Komodo

DevOps rootful 3 containers

mongo docker.io/mongo:8

komodo-core ghcr.io/moghtech/komodo-core:2 · 9120:9120

komodo-periphery ghcr.io/moghtech/komodo-periphery:2

Kubernetes YAML

apiVersion: v1
kind: Pod
metadata:
  name: komodo
  labels:
    app: komodo
spec:
  restartPolicy: Always
  containers:
  - name: mongo
    image: docker.io/mongo:8
    env:
    - name: MONGO_INITDB_ROOT_USERNAME
      value: admin
    - name: MONGO_INITDB_ROOT_PASSWORD
      value: kKg23_fvyCNOWNXrNcz0HA
    volumeMounts:
    - name: vol-0
      mountPath: /data/db
    - name: vol-1
      mountPath: /data/configdb
    args:
    - --quiet
    - --wiredTigerCacheSizeGB
    - '0.25'
  - name: komodo-core
    image: ghcr.io/moghtech/komodo-core:2
    ports:
    - containerPort: 9120
      hostPort: 9120
    env:
    - name: TZ
      value: UTC
    - name: KOMODO_DATABASE_ADDRESS
      value: 127.0.0.1:27017
    - name: KOMODO_DATABASE_USERNAME
      value: admin
    - name: KOMODO_DATABASE_PASSWORD
      value: kKg23_fvyCNOWNXrNcz0HA
    - name: KOMODO_HOST
      value: https://komodo.example.com
    - name: KOMODO_TITLE
      value: Komodo
    - name: KOMODO_PERIPHERY_PUBLIC_KEY
      value: file:/config/keys/periphery.pub
    - name: KOMODO_LOCAL_AUTH
      value: 'true'
    - name: KOMODO_INIT_ADMIN_USERNAME
      value: admin
    - name: KOMODO_INIT_ADMIN_PASSWORD
      value: kKg23_fvyCNOWNXrNcz0HA
    - name: KOMODO_FIRST_SERVER_NAME
      value: Local
    - name: KOMODO_WEBHOOK_SECRET
      value: rBeVc-cPz13yGAvWXkyR6g
    - name: KOMODO_JWT_SECRET
      value: rBeVc-cPz13yGAvWXkyR6g
    volumeMounts:
    - name: vol-2
      mountPath: /config/keys
    - name: vol-3
      mountPath: /backups
  - name: komodo-periphery
    image: ghcr.io/moghtech/komodo-periphery:2
    env:
    - name: PERIPHERY_CORE_ADDRESS
      value: ws://127.0.0.1:9120
    - name: PERIPHERY_CONNECT_AS
      value: Local
    - name: PERIPHERY_CORE_PUBLIC_KEYS
      value: file:/config/keys/core.pub
    - name: PERIPHERY_ROOT_DIRECTORY
      value: /etc/komodo
    - name: PERIPHERY_INCLUDE_DISK_MOUNTS
      value: /etc/hostname
    volumeMounts:
    - name: vol-2
      mountPath: /config/keys
    - name: vol-4
      mountPath: /var/run/docker.sock
    - name: vol-5
      mountPath: /proc
      readOnly: true
    - name: vol-6
      mountPath: /etc/komodo
  volumes:
  - name: vol-0
    persistentVolumeClaim:
      claimName: komodo-mongo-data
  - name: vol-1
    persistentVolumeClaim:
      claimName: komodo-mongo-config
  - name: vol-2
    persistentVolumeClaim:
      claimName: komodo-keys
  - name: vol-3
    hostPath:
      path: /etc/komodo/backups
      type: DirectoryOrCreate
  - name: vol-4
    hostPath:
      path: /run/podman/podman.sock
      type: FileOrCreate
  - name: vol-5
    hostPath:
      path: /proc
      type: DirectoryOrCreate
  - name: vol-6
    hostPath:
      path: /etc/komodo
      type: DirectoryOrCreate

