defaults.jinja

{% load_yaml as defaults %}
config:
  containers:
    # /etc/containers/containers.conf
    containers: {}
    network: {}
    engine:
      # crun: OCI runtime with support for cgroup V2
      runtime: "crun"

  storage:
    # /etc/containers/storage.conf
    storage:
      # Primary storage driver
      driver: "overlay"
      runroot: "/run/containers/storage"
      graphroot: "/var/lib/containers/storage"

      # # storage options
      # options:
      #   root-auto-userns-user: containers
      #   overlay:
      #     mount_program: "/usr/bin/fuse-overlayfs"
      #     mountopt: "nodev,metacopy=on"

  mounts:
    # /etc/containers/mounts.conf
    # Global Mounts: The format of the mounts.conf is the volume format /SRC:/DEST,
    # one mount per line. For example, a mounts.conf with the line
    # - "/usr/share/secrets:/run/secrets"
    # would cause the contents of the /usr/share/secrets directory on the host
    # to be mounted on the /run/secrets directory inside the container.
    # Setting mountpoints allows containers to use the files of the host.
    mounts: []

  policy:
    # /etc/containers/policy.json
    # Policy: Manages which registries you trust as a source of container images based on its location.
    # The location is determined by the transport and the registry host of the image.
    # Using this container image docker://docker.io/library/busybox as an example,
    #   docker is the transport and docker.io is the registry host.
    default:
      - type: insecureAcceptAnything
    transports:
      "docker-daemon":
        "":
          - type: insecureAcceptAnything


# settings for containers/init.sls and containers/lib.sls
podman:
  system:
    config_basepath: /etc/containers/podman.config
    workdir_basepath: /etc/containers/podman.service
    build_basepath: /var/lib/containers/podman-build
    service_basepath: /etc/systemd/system
    script_basepath: /usr/local/bin
    desktop_basepath: /usr/local/share/applications
  user:
    config_basepath: ${HOME}/.config/podman.config
    workdir_basepath: ${HOME}/.config/podman.service
    build_basepath: ${HOME}/.local/lib/podman-build
    service_basepath: ${HOME}/.config/systemd/user
    script_basepath: ${HOME}/.local/bin
    desktop_basepath: ${HOME}/.local/share/applications

compose:
  compose_filename: docker-compose.yml
  override_filename: docker-compose.override.yml
  env_filename: .env

  system:
    config_basepath: /etc/containers/podman-compose.config
    workdir_basepath: /etc/containers/podman-compose.service
    build_basepath: /var/lib/containers/podman-compose-build
    service_basepath: /etc/systemd/system
    script_basepath: /usr/local/bin
    desktop_basepath: /usr/local/share/applications
  user:
    config_basepath: ${HOME}/.config/podman-compose.config
    workdir_basepath: ${HOME}/.config/podman-compose.service
    build_basepath: ${HOME}/.local/lib/podman-compose-build
    service_basepath: ${HOME}/.config/systemd/user
    script_basepath: ${HOME}/.local/bin
    desktop_basepath: ${HOME}/.local/share/applications

x11docker:
  # default x11 docker switches
  default:
    - --backend=podman
    - --xpra
  empty: []
  host:
    - --backend=podman
    - --hostdisplay
    - --hostipc
    - --cap-default
    - --clipboard
    - --gpu
    # - --verbose
    # - --webcam

pkg:
  ubuntu:
    source: ppa
    branch: stable {# stable,testing #}
    base:
    - uidmap
    - criu
    - crun
    - cri-o-runc
    - cri-tools
    - containernetworking-plugins
    - slirp4netns
    - fuse-overlayfs
    - skopeo
    - buildah
    - podman
    desktop:
    # x11docker-tools
    - tini
    # x11docker-x11-tools
    - xinit
    - xauth
    - xclip
    - x11-utils
    - x11-xkb-utils
    - x11-xserver-utils
    - xdg-utils
    - xdotool
    - dbus-x11
    - xpra
    - xserver-xephyr
    - weston
    - xwayland
    # x11docker-gpu-tools
    - mesa-utils
    - mesa-utils-extra
    - libxv1
    - va-driver-all
  manjaro:
    base:
    - crun
    - catatonit
    - netavark
    - aardvark-dns
    - buildah
    - podman
    - podman-compose
    - podman-docker
    - docker-compose
    desktop:
    - wtype
    - weston
    - xorg-xwayland
    - podman-desktop
    - podman-tui-git

{% endload %}


{%- set settings = salt['grains.filter_by']({'default': defaults},
  grain='default', default= 'default', merge= salt['pillar.get']('containers', {})) %}


{% load_yaml as default_container %}
# name of the container pod, systemd service, oneshot, command, desktop app
name:

