Using Podman Quadlets

[am4c130d]

Thank you for the docker instance. I've played with it in docker, but have settled on using Podman as podman is installed by default on my Linux system.

I wanted a way of running roonbridge as a root process so I could switching between user accounts without interrupting or needing to reload my music.

I wanted to share the quadlet I created:

[Unit]
Description=Rootful roonbridge running in background

[Container]
ContainerName=roonbridge
Image=giof71/roon-bridge:latest
Volume=/dev/snd:/dev/snd
Volume=/run/udev:/run/udev:ro
Network=host
PodmanArgs=--privileged

[Service]
Restart=always

[Install]
WantedBy=multi-user.target

Save the file as roonbridge.container and copy it to /etc/containers/systemd/
then execute

sudo systemctl daemon-reload
sudo systemctl start roonbridge.service

This launches it as a rootful container which works across all users and supports hot-plugging USB DACs.

For me, this is much cleaner than docker - no Podman process and the systemd container is very simple and clean.

[GioF71]

Hello, thank you for sharing this!

I have created systemd unit for docker containers in the past (see e.g. here even if it's old stuff now).
But quadlets are so neat. I think I will make use of this technology.

I prefer to run in user mode, and maybe enabling lingering if I want the service to be independent of the login status (so it starts even before you login, useful for a server or headless system especially).

Also I have a few questions and considerations. Some things I cannot directly verify because right now I don't have a Roon subscription running.

About usb hot-plugging: is that why you mapped /run/udev ? If this is valid for docker as well, I will update the README file.

About this:

Volume=/dev/snd:/dev/snd

it did not work for me. I had to replace it with:

AddDevice=/dev/snd

which also seems appropriate as it's about a set of devices. Does this work for you as well?

This other line:

PodmanArgs=--privileged

does not seem to be strictly necessary... but again, I can't really verify on my system right now.

[am4c130d]

One difference may be distro. I use Kalpa, which is an immutable derivative of OpenSUSE Tumbleweed - and it appears to be pretty locked down from an SE Linux perspective. Podman is installed by default in Kalpa which is why I used podman, and I am under the impression podman and docker can be used interchangeably.

I mapped /run/udev and used Volume=/dev/snd to get the hot-plugging behavior I wanted. When I was thinking this through/experimenting, I found treating /dev/snd as a volume that contained devices was more reliable than mapping it as a device. Though, I have not gone back and definitively proven I have to use volume and not device. It's plausible that using volume requires /run/udev. I have not tested docker vs podman for this though, but I assume what works for one, works for the other.

PodmanArgs=--privileged

Was the result of lots of troubleshooting. On Kalpa, without --privileged hot-plugging did not work for the quadlet or running podman run from a systemd service. But hot-plugging worked fine without it if I used podman run as a user. I concluded that despite being a network attached, rootful container - it was limited to writing to /dev/snd, so the attack surface was modest enough for me.

I also tried user mode with linger. I found I had to be logged in for the devices to be available to the user - probably an SE Linux issue. I would see the devices appear and disappear from the RoonServer logs depending on whether I was logged in or not - but the roonbridge remained connected the whole time.