# Rootless Container mit Podman
podman run --rm -it \
  --userns=keep-id \
  --security-opt label=disable \
  alpine:latest /bin/sh

# User Namespace Mapping
echo "Container läuft als User $(id -u):$(id -g)"
echo "Host User: $(id -u):$(id -g) außerhalb des Containers"

graph TD
    A[Docker Client] --> B[Docker Daemon]
    B --> C[Container Runtime]
    B --> D[Image Management]
    
    E[Podman CLI] --> F[Container Runtime]
    E --> G[Image Management]
    E --> H[Pod Management]
    
    subgraph "Docker Architecture"
    A
    B
    C
    D
    end
    
    subgraph "Podman Architecture"
    E
    F
    G
    H
    end

# Docker (Daemon als Root)
sudo docker run -d nginx
ps aux | grep dockerd  # Läuft als root

# Podman (Rootless)
podman run -d nginx
ps aux | grep podman   # Läuft als normaler User

# Pod mit mehreren Containern erstellen
podman pod create --name webapp-pod \
  --publish 8080:80 \
  --publish 3306:3306

# Frontend Container hinzufügen
podman run -dt --pod webapp-pod \
  --name frontend \
  nginx:alpine

# Backend Container hinzufügen
podman run -dt --pod webapp-pod \
  --name backend \
  node:16-alpine

# Database Container hinzufügen
podman run -dt --pod webapp-pod \
  --name database \
  -e MYSQL_ROOT_PASSWORD=secret \
  mysql:8.0

# Pod Status prüfen
podman pod ps
podman ps --pod

# Kubernetes Manifest aus Pod generieren
podman generate kube webapp-pod > webapp-deployment.yaml

# Generierte YAML anzeigen
cat webapp-deployment.yaml

# Auto-generiert von Podman
apiVersion: v1
kind: Pod
metadata:
  name: webapp-pod
  labels:
    app: webapp-pod
spec:
  containers:
  - name: frontend
    image: nginx:alpine
    ports:
    - containerPort: 80
      protocol: TCP
    resources:
      limits:
        memory: "512Mi"
        cpu: "500m"
      requests:
        memory: "256Mi"
        cpu: "250m"
  - name: backend
    image: node:16-alpine
    env:
    - name: NODE_ENV
      value: production
  - name: database
    image: mysql:8.0
    env:
    - name: MYSQL_ROOT_PASSWORD
      value: secret
    ports:
    - containerPort: 3306
      protocol: TCP

---
# Podman generiert automatisch Services
apiVersion: v1
kind: Service
metadata:
  name: webapp-pod-service
spec:
  selector:
    app: webapp-pod
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
    name: frontend
  - port: 3306
    targetPort: 3306
    protocol: TCP
    name: database
  type: ClusterIP

# Von Podman direkt nach Kubernetes
podman generate kube webapp-pod | kubectl apply -f -

# Oder in Datei speichern und anpassen
podman generate kube webapp-pod > k8s-manifest.yaml
kubectl apply -f k8s-manifest.yaml

# Pod in Kubernetes überprüfen
kubectl get pods
kubectl get services

# Development Environment Setup
mkdir -p ~/dev/k8s-podman-project
cd ~/dev/k8s-podman-project

# Multi-Container Development Pod
podman pod create --name dev-environment \
  --publish 3000:3000 \
  --publish 8080:8080 \
  --publish 5432:5432

# React Frontend (Development)
podman run -dt --pod dev-environment \
  --name react-frontend \
  -v $(pwd)/frontend:/app \
  -w /app \
  node:18-alpine \
  sh -c "npm install && npm run dev"

# Express Backend (Development)
podman run -dt --pod dev-environment \
  --name express-backend \
  -v $(pwd)/backend:/app \
  -w /app \
  node:18-alpine \
  sh -c "npm install && npm run dev"

# PostgreSQL Database
podman run -dt --pod dev-environment \
  --name postgres-db \
  -e POSTGRES_PASSWORD=devpass \
  -e POSTGRES_DB=myapp \
  -v postgres-data:/var/lib/postgresql/data \
  postgres:15-alpine

# Development Tools Container
podman run -dt --pod dev-environment \
  --name dev-tools \
  -v $(pwd):/workspace \
  -w /workspace \
  alpine:latest \
  tail -f /dev/null

