https://docs.oracle.com/en/operating-systems/oracle-linux/podman/

uname -r

To run processes inside a container in real time mode for UEKR6, the /sys/fs/cgroup/cpu,cpuacct/machine.slice/cpu.rt_runtime_us must be populated with Real Time (RT) budgeting. The oneshot systemd service will automatically populate the RT budgeting. This service needs to run only after storage and networking for the Podman containers are available in the host. Therefore, the property After= has the value of multi-user.target as an umbrella dependency for the service.

To enable the oneshot systemd service, you must first create a Systemd initialization file, /etc/systemd/system/podman-rac-cgroup.service with the following content:

With Security-Enhanced Linux (SELinux), you must set a policy to implement permissions for your containers. If you do not configure a policy module for your containers, then they can end up restarting indefinitely. You must add all Podman host nodes for your cluster to the policy module rac-podman, by installing the necessary packages and creating a type enforcement file (designated by the .te suffix) to build the policy, and load it into the system.

When you restart Podman containers, device permissions, default routes, and /etc/hosts entries that were previously configured for the containers are reset. To maintain your configuration between Podman and Podman container restarts, use this procedure to build a script that you can configure to run on each container to set up the environment after restarts.

Because Oracle Real Application Clusters (Oracle RAC) uses containers based on systemd, you can run the container environment script on every restart by adding the script to the /etc/rc.local folder inside the container when you create the Oracle RAC slim image. After restarts, the script you add to rc.local can ensure that your Podman container environments are restored. Complete each of these steps in sequence. Create the files and script in the Podman image build directory, which in this example is /stage/image.

1. Sets the default gateway
2. Sets the correct device permissions on ASM devices
3. Sets up the /etc/hosts file.
4. Sets up the /etc/resolv.conf file.

If you plan to deploy containers on multiple hosts, then you must copy setupContainerEnv.sh on all the Podman hosts where the image is built.

1. Create a file named Containerfile under /scratch/image.
2. Open Containerfile with an editor, and paste the following lines into the file:

   # Pull base image
   # ---------------
   FROM oraclelinux:8
   # Environment variables required for this build (do NOT change)
   # -------------------------------------------------------------
   ## Environment Variables
   ## ---
   ENV SCRIPT_DIR=/opt/scripts/startup \
       RESOLVCONFENV="resolv.conf" \
       HOSTFILEENV="hostfile" \
       SETUPCONTAINERENV="setupContainerEnv.sh"
   
   ### Copy Files
   # ----
   
   COPY  $SETUPCONTAINERENV $SCRIPT_DIR/
   
   ### RUN Commands
   # -----
   COPY $HOSTFILEENV $RESOLVCONFENV $SCRIPT_DIR/ 
    RUN dnf -y install systemd oracle-database-preinstall-21c vim passwd openssh-server hostname xterm xhost vi && \
    dnf clean all && \
    sync && \
    groupadd -g 54334 asmadmin && \
    groupadd -g 54335 asmdba && \
    groupadd -g 54336 asmoper && \
    useradd -u 54332 -g oinstall -G oinstall,asmadmin,asmdba,asmoper,racdba,dba grid && \
    usermod -g oinstall -G oinstall,dba,oper,backupdba,dgdba,kmdba,asmdba,racdba,asmadmin oracle && \
    cp /etc/security/limits.d/oracle-database-preinstall-21c.conf /etc/security/limits.d/grid-database-preinstall-21c.conf && \
    sed -i 's/oracle/grid/g' /etc/security/limits.d/grid-database-preinstall-21c.conf && \
    rm -f /etc/rc.d/init.d/oracle-database-preinstall-21c-firstboot && \
    rm -f /etc/sysctl.conf && \
    rm -f /usr/lib/systemd/system/dnf-makecache.service && \
    echo "$SCRIPT_DIR/$SETUPCONTAINERENV" >> /etc/rc.local && \
    chmod +x $SCRIPT_DIR/$SETUPCONTAINERENV && \
    chmod +x /etc/rc.d/rc.local && \
    setcap 'cap_net_admin,cap_net_raw+ep' /usr/bin/ping && \
    sync
   
   USER root
   WORKDIR /root
   VOLUME ["/stage/software"]
   VOLUME ["/u01"]
   CMD ["/usr/sbin/init"]
   # End of the Containerfile
   

If you require additional packages for your application, then you can add them to the RUN yum command.

