Possibility to use systemd activated sockets with podman kube

[oryjkov]

What I want:

Run a kube deployment with several containers without access to outside world. Only allow access from outside via a few endpoints using systemd socket activation.

What I tried:

Created a systemd .kube file, systemd .socket file and the corresponding yaml kubernetes config. The .kube file depends on a systemd socket.

Result:

Containers do not inherit the systemd socket. Seems that only the -services container inherits the socket, but that makes it useless.,

I can run this setup using a systemd pod, but I found this configuration to be less ergonomic. It needs a bunch of separate files to describe the setup and it is not possible to generate it from an existing set of containers as podman kube generate does.

Question:

Is there a way to make this work with a kube?

more info in eriksjolund/podman-traefik-socket-activation#3

[eriksjolund]

Kubernetes does not support socket activation so it does not make much sense for Podman to support socket activation for kube units (quadlets) in my opinion.

To support it properly in Podman for kube units, there would need to be a new syntax (maybe some annotations) that maps sockets (from FD_NAMES) to individual containers.

I did a minimal test to see if socket activation currently works for a Pod.
Result: It did not work. In the logs Unable to close file fd-3: \"close fd-3: bad file descriptor\" can be seen.

Details:

1. Create file ~/kube.yaml containing

   kind: Pod
   metadata:
     name: echopod
   spec:
     containers:
       - name: echo
         image: ghcr.io/eriksjolund/socket-activate-echo
   

2. Create file ~/.config/systemd/user/mykube.socket containing

   [Socket]
   ListenStream=9000
   

3. Create file ~/.config/containers/systemd/mykube.kube containing

   [Unit]
   After=network-online.target
   
   [Kube]
   Yaml=%h/kube.yaml
   
   [Install]
   WantedBy=default.target
   

4. Pull image

   podman pull ghcr.io/eriksjolund/socket-activate-echo
   

5. Reload

   systemctl --user daemon-reload
   

6. Start socket

   systemctl --user start mykube.socket
   

7. Test the echo server

   echo hello | socat -t 10 - tcp4:127.0.0.1:9000
   

   result: the command times out after 10 seconds and returns. If it would have worked, hello would have been printed.
8. Check the logs

   journalctl --user -xe
   

   Among other things, the following output can be seen

   Apr 25 06:41:41 localhost.localdomain podman[713492]: 2026-04-25 06:41:41.740260871 +0200 CEST m=+0.762843008 container init 01155cb9ecb46b3f8f1e1e1ccd62e5278d2af88184fac4048a7cc108713e2fb9 (image=, name=44a4df4d>
   Apr 25 06:41:41 localhost.localdomain podman[713492]: 2026-04-25 06:41:41.741151142 +0200 CEST m=+0.763733325 container start 01155cb9ecb46b3f8f1e1e1ccd62e5278d2af88184fac4048a7cc108713e2fb9 (image=, name=44a4df4>
   Apr 25 06:41:41 localhost.localdomain systemd[514105]: Started libpod-6554e061682d6b7622123b6b44c972eca9cb4ea2c5615587aeb9e62a649988d7.scope - libcrun container.
   ░░ Subject: A start job for unit UNIT has finished successfully
   ░░ Defined-By: systemd
   ░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
   ░░ 
   ░░ A start job for unit UNIT has finished successfully.
   ░░ 
   ░░ The job identifier is 62932.
   Apr 25 06:41:41 localhost.localdomain mykube[713492]: time="2026-04-25T06:41:41+02:00" level=error msg="Unable to close file fd-3: \"close fd-3: bad file descriptor\""
   Apr 25 06:41:41 localhost.localdomain podman[713492]: 2026-04-25 06:41:41.75633054 +0200 CEST m=+0.778912722 container init 6554e061682d6b7622123b6b44c972eca9cb4ea2c5615587aeb9e62a649988d7 (image=ghcr.io/eriksjol>
   Apr 25 06:41:41 localhost.localdomain podman[713492]: 2026-04-25 06:41:41.757053121 +0200 CEST m=+0.779635258 container start 6554e061682d6b7622123b6b44c972eca9cb4ea2c5615587aeb9e62a649988d7 (image=ghcr.io/eriksj>
   Apr 25 06:41:41 localhost.localdomain podman[713492]: 2026-04-25 06:41:41.7578073 +0200 CEST m=+0.780389437 pod start 44a4df4d003081ab700672925a67447987225db696f2035877e05585305af624 (image=, name=echopod)
   Apr 25 06:41:41 localhost.localdomain mykube[713492]: Pod:
   Apr 25 06:41:41 localhost.localdomain mykube[713492]: 44a4df4d003081ab700672925a67447987225db696f2035877e05585305af624
   Apr 25 06:41:41 localhost.localdomain mykube[713492]: Container:
   Apr 25 06:41:41 localhost.localdomain mykube[713492]: 6554e061682d6b7622123b6b44c972eca9cb4ea2c5615587aeb9e62a649988d7
   Apr 25 06:41:41 localhost.localdomain systemd[514105]: Started mykube.service.
   

9. Show mykube.service

   systemctl --user cat mykube.service
   

   The following output is printed

   # /run/user/1079/systemd/generator/mykube.service
   # Automatically generated by /usr/lib/systemd/user-generators/podman-user-generator
   # 
   [Unit]
   Wants=podman-user-wait-network-online.service
   After=podman-user-wait-network-online.service
   After=network-online.target
   SourcePath=/var/home/test3/.config/containers/systemd/mykube.kube
   RequiresMountsFor=%t/containers
   
   [X-Kube]
   Yaml=%h/kube.yaml
   
   [Install]
   WantedBy=default.target
   
   
   [Service]
   KillMode=mixed
   Environment=PODMAN_SYSTEMD_UNIT=%n
   Type=notify
   NotifyAccess=all
   SyslogIdentifier=%N
   ExecStart=/usr/bin/podman kube play --replace --service-container=true %h/kube.yaml
   ExecStopPost=/usr/bin/podman kube down %h/kube.yaml.
   
   # /usr/lib/systemd/user/service.d/10-timeout-abort.conf
   # This file is part of the systemd package.
   # See https://fedoraproject.org/wiki/Changes/Shorter_Shutdown_Timer.
   #
   # To facilitate debugging when a service fails to stop cleanly,
   # TimeoutStopFailureMode=abort is set to "crash" services that fail to stop in
   # the time allotted. This will cause the service to be terminated with SIGABRT
   # and a coredump to be generated.
   #
   # To undo this configuration change, create a mask file:
   #   sudo mkdir -p /etc/systemd/user/service.d
   #   sudo ln -sv /dev/null /etc/systemd/user/service.d/10-timeout-abort.conf
   
   [Service]
   TimeoutStopFailureMode=abort
   

10. Show podman version

    podman --version
    

    The following output is printed

    podman version 5.8.2