# Pod Logs anzeigen
podman pod logs dev-environment

# Einzelne Container logs
podman logs react-frontend
podman logs express-backend

# In Container einsteigen für Debugging
podman exec -it dev-tools /bin/sh

# Netzwerk-Tests zwischen Containern
podman exec react-frontend curl http://localhost:8080/api/health
podman exec express-backend ping postgres-db

# Production Images erstellen
podman build -t myapp/frontend:v1.0 ./frontend
podman build -t myapp/backend:v1.0 ./backend

# Production Pod erstellen
podman pod create --name production-pod \
  --publish 80:80 \
  --publish 443:443

# Production Container starten
podman run -dt --pod production-pod \
  --name frontend-prod \
  myapp/frontend:v1.0

podman run -dt --pod production-pod \
  --name backend-prod \
  -e NODE_ENV=production \
  myapp/backend:v1.0

# Kubernetes Manifest generieren
podman generate kube production-pod > production-deployment.yaml

# Erweiterte Kubernetes-Konfiguration hinzufügen
cat >> production-deployment.yaml << EOF
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: frontend
        image: myapp/frontend:v1.0
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
      - name: backend
        image: myapp/backend:v1.0
        env:
        - name: NODE_ENV
          value: production
        resources:
          requests:
            memory: "512Mi"
            cpu: "500m"
          limits:
            memory: "1Gi"
            cpu: "1000m"
EOF

# User Namespaces aktivieren
echo 'user.max_user_namespaces=28633' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# Podman rootless installation
curl -fsSL https://get.podman.io/rootless.sh | sh

# Podman rootless konfigurieren
podman system migrate
podman info | grep -A 10 "host:"

# Rootless Container mit erweiterten Security-Features
podman run -dt \
  --name secure-app \
  --userns=keep-id \
  --security-opt label=disable \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  --cap-add NET_BIND_SERVICE \
  --read-only \
  --tmpfs /tmp \
  --tmpfs /run \
  nginx:alpine

# Sicherheits-Audit
podman inspect secure-app | jq '.[] | .HostConfig | {
  Privileged,
  CapAdd,
  CapDrop,
  SecurityOpt,
  ReadonlyRootfs
}'

# SELinux-kompatible Container
podman run -dt \
  --name selinux-app \
  --security-opt label=type:container_t \
  --security-opt label=level:s0:c100,c200 \
  alpine:latest

# SELinux Context prüfen
podman exec selinux-app ls -Z /

# .gitlab-ci.yml
stages:
  - build
  - test
  - deploy

variables:
  PODMAN_DRIVER: overlay

before_script:
  - podman info

build:
  stage: build
  script:
    # Multi-stage Build mit Podman
    - podman build -t $CI_REGISTRY_IMAGE/app:$CI_COMMIT_SHA .
    - podman push $CI_REGISTRY_IMAGE/app:$CI_COMMIT_SHA
  only:
    - main
    - develop

test:
  stage: test
  script:
    # Integration Tests mit Podman Pods
    - podman pod create --name test-env
    - podman run -dt --pod test-env --name app $CI_REGISTRY_IMAGE/app:$CI_COMMIT_SHA
    - podman run -dt --pod test-env --name db postgres:13
    - sleep 10
    # Run Tests
    - podman exec app npm test
    - podman exec app npm run e2e
  after_script:
    - podman pod rm -f test-env

k8s-deploy:
  stage: deploy
  script:
    # Kubernetes Deployment mit Podman-generierten Manifests
    - podman pull $CI_REGISTRY_IMAGE/app:$CI_COMMIT_SHA
    - podman tag $CI_REGISTRY_IMAGE/app:$CI_COMMIT_SHA myapp:latest
    - podman pod create --name deploy-pod
    - podman run -dt --pod deploy-pod --name app myapp:latest
    - podman generate kube deploy-pod > k8s-deployment.yaml
    - kubectl apply -f k8s-deployment.yaml
  only:
    - main

# .github/workflows/podman-k8s.yml
name: Podman to Kubernetes
on:
  push:
    branches: [main]

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    
    - name: Setup Podman
      run: |
        sudo apt-get update
        sudo apt-get install -y podman
        
    - name: Build with Podman
      run: |
        podman build -t myapp:${{ github.sha }} .
        