1. Log in as root, and move to the directory for image creation that you have previously prepared:

   # cd /scratch/image

2. Run the procedure for your use case:

   • Your server is behind a proxy firewall:
     • Run the following commands, where:
       • localhost-domain is the local host and domain for the internet gateway in your network
       • http-proxy is the HTTP proxy server for your network environment
       • https-proxy is the HTTPS proxy server for your network environment
       • 21.3 with the 21.7 RU is the Oracle Database release that you are planning to install inside the container.

     # export NO_PROXY=localhost-domain 
     # export http_proxy=http-proxy
     # export https_proxy=https-proxy
     # export version=21.7
     # podman build --force-rm=true --no-cache=true --build-arg \
     http_proxy=${http_proxy} --build-arg https_proxy=${https_proxy} \
     -t oracle/database-rac:$version-slim  -f Containerfile .

   • Your server is not behind a proxy firewall:
     • Run the following commands, where version is the Oracle Database release that you are planning to install inside the Podman Container (for example, 21.7):

     # export version=21.7 
     # podman build --force-rm=true --no-cache=true -t oracle/database-rac:$version-slim -f Containerfile .

3. After the image builds successfully, you should see the image oracle/database-rac:21.7-slim created on your Podman host:

   [root@podman-host--1 image]# podman images
   REPOSITORY                                    TAG         IMAGE ID      CREATED        SIZE
   localhost/oracle/database-rac                 21.7-slim  9d5fed7eb7ba  7 seconds ago  396 MB
   container-registry.oracle.com/os/oraclelinux  8-slim      2ea85efcdb48  3 weeks ago    114 MB
   container-registry.oracle.com/os/oraclelinux  8           e6ca9618a97b  3 weeks ago    243 MB
   

4. Save the image into a tar file, and transfer it to the other Podman host:

   # podman image save -o /var/tmp/database-rac.tar localhost/oracle/database-rac:21.7-slim 
   # scp -i <ssh key for host podman-host-2> /var/tmp/database-rac.tar opc@podman-host-2:/var/tmp/database-rac.tar
   

5. On the other Podman host, load the image from the tar file and check that it is loaded:

   # podman image load -i /var/tmp/database-rac.tar 
   # podman images
   REPOSITORY                                    TAG         IMAGE ID      CREATED        SIZE
   localhost/oracle/database-rac                 21.7-slim  9d5fed7eb7ba   2 minutes ago  396 MB
   container-registry.oracle.com/os/oraclelinux  8           dfce5863ff0f  2 months ago   243 MB

Oracle RAC NFS mount options for binaries, Oracle Database data files and Oracle ASM diskgroups that are not used for OCR and voting disk files on Linux x86-64 are as follows:

rw,bg,hard,nointr,rsize=32768,wsize=32768,tcp,vers=3,timeo=600,actimeo=0

For NFS mounts for the Oracle Clusterware OCR and voting disk files, add noac to the mount options, and ensure that the OCR and voting disk files are placed in ASM disk groups. :

rw,bg,hard,nointr,rsize=32768,wsize=32768,tcp,noac,vers=3,timeo=600,actimeo=0

When you are creating a volume this case, you then provide the following argument in the Podman podman container create command:

  --volume racstorage:/oradata \

After these example commands are run, and the Podman container is created with the volume argument, it can access the NFS file system at /oradata when the container is up and running.

If you want to use multiple private networks for Oracle Real Application Clusters (Oracle RAC), then you must set the rp_filter tunable to 0 or 2. To set the rp_filter value, you add the arguments for that tunable to the podman create container command when you create your containers:

--sysctl 'net.ipv4.conf.private_interface_name.rp_filter=2'

Based on the order of connection to the public and private networks that you previously configured, you can anticipate the private interface names that you define with this command.

