# 先创建并运行一个容器
podman run -d --name webserver -p 8080:80 nginx:1.27-alpine

# 生成 systemd 服务文件
podman generate systemd --name webserver --files

# 输出：
# /home/user/container-webserver.service

# 查看生成的服务文件
cat container-webserver.service

# container-webserver.service
# generated by Podman 5.x.x

[Unit]
Description=Podman container-webserver.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=/run/user/1000/containers

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
TimeoutStartSec=70
TimeoutStopSec=70
ExecStart=/usr/bin/podman start webserver
ExecStop=/usr/bin/podman stop -t 10 webserver
ExecStopPost=/usr/bin/podman stop -t 10 webserver
PIDFile=/run/user/1000/containers/overlay-containers/<id>/userdata/conmon.pid
Type=forking

[Install]
WantedBy=default.target

# 移动到 systemd 用户目录
mkdir -p ~/.config/systemd/user/
mv container-webserver.service ~/.config/systemd/user/

# 重新加载 systemd
systemctl --user daemon-reload

# 启动服务
systemctl --user start container-webserver

# 查看状态
systemctl --user status container-webserver

# 开机自启
systemctl --user enable container-webserver

# 查看日志
journalctl --user -u container-webserver

# 停止
systemctl --user stop container-webserver

# 创建 Pod
podman pod create --name myapp -p 8080:80
podman run -d --pod myapp --name web nginx:1.27-alpine
podman run -d --pod myapp --name app myapp:latest

# 生成 Pod 级别的 systemd 文件
podman generate systemd --name myapp --files --new

# 这会为 Pod 和每个容器都生成服务文件
# 包含正确的依赖顺序（pod 先启动）

# --new 模式（推荐）：每次启动都是全新容器
podman generate systemd --name webserver --new --files

# 优势：
# 1. 每次启动拉取最新镜像（配合 Restart=always）
# 2. 无状态，不会累积旧容器数据
# 3. 更符合容器"一次性"的设计理念

# webserver.container
[Unit]
Description=My Web Server
After=network-online.target
Wants=network-online.target

[Container]
Image=docker.io/library/nginx:1.27-alpine
PublishPort=8080:80
Volume=web-content.volume:/usr/share/nginx/html:ro
Environment=NGINX_HOST=example.com
Label=app=webserver
AutoUpdate=registry

[Service]
Restart=always
RestartSec=5

[Install]
WantedBy=default.target

# web-content.volume
[Volume]
Label=app=webserver,type=content

# mynet.network
[Network]
Subnet=10.89.0.0/24
Gateway=10.89.0.1
Label=app=mynetwork

# app.container
[Unit]
Description=My Application
After=network-online.target webserver.service

[Container]
Image=docker.io/library/myapp:v2.0
PublishPort=8080:8080
Network=mynet.network
Volume=app-data.volume:/data:Z
Environment=DATABASE_URL=postgres://localhost:5432/mydb
Secret=database-credentials.secret
HealthCmd=/app/healthcheck
HealthInterval=30s
HealthRetries=3
AutoUpdate=registry

[Service]
Restart=always
RestartSec=10
TimeoutStartSec=120

[Install]
WantedBy=default.target

# 重新加载 systemd 以识别新的 Quadlet 文件
systemctl --user daemon-reload

# Quadlet 会自动生成对应的服务：
systemctl --user start webserver.service

# 查看状态
systemctl --user status webserver.service

# 开机自启
systemctl --user enable webserver.service

# 查看日志
journalctl --user -u webserver.service -f

# 检查生成的 podman 命令（调试用）
/usr/libexec/podman/quadlet --dry-run

# myapp.kube
[Unit]
Description=My App Stack (Kubernetes YAML)
After=network-online.target

[Kube]
YAML=/path/to/deployment.yaml
PublishPort=8080:8080
AutoUpdate=registry

[Install]
WantedBy=default.target

# ~/.config/systemd/system/nginx-proxy.container
[Unit]
Description=Nginx Reverse Proxy
After=network-online.target

[Container]
Image=docker.io/library/nginx:1.27-alpine
PublishPort=80:80
PublishPort=443:443
Volume=nginx-conf.volume:/etc/nginx/conf.d:ro
Volume=certs.volume:/etc/nginx/certs:ro
Network=frontend.network
AutoUpdate=registry

[Service]
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target

# ~/.config/systemd/system/backend-app.container
[Unit]
Description=Backend Application
After=network-online.target postgres.service

[Container]
Image=registry.example.com/app:v2.1.0
Network=frontend.network
Network=backend.network
Environment=DB_HOST=postgres
Environment=REDIS_HOST=redis
Volume=app-logs.volume:/app/logs:Z
HealthCmd=/app/healthcheck.sh
HealthInterval=30s
AutoUpdate=registry
PodmanArgs=--memory 1g --cpus 2

[Service]
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

# postgres-prod.container
[Unit]
Description=PostgreSQL Database
After=network-online.target

[Container]
Image=docker.io/library/postgres:16-alpine
PublishPort=5432:5432
Volume=pgdata.volume:/var/lib/postgresql/data:Z
Environment=POSTGRES_DB=appdb
Environment=POSTGRES_USER=appuser
Secret=db-password.secret,type=env,target=POSTGRES_PASSWORD
Network=backend.network
HealthCmd=pg_isready -U appuser -d appdb
HealthInterval=10s
HealthRetries=5
HealthStartPeriod=30s
PodmanArgs=--shm-size=256m

[Service]
Restart=always
RestartSec=30
TimeoutStartSec=120

[Install]
WantedBy=multi-user.target

# 创建 systemd timer 定期更新镜像
cat > ~/.config/systemd/user/update-images.timer << 'EOF'
[Unit]
Description=Update container images weekly

[Timer]
OnCalendar=Sun *-*-* 03:00:00
Persistent=true

[Install]
WantedBy=timers.target
EOF

cat > ~/.config/systemd/user/update-images.service << 'EOF'
[Unit]
Description=Update container images

[Service]
Type=oneshot
ExecStart=/usr/bin/podman pull nginx:1.27-alpine
ExecStart=/usr/bin/podman pull postgres:16-alpine
ExecStart=/usr/bin/podman image prune -f
EOF

systemctl --user daemon-reload
systemctl --user enable --now update-images.timer

# Rootless 用户需要启用 linger 才能在未登录时保持服务运行
sudo loginctl enable-linger $(whoami)

# 验证
ls /var/lib/systemd/linger/
# 应该包含你的用户名

# 禁用
sudo loginctl disable-linger $(whoami)

# 检查有哪些容器可自动更新
podman auto-update --dry-run

# 执行更新
podman auto-update

# 设置 systemd timer 定期检查
# 通常已由发行版提供：podman-auto-update.timer
systemctl --user enable --now podman-auto-update.timer

# 查看更新日志
journalctl --user -u podman-auto-update.service