Configuring and Verifying Rust‑Based conmon v3 with Podman

on

By the end of this guide, readers will be able to install the Rust‑implemented conmon v3 monitor, configure Podman to use it system‑wide or per‑user, verify the active monitor version, and understand the operational differences and trade‑offs compared with the previous C implementation.

Understanding conmon and Its Role in Podman

Podman delegates the low‑level container lifecycle to an OCI runtime such as crun or runc. Once the runtime has started the container process, a small helper called conmon remains attached to that process. Conmon’s responsibilities include:

  • Relaying standard input, output, and error streams between the container and the invoking Podman command.
  • Providing the endpoint for podman attach operations.
  • Collecting and forwarding container logs to the configured logging driver.
  • Recording the container’s exit status so that Podman can report it to the user.

Historically conmon was written in C (conmon v2). The new conmon v3 replaces that codebase with Rust, aiming to eliminate memory‑safety bugs common in low‑level C programs. Additionally, the Rust version introduces a unified logging‑backend interface, simplifying future extensions and testing of log drivers.

Installing conmon v3

The Rust implementation is packaged as conmon-v3. Installation uses the system package manager; on Fedora the command is:

sudo dnf install conmon-v3

This command adds the /usr/bin/conmon-v3 binary to the system and registers the package in the RPM database. To revert the installation, the same package manager can be used to remove the package:

sudo dnf remove conmon-v3

System‑Wide Configuration

Podman reads its configuration from /etc/containers/containers.conf and any drop‑in files located in /etc/containers/containers.conf.d/. To make conmon v3 the default monitor for all users, create a drop‑in file with the following content:

# /etc/containers/containers.conf.d/99-conmon-v3.conf
[engine]
conmon_path = ["/usr/bin/conmon-v3"]

The conmon_path key expects a JSON‑style array; the array allows future extensions for multiple monitors, but a single entry is sufficient for now. After creating the file, Podman will resolve the monitor path during the next container start. Existing containers continue to use the monitor that was active when they were launched; they are not retroactively switched.

To undo the change, simply delete the drop‑in file:

sudo rm /etc/containers/containers.conf.d/99-conmon-v3.conf

Podman will fall back to the monitor defined in the main configuration file or the compiled default, which is typically the C‑based conmon binary.

Per‑User Override

Individual users may prefer a different monitor without affecting the system default. User‑specific configuration resides in $HOME/.config/containers/containers.conf (or the containers.conf.d directory). To select conmon v3 for a single user, create the following drop‑in:

# $HOME/.config/containers/containers.conf.d/99-conmon-v3.conf
[engine]
conmon_path = ["/usr/bin/conmon-v3"]

The precedence order is: user drop‑ins → user main file → system drop‑ins → system main file. Removing the user drop‑in restores the previous behavior for that account.

Verifying the Active Monitor

Podman provides the podman info command, which reports the path and version of the monitor currently in use. Run the command as a regular user to see the user‑level configuration, and with sudo to inspect the rootful configuration:

podman info --format json | jq '.store.conmon.path, .store.conmon.version'

The expected output should show /usr/bin/conmon-v3 as the path and a version string beginning with “3”. For rootful verification:

sudo podman info --format json | jq '.store.conmon.path, .store.conmon.version'

If the path points to the older binary (commonly /usr/bin/conmon) or the version does not start with “3”, the configuration has not been applied correctly. Double‑check the drop‑in file syntax and ensure the file is readable by the Podman process (typically owned by root with mode 0644).

Testing Conmon v3 Behavior

After confirming that Podman is using conmon v3, start fresh containers to exercise the new monitor. The following checklist helps identify regressions or differences relative to conmon v2:

  • Hangs or missing output: Run a container that produces continuous stdout (e.g., podman run --rm alpine sh -c "while true; do echo tick; sleep 1; done") and attach to it. Verify that output appears promptly and that Ctrl+C terminates cleanly.
  • Incorrect exit status: Execute a container that exits with a non‑zero code (e.g., podman run --rm alpine false) and check that podman ps -a reports the same exit code.
  • CPU usage spikes: Monitor the host’s CPU while a container runs a CPU‑intensive workload (e.g., podman run --rm alpine stress --cpu 2 --timeout 30s). Compare the usage to a baseline run with conmon v2 to spot abnormal consumption.
  • Logging consistency: Enable a logging driver (e.g., journald) and confirm that logs appear in the expected destination without duplication or loss.
  • Interactive sessions: Start an interactive shell (podman run -it --rm alpine sh) and test attach/detach cycles. Ensure that the session remains stable after multiple attach operations.

When a discrepancy is observed, capture the following data for reporting:

# Detailed Podman debug output
podman info --debug

# System journal entries for the container
journalctl -u podman -b | grep

The collected logs, along with the Fedora version, package versions, and a concise reproduction script, constitute a useful bug report for the conmon v3 issue tracker.

Trade‑offs Between conmon v2 and v3

Switching to the Rust implementation offers clear safety benefits. Rust’s ownership model eliminates many classes of memory errors (buffer overflows, use‑after‑free, null dereferences) that have historically required patches in the C codebase. This reduces the attack surface for privilege‑escalation exploits that target the monitor process.

The unified logging backend also simplifies the addition of new log drivers. Projects that need custom log handling can now implement a single interface rather than adapting multiple code paths.

