Is it possible to auto-update a Toolbx container with Podman Quadlet?

[minimaxheadroom (Max)]

I’m running Silverblue 38 and I’d like to automatically update my Toolbx containers. I want my system to periodically reach out to the remote image registry to see if a Toolbx image has been updated, pull it down if a new one is found, and then recreate the Toolbx based on the new image.

I’ve tried to do this using Podman’s Quadlet feature, which relies on systemd to manage containers and volumes, but have been unsuccessful. I used the initial example in podman-auto-update(1) to start my little project.

From that example, I was able to have a new image automatically pulled down upon detection of a different container image digest, which is great. The Quadlet file I’m using (see below) defines an official Toolbx image. The fundamental issue: the container produced through this process is incompatible with Toolbx.

Running toolbox list doesn’t show the resulting “systemd-fedora-toolbox” container, while podman container list does. When entering the new container, I’m greeted by a vanilla prompt (the prepended diamond symbol is gone). Additionally, the usual file to help you identify a Toolbx container is missing:

$ podman exec systemd-fedora-toolbox stat /run/.toolboxenv
stat: cannot statx '/run/.toolboxenv': No such file or directory

I assume the general problem is related to podman being called directly instead of toolbox, and so the toolbox init-container command isn’t being used for the container’s entry point. Other reasons aside, my newness to the tech is most likely why it’s not working.

Any insights or pointers would be appreciated.

---

Contents of the Quadlet .container file.

cat $HOME/.config/containers/systemd/fedora-toolbox.container

[Container]
Image=registry.fedoraproject.org/fedora-toolbox:39
Exec=sleep infinity
AutoUpdate=registry

Contents of the service file generated by Quadlet.

/usr/libexec/podman/quadlet -dryrun -user

quadlet-generator[1091319]: Loading source unit file /var/home/jrandom/.config/containers/systemd/fedora-toolbox.container
---fedora-toolbox.service---
[X-Container]
Image=registry.fedoraproject.org/fedora-toolbox:39
Exec=sleep infinity
AutoUpdate=registry

[Unit]
SourcePath=/var/home/jrandom/.config/containers/systemd/fedora-toolbox.container
RequiresMountsFor=%t/containers

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
KillMode=mixed
ExecStop=/usr/bin/podman rm -f -i --cidfile=%t/%N.cid
ExecStopPost=-/usr/bin/podman rm -f -i --cidfile=%t/%N.cid
Delegate=yes
Type=notify
NotifyAccess=all
SyslogIdentifier=%N
ExecStart=/usr/bin/podman run --name=systemd-%N --cidfile=%t/%N.cid --replace --rm --cgroups=split --sdnotify=conmon -d --label io.containers.autoupdate=registry registry.fedoraproject.org/fedora-toolbox:39 sleep infinity

See Also

How do I update the OS in a toolbox container?

As in the subject The OS in the image that toolbox list returns is a bit old How do I update the os of existing containers ? And how do I update the image itself ? So that new ocntainers don’t start with an old OS ?

[jakfrost (Stephen Snow)]

@minimaxheadroom

I want my system to periodically reach out to the remote image registry to see if a Toolbx image has been updated

I think the container images only get created once at release and only get replaced if there is a problem with that image. So basically, every release cycle there will be a corresponding image created. Quadlet seems more in tune with keeping a custom OCI image you created up to date. You could use quadlet the way you have and then create an image from the resulting podman container and have toolbox create a new toolbox container based on that new image.

[siosm (Timothée Ravier)]

To go this path, you would have to make sure your quadlet uses the exact same arguments as toolbox uses to create the containers.

Otherwise, you can make a small bash scripts that does toolbox rm; podman pull; toolbox create and call it in a systemd unit.

[minimaxheadroom (Max)]

@jakfrost

You could use quadlet the way you have and then create an image from the resulting podman container and have toolbox create a new toolbox container based on that new image.

To elaborate, I’m actually creating my own Toolbx images with registry.fedoraproject.org/fedora-toolbox:<version-id> as the parent, inspired by Timothée’s quay-containerfiles project.

I tested Quadlet to see if my custom Toolbx images were causing issues. I added the Image=registry.fedoraproject.org/fedora-toolbox:39 line in a separate Quadlet file, as shown in my example, but the result was the same, whether using the official or custom image.

[minimaxheadroom (Max)]

@siosm

To go this path, you would have to make sure your quadlet uses the exact same arguments as toolbox uses to create the containers.

So essentially, grab the output of podman inspect --type container --format ' {{ .Config.CreateCommand }}' <containerfoo> (similar to this post) and translate that into the appropriate options for [Container] in the Quadlet file, right? I see PodmanArgs= in the Podman documentation as a potential target option to use in the Quadlet file.

@siosm

Otherwise, you can make a small bash scripts that does toolbox rm; podman pull; toolbox create and call it in a systemd unit.

Thanks, I may give that a try. Squeezing Toolbx into the Quadlet approach may be too much of a headache right now.

---

Unrelated, but I had intended my last message to be a direct reply to Stephen. It seems @mentioning someone (I had originally done so by writing Timothée’s handle as @siosm in that message) is interpreted by the forum as a reply as well, which I noticed only after the message was posted. problem