    - name: Create Development Pod
      run: |
        podman pod create --name dev-pod --publish 8080:8080
        podman run -dt --pod dev-pod --name app myapp:${{ github.sha }}
        
    - name: Generate Kubernetes YAML
      run: |
        podman generate kube dev-pod > k8s-manifest.yaml
        cat k8s-manifest.yaml
        
    - name: Deploy to Kubernetes
      run: |
        echo "${{ secrets.KUBECONFIG }}" | base64 -d > kubeconfig
        export KUBECONFIG=kubeconfig
        kubectl apply -f k8s-manifest.yaml

# Docker-Kompatibilität durch Aliases
echo 'alias docker=podman' >> ~/.bashrc
echo 'alias docker-compose=podman-compose' >> ~/.bashrc
source ~/.bashrc

# Bestehende Docker Commands funktionieren
docker run hello-world
docker ps
docker images

# Podman Compose installieren
pip3 install podman-compose

# Bestehende docker-compose.yml verwenden
podman-compose up -d
podman-compose ps
podman-compose logs

# docker-compose.yml (funktioniert mit Podman)
version: '3.8'
services:
  web:
    build: .
    ports:
      - "8080:80"
    environment:
      - NODE_ENV=production
    depends_on:
      - db
  
  db:
    image: postgres:13
    environment:
      - POSTGRES_PASSWORD=secret
    volumes:
      - db_data:/var/lib/postgresql/data

volumes:
  db_data:

# Mit Podman Compose starten
podman-compose up -d

# Kubernetes YAML aus Compose generieren
podman-compose -f docker-compose.yml config | \
  kompose convert -f - -o k8s-manifests/

# Phase 1: Parallel Installation
sudo systemctl stop docker
podman system migrate

# Phase 2: Image Migration
docker save myapp:latest | podman load

# Phase 3: Volume Migration
podman volume create myapp-data
docker run --rm -v myapp-volume:/from -v myapp-data:/to alpine sh -c "cp -a /from/. /to"

# Phase 4: Network Migration
podman network create myapp-network --driver bridge

# Overlay Storage Driver konfigurieren
echo 'storage_driver = "overlay"' >> ~/.config/containers/storage.conf
echo 'mount_program = "/usr/bin/fuse-overlayfs"' >> ~/.config/containers/storage.conf

# Image Layer Caching optimieren
podman system prune -a
podman image prune -a

# Systemd Service für Pod erstellen
podman generate systemd --new --files --name webapp-pod

# Service aktivieren
systemctl --user daemon-reload
systemctl --user enable pod-webapp-pod.service
systemctl --user start pod-webapp-pod.service

# Auto-Start nach Reboot
loginctl enable-linger $USER

# CGroups v2 für bessere Resource Control
podman run -dt \
  --name resource-controlled \
  --memory=512m \
  --cpus=1.5 \
  --pids-limit=100 \
  nginx:alpine

# Resource Usage monitoring
podman stats resource-controlled

# Sicherheits-Template für deutsche Unternehmen
podman run -dt \
  --name production-app \
  --userns=keep-id \
  --security-opt label=disable \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  --cap-add CHOWN \
  --cap-add DAC_OVERRIDE \
  --cap-add SETUID \
  --cap-add SETGID \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,size=100m \
  --tmpfs /run:rw,noexec,nosuid,size=100m \
  -v app-logs:/var/log:rw \
  myapp:latest

# Structured Logging für Compliance
podman run -dt \
  --name gdpr-compliant-app \
  --log-driver journald \
  --log-opt tag=myapp \
  -e LOG_LEVEL=INFO \
  -e GDPR_MODE=enabled \
  myapp:latest

# Log Retention konfigurieren
sudo mkdir -p /etc/systemd/journald.conf.d
echo '[Journal]
MaxRetentionSec=7d
SystemMaxUse=1G' | sudo tee /etc/systemd/journald.conf.d/retention.conf

# Prometheus Metrics für Podman
podman run -dt \
  --name metrics-exporter \
  --publish 9090:9090 \
  -v /proc:/host/proc:ro \
  -v /sys:/host/sys:ro \
  prom/node-exporter \
  --path.procfs=/host/proc \
  --path.sysfs=/host/sys

# Permission Issues
podman unshare chown -R 1000:1000 /path/to/volume

# Network Connectivity Issues
podman network ls
podman network inspect podman

# Storage Issues
podman system df
podman system prune

# Detaillierte Container-Informationen
podman inspect container-name | jq '.[] | {
  Config: .Config,
  NetworkSettings: .NetworkSettings,
  Mounts: .Mounts
}'

# Pod Netzwerk debugging
podman exec -it pod-name ip addr show
podman exec -it pod-name netstat -tulpn