Skip to content

Installing on Podman by Hand

If your organisation's policy requires every step by hand, these steps do what the installer does on Podman. Running on Podman explains the files they put in place, and the choice between rootful and rootless.

Installing JIM on Podman by hand, step by step Installing by hand takes six steps, run as root. 1: put the files in place: the pod files and settings in /opt/jim, and the Quadlet units in systemd's folder. 2: fill in the settings in jim-config.yaml, such as the identity provider's. 3: load JIM's images from the release bundle, or pull them. 4: store the secrets jim-secrets and jim-tls in Podman. 5: prepare the host's network: firewalld and NetworkManager on RHEL and its derivatives, AppArmor on Ubuntu 24.04. 6: start JIM with systemctl. For a rootless installation, the same steps run as the jim account, with the units in that account's folder. Put the filesin placepod files and units1 Fill in thesettingsidentity provider2 Load imagesor pull them3 Store the secretsin Podman4 Prepare thenetworkfirewall orAppArmor5 Start JIM6 Installing JIM on Podman by hand, step by step Installing by hand takes six steps, run as root. 1: put the files in place: the pod files and settings in /opt/jim, and the Quadlet units in systemd's folder. 2: fill in the settings in jim-config.yaml, such as the identity provider's. 3: load JIM's images from the release bundle, or pull them. 4: store the secrets jim-secrets and jim-tls in Podman. 5: prepare the host's network: firewalld and NetworkManager on RHEL and its derivatives, AppArmor on Ubuntu 24.04. 6: start JIM with systemctl. For a rootless installation, the same steps run as the jim account, with the units in that account's folder. Put the files in placepod files and units1 Fill in the settingsidentity provider2 Load imagesor pull them3 Store the secretsin Podman4 Prepare the networkfirewall or AppArmor5 Start JIM6

Before you begin

  • A server that meets the Requirements for Podman.
  • The files from the release you are installing: those attached to the release, or the podman/ folder of the release bundle, which keeps the three units in podman/quadlet/.
  • JIM's certificate and its unencrypted private key (see The Certificate), and your identity provider's settings for JIM.

Install JIM

Run these steps as root, from the folder holding the files.

  1. Put the files in place. Leave out jim-database.kube if you use your own PostgreSQL server.

    mkdir -p /opt/jim/tls /etc/containers/systemd && chmod 700 /opt/jim/tls
cp jim.yaml jim-database.yaml jim-config.yaml /opt/jim/
cp jim.network jim.kube jim-database.kube /etc/containers/systemd/

    The units expect the pod files in /opt/jim; if you put them elsewhere, change Yaml= and ConfigMap= in each .kube file. To use a port other than 443, change PublishPort= in jim.kube.

  2. Fill in /opt/jim/jim-config.yaml: the identity provider settings, and for your own PostgreSQL server its name in JIM_DB_HOSTNAME. For the bundled PostgreSQL on a host with more than 4 GB of memory, size it as the installer would (see Bundled PostgreSQL Memory).

  3. Load the images, from the release bundle's docker-images folder, or download them:

    for f in docker-images/*.tar; do podman load < "$f"; done
# or, connected:
for image in $(awk '$1 == "image:" { print $2 }' /opt/jim/jim.yaml /opt/jim/jim-database.yaml); do podman pull "$image"; done

  4. Store the secrets. Fill in a copy of jim-secrets.yaml (for the bundled PostgreSQL, choose a strong password: the database is created with it on first start), store it, and delete the copy. Then put JIM's certificate and key in /opt/jim/tls as tls.crt and tls.key (see The Certificate) and store them too:

    podman kube play - < jim-secrets.yaml && shred -u jim-secrets.yaml

printf 'apiVersion: v1\nkind: Secret\nmetadata:\n  name: jim-tls\ndata:\n  tls.crt: %s\n  tls.key: %s\n' \
  "$(base64 -w0 /opt/jim/tls/tls.crt)" "$(base64 -w0 /opt/jim/tls/tls.key)" | podman kube play --replace -

  5. Prepare the host's network. On RHEL and its derivatives, open the port in firewalld, keep JIM's network through a firewalld reload, and keep NetworkManager off Podman's interfaces; on Ubuntu 24.04, add the AppArmor rules JIM's containers need instead (see Firewall, SELinux, AppArmor and NetworkManager):

    firewall-cmd --add-service=https && firewall-cmd --permanent --add-service=https
systemctl enable --now netavark-firewalld-reload.service
printf '[keyfile]\nunmanaged-devices+=interface-name:veth*;interface-name:podman*\n' > /etc/NetworkManager/conf.d/90-jim-podman.conf
nmcli general reload conf

  6. Start JIM:

    systemctl daemon-reload
systemctl start jim-database.service jim.service

Rootless, by hand

For a rootless installation, first create the account, enable lingering for it, and let it use port 443. Check /etc/subuid and /etc/subgid each give the account a range; current distributions add one when the account is created.

useradd --create-home --comment "JIM (Junctional Identity Manager)" --shell /sbin/nologin jim
grep '^jim:' /etc/subuid /etc/subgid
loginctl enable-linger jim
echo net.ipv4.ip_unprivileged_port_start=443 > /etc/sysctl.d/90-jim.conf && sysctl --system

Define the jim-systemctl and jim-podman functions from Rootless commands in the same shell, then follow the steps above, with three differences:

  • In step 1, put the units in the account's folder instead of /etc/containers/systemd/:

    sudo -u jim mkdir -p /home/jim/.config/containers/systemd
cp jim.network jim.kube jim-database.kube /home/jim/.config/containers/systemd/
chown jim: /home/jim/.config/containers/systemd/*

  • Run each podman command as jim-podman.

  • Run each systemctl command as jim-systemctl.

Check it worked

  1. Wait for JIM, which prepares its database on first start. It is ready when podman healthcheck run jim-web succeeds (rootless, jim-podman healthcheck run jim-web).
  2. Open JIM in a browser and sign in with your identity provider.

Without systemd

On a host without systemd, or with a Podman older than 4.4, run the pods directly. JIM runs, but does not start by itself after a reboot, so this is best effort rather than supported:

podman network create --ignore jim
podman kube play --replace --network jim --configmap /opt/jim/jim-config.yaml /opt/jim/jim-database.yaml
podman kube play --replace --network jim --configmap /opt/jim/jim-config.yaml --publish 443:8443 /opt/jim/jim.yaml

The installer does this for you on such a host.