However, administrators should be aware of the following considerations:

  • Binary size and start‑up latency: The Rust binary includes the standard library and may be slightly larger than the C counterpart. In most workloads the difference is negligible, but environments with extremely tight storage constraints should verify the footprint.
  • Maturity of the codebase: Conmon v3 is newer and may still have edge‑case bugs not yet discovered. Maintaining the ability to revert to v2 (by removing the drop‑in) ensures continuity during troubleshooting.
  • Compatibility with third‑party tools: Some external tools parse the monitor path from podman info and may have assumptions about the binary name. Verify that any automation scripts handle the new path gracefully.

Overall, the safety improvements outweigh the modest trade‑offs for most production and development environments. Administrators are encouraged to adopt conmon v3 on a test machine or VM before rolling it out fleet‑wide, using the verification steps described earlier.

Rolling Back to the Previous Monitor

If testing reveals incompatibilities, restoring the original monitor is straightforward. Remove the configuration file that points to conmon v3, then restart any affected containers so that they are launched with the default monitor. The steps are:

# System‑wide revert
sudo rm /etc/containers/containers.conf.d/99-conmon-v3.conf

# User‑specific revert (if applicable)
rm $HOME/.config/containers/containers.conf.d/99-conmon-v3.conf

After removal, new containers will automatically use the monitor defined by the remaining configuration (typically the C‑based conmon). Existing containers continue with the monitor they were started with; stopping and restarting them applies the change.

Source: fedoramagazine.org

Read more
Post a Comment
Subscribe to: Posts (Atom)

Popular Posts

Install Ollama and Open WebUI on Ubuntu 24.04 with NVIDIA GPU Acceleration (Step-by-Step)

Overview Running a local large language model (LLM) is easier than ever thanks to Ollama and Open WebUI. Ollama handles model downloads and inference, while Open WebUI gives you a clean, chat-style interface in your browser. In this tutorial, you'll install both on Ubuntu 24.04 (works on 22.04 too), enable NVIDIA GPU acceleration, and deploy them with Docker Compose. The result is a fast, private AI stack you control. What You'll Need - Ubuntu 24.04 or 22.04 (fresh or existing server/desktop). - An NVIDIA GPU with recent drivers (Turing/RTX or newer recommended). - Root or sudo access. - Open ports 3000 (Open WebUI) and 11434 (Ollama) on your firewall if you access remotely. Step 1: Install NVIDIA Drivers and Verify CUDA First, update your system and install the recommended NVIDIA driver. On Ubuntu Desktop you can use Additional Drivers, but the CLI route is reliable: sudo apt update && sudo apt -y upgrade sudo ubuntu-drivers autoinstall sudo reboot After reboo...

Install a Local AI Chatbot on Ubuntu 24.04 with Ollama and Open WebUI (Step-by-Step)

Running a fast, private AI chatbot on your own computer or server is easier than ever. In this guide, you will install Ollama (a lightweight local LLM runtime) and Open WebUI (a modern web interface) on Ubuntu 24.04 . You will be able to chat with models like Llama 3 or Mistral without sending data to the cloud, and with optional GPU acceleration if you have an NVIDIA card. What you will need : an Ubuntu 22.04/24.04 machine (VM, bare metal, or WSL), at least 8 GB RAM (16 GB recommended for larger models), 15–30 GB free disk space for models, Internet access, and optional NVIDIA GPU drivers for acceleration. Why Ollama + Open WebUI? Ollama manages local large language models (LLMs) with simple commands and sensible defaults. Open WebUI gives you a clean, chat-style interface with features like prompt history, file uploads (for some models), and model switching. Together, they are a simple, reliable stack for a self-hosted AI experience. 1) Update Ubuntu and install basics First, ...

Install Ollama + Open WebUI on Ubuntu 24.04 with NVIDIA GPU Acceleration (Step-by-Step)

Overview This guide shows you how to install Ollama and Open WebUI on Ubuntu 24.04 with NVIDIA GPU acceleration. You will get a fast local AI stack that can run modern large language models (LLMs) like Llama 3 on your own hardware, secured and accessible in a web browser. We will cover GPU driver setup, Docker with the NVIDIA Container Toolkit, Ollama installation, Open WebUI deployment, basic security, and troubleshooting. Prerequisites - A machine running Ubuntu 24.04 (fresh or updated). - An NVIDIA GPU with at least 8 GB VRAM recommended for 8B models (more is better). - Internet access and sudo privileges. Step 1: Install the NVIDIA GPU Driver Install the recommended proprietary driver so CUDA becomes available to both Ollama and containers. sudo apt update && sudo apt install -y ubuntu-drivers-common sudo ubuntu-drivers autoinstall sudo reboot After reboot, verify the GPU is recognized: nvidia-smi You should see a driver version and your GPU model. If not, check...

Trending Now

Homogeneous Nucleation on Mars: A Textbook Process Finally Observed in Nature

on
By the end of this piece, you will understand what the Arsia Mons Elongated Cloud is, why it resisted explanation for several years after its first observation, and what the newly published model reveals about a physical process that has never been directly confirmed on any planet's atmosphere. The cloud that broke the model Every morning during Martian spring and summer, a thin, extremely long cloud forms near the Arsia Mons volcano and gradually elongates until it stretches to more than 1,000 miles before dissipating. The cycle then repeats for several months. The formation was first recorded by a probe in 2018, and from that point onward it became a persistent puzzle for atmospheric scientists working with Mars data. The cloud's geometry, its timing, and its seasonal recurrence all pointed to a real and reproducible physical process, yet no existing model could reproduce it. For a technical audience familiar with simulation work, the situation is analogous to a product...