Deployment Guide rootful

Operating System:

Prerequisite as root

Install Podman

apt update && apt install -y podman

Save the YAML file

sudo mkdir -p /etc/containers/
sudo nano /etc/containers/komodo.yaml

Test the pod (without systemd)

sudo podman play kube /etc/containers/komodo.yaml

# Status:
sudo podman pod ps && sudo podman ps

# Stop:
sudo podman play kube --down /etc/containers/komodo.yaml

Create Quadlet .kube file (systemd)

komodo.kube

Save to /etc/containers/systemd/:

sudo mkdir -p /etc/containers/systemd/
sudo nano /etc/containers/systemd/komodo.kube

Start systemd service (rootful)

sudo systemctl daemon-reload
sudo systemctl start komodo.service

Status & Logs

sudo systemctl status komodo.service
sudo journalctl -u komodo.service -f
sudo podman pod ps
sudo podman ps

Enable automatic image updates optional

Requires AutoUpdate=registry in the .kube file. Podman checks for new images and restarts the pod automatically:

sudo systemctl enable --now podman-auto-update.timer

# Check status:
sudo systemctl status podman-auto-update.timer

# Trigger manually:
sudo podman auto-update

Rootful mode:

Containers run as root — only use trusted images
Ports < 1024 can be bound directly
No loginctl enable-linger needed — systemd manages the service
Quadlet path: /etc/containers/systemd/ (not ~/.config/)

Useful Tips

Ports < 1024 (e.g. 80, 443)

Rootless cannot open privileged ports. Solution:

sysctl net.ipv4.ip_unprivileged_port_start=80

Make persistent in /etc/sysctl.d/99-podman.conf.

Containers communicate via localhost

All containers in the pod share the same network namespace. Always use localhost, not container names.

# Correct (e.g. app → db):
localhost:5432

# Wrong (doesn't work in a pod):
db-container:5432

List open ports

Which ports is the running pod listening on?

podman port komodo-pod

Custom DNS for the pod

Set a custom DNS server (e.g. local Pi-hole):

# In YAML under spec.dnsConfig:
spec:
  dnsConfig:
    nameservers:
      - 192.168.1.x

Set volume ownership

Fix permission errors by adjusting UID/GID in the user namespace:

podman unshare chown 1000:1000 /path/to/volume

SELinux volume labels

On SELinux systems (RHEL, Fedora) set the volume suffix:

/host/path:/container/path:Z   # private
/host/path:/container/path:z   # shared

List all volumes

podman volume ls
podman volume inspect <volume-name>

Volume backup

Back up data from a named volume:

podman run --rm \
  -v <volume-name>:/data:ro \
  -v $(pwd):/backup \
  busybox tar czf /backup/backup.tar.gz /data

Cleanup

Remove unused images, containers and volumes:

podman system prune -f        # containers + images
podman image prune -f         # untagged images only
podman volume prune -f        # unused volumes

Manual update

Pull a new image version and restart the pod:

podman pull <image>:<tag>
podman play kube --replace \
  ~/.config/containers/komodo.yaml

Check for outdated images

List local images and test auto-update without applying:

podman images
podman auto-update --dry-run

Shell into a running container

podman exec -it komodo-<container> /bin/sh
# or bash:
podman exec -it komodo-<container> /bin/bash

Follow live logs

# All containers in the pod:
podman pod logs -f komodo-pod

# Single container:
podman logs -f komodo-<container>

Pod info & resource usage

podman pod inspect komodo-pod
podman stats komodo-pod

Restart pod without data loss

podman pod restart komodo-pod

# or via systemd:
systemctl --user restart komodo.service

Stop & remove pod

sudo podman pod stop komodo-pod
sudo podman pod rm komodo-pod

All in one

sudo podman pod stop komodo-pod && sudo podman pod rm komodo-pod

Customize this stack

Change ports, volumes, environment variables and more in the generator.

Open in Generator