ansible_distribution_version|int >= 36 %}
|
|
TemporaryFileSystem=/etc/containers/networks
|
|
ReadWritePaths=/etc/containers/networks
|
|
{% endif %}
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|