# type: "build", "service", "oneshot", "command", "desktop"
# build   = build or pull image only, will not generate a systemd service
# service = systemd service: create and start command as a systemd service
# oneshot = systemd oneshot service: create a systemd oneshot execute service
# command = create a shell script to call the container from the commandline
# desktop = create a shell script using x11docker to call the container as a gui application
type: service

# name of the container image: x/y[:z]
image:
# optional tag, will be appended to image and on build time
tag: ""

# enabled: if false, service will be stopped, config files are removed
enabled: true
# absent (service, oneshot): if true also remove systemd service files
absent: false
# refresh: if true, container image will be pulled/build on every service start
refresh: true
# ephemeral (service, oneshot, command, desktop): remove existing container before start
ephemeral: true
# Set the user namespace mode for the container. options are "pick","auto","host","private"
# pick is analog to systemd nspawn and computes starting host_uid based on the container name hash
# if user != root then auto will be substituted by pick
userns: auto

# systemd options
systemd:
  # systemd restart: "no, on-failure, on-success, on-abnormal, on-watchdog, on-abort, or always"
  # default: "no" if type oneshot, else "on-failure"
  restart: ""
  # after, requires, wants: equal to systemd config
  after: ""
  requires: ""
  wants: ""
  # additional systemd properties for the [service] section
  service: {}
  # additional systemd properties for the [unit] section
  unit: {}

# desktop options
desktop:
  # template: group of options passed to x11docker:  ['default', 'host', 'empty']
  template: default
  # options: list of strings: additional options for x11docker
  options: []
  # entry: desktop entry is used for .desktop file
  entry:
    # # https://specifications.freedesktop.org/desktop-entry-spec/latest/
    # # mandatory entries: Name, Exec
    Type: Application
    # Name: Program-Name
    # Exec: env X=Y name.sh
    # # optional entries
    # Comment: A Sentence to describe the application
    # Terminal: true
    # Icon: applications-internet
    # Categories: Network;
    # Keywords: android;emulator;

# environment: dict: add environment data: {key: value,}
environment: {}
# label: dict: add labels to container: {key:value,}
labels: {}
# storage: list of dicts: create volumes: [{name: volume_name, opts=[], labels={}, driver: local},]
storage: []
# volume: list of strings: use volumes: ["source-volume|host-dir:]container-dir[:options]",]
volumes: []
# ports: list of strings: expose container ports: ["[hostip]:hostport:containerport[/protocol]",]
ports: []
# files to be placed inside workdir, which will be available via "./"
# source can be file.managed: contents, source or special case symlink (see example)
files: {}
{# Example:
  test.file:
    mode: "600"
    contents: |
      this is the content
  still.some.file:
    source: salt://containers/test.file
    template: jinja
    # specify any file.managed attribute, environment will be put into context
    defaults:
      custom: this is a custom var that will be available in the jinja context
  some.symlink.file:
    symlink: /target/the/symlink/is/pointing
#}

# command: string, if set, will replace default command
command: ""
# args: string, if set, will add args for command, command must also be set
args: ""
# options: list of string: additional container options parameter for podman run
options: []
# build: if source != "", build container with args using "podman build <source>"
build:
  source: ""
  args: {}
# run before the service is started the first time
init:
  command: ""
  environment: {}
# run after updating the corresponding image to a newer image before starting the service
change:
  command: ""
  environment: {}
{% endload %}


{% load_yaml as default_compose %}
# name of the compose sevice and name of the controlling systemd service
name:

# type: "service"
# service = systemd service: create and start command as a systemd service
type: service

# enabled: if false, service will be stopped, config files are removed
enabled: true
# absent: if true also remove systemd service files
absent: false
# refresh: if true, container image will be pulled/build on every service start
refresh: true
# ephemeral: remove existing container before start
ephemeral: true
# Set the user namespace mode for the container. options are "pick","auto","host","private"
# pick is analog to systemd nspawn and computes starting host_uid based on the container name hash
userns: auto

# systemd options
systemd:
  # systemd restart: "no, on-failure, on-success, on-abnormal, on-watchdog, on-abort, or always"
  restart: "on-failure"
  # after, requires, wants: equal to systemd config
  after: ""
  requires: ""
  wants: ""
  # additional systemd properties for the [service] section
  service: {}
  # additional systemd properties for the [unit] section
  unit: {}

# desktop options
desktop:
  template: default
  options: []
  entry:
    Type: Application
    # # https://specifications.freedesktop.org/desktop-entry-spec/latest/

# environment: dict: add environment data: {key: value,}
environment: {}
# compose source config
source: ""
# compose overrides: dict: define or override config from source
config: {}
# files to be placed inside workdir
files: {}
{# Examples: see container_defaults #}

# run before the service is started the first time
init:
  command: ""
  environment: {}
# run after updating the corresponding image to a newer image before starting the service
change:
  command: ""
  environment: {}
{% endload %}