You can still create a Podman bridge in your environment, if MACVLAN is not available to you. However, this bridge will not be reachable from an external network. In addition, the Oracle RAC Podman containers for a given cluster will be limited to be in the same Podman host.

To use this example on your Podman host, change the values for --cpuset-cpu, --memory, and --device --dns values to the correct values for your environment. Ensure that the domain name servers (DNS) that you specify with --dns can resolve the host names and single client access names (SCANs) that you plan to use for Oracle Grid Infrastructure. To understand all of the options mentioned in the following command, refer to the Podman documentation for the Podman version installed on the host. You can also shut down the container gracefully with manual commands. See "How to Gracefully Shut Down a RAC container" in this document.

--cpu-rt-runtime 95000 \ 

To use this example on your Podman host, change the values for --cpuset-cpu, --memory, and --device --dns values to the correct values for your environment. Ensure that the domain name servers (DNS) that you specify with --dns can resolve the host names and single client access names (SCANs) that you plan to use for Oracle Grid Infrastructure. To understand all of the options mentioned in the following command, refer to the Podman documentation for the Podman version installed on the host. You can also shut down the container gracefully with manual commands. See "How to Gracefully Shut Down a RAC container" in this document.

--cpu-rt-runtime 95000 \ 

If a network for a container running Oracle Real Application Clusters (Oracle RAC) is disconnected, then reconnecting the same network can result in the network interface name in the Oracle RAC node to disappear. In the place of the previous network interface, a different interface name is created. When this scenario happens, the result is a network configuration that is inconsistent with the network configuration in Oracle Clusterware. If that network interface was the sole private interface for the cluster node, then that node can be evicted from the cluster.

To correct this problem, use this procedure to restore the network interface names on the containers to the same network interface names that were originally configured with Oracle Clusterware.

When an Oracle RAC public or private network is connected to a physical network outside of the Podman host, the corresponding Podman network uses the Macvlan mode of bypassing the Linux bridge, using a NIC adapter in the Podman host as the parent adapter.

After configuration, if you need to disconnect and replace a NIC card used with a network for a container running Oracle Real Application Clusters (Oracle RAC), then reconnecting the same network can result in the network interface name in the Oracle RAC node to disappear. In the place of the previous network interface name, a different interface name is created. When this scenario happens, the result is a network configuration that is inconsistent with the network configuration in Oracle Clusterware. If that network interface was the sole private interface for the cluster node, then that node can be evicted from the cluster.

To resolve that issue, use the following procedure:

1. Disable and then stop the Oracle Clusterware on the node:

   # crsctl disable crs
   # crsctl stop crs

2. Disconnect the container from the network corresponding to the host NIC being replaced. For example, where the container name is mycontainer, and the network name is mypriv1, enter the following command:

   
   # podman network disconnect mycontainer mypriv1

3. Replace the host NIC, and ensure that the new NIC is discovered, is available to the host, and the host operating system device name is found. The NIC name can be different from what it was previously. Depending on the host environment, this step can require restarting the host operating system. For example, if the NIC device name was previously eth1, it can be eth3 after replacement.
4. "Recreate the network using the NIC device name that you find. For example, where the network name is mypriv1, and the NIC that previously was eth1 and now is eth3:

   # podman network rm mypriv1
   # podman network create .... -o parent=eth3 mypriv1

5. Stop the container.
6. Disconnect the other networks from the container.
7. Reconnect to the container all of the networks, using the same order that you used when originally creating the container. Connecting networks in the same order ensures that the interface names in the container are the same as before the replacement.
8. Start the container, and verify that network interface names and IP addresses are as before.
9. Restart and enable Clusterware in the node:

   # crsctl enable crs
   # crsctl start crs

After you delete the container that you used for an Oracle RAC node, if you recreate that container again, then it is not an Oracle RAC node, even though you use the same volume for the mount point (/u01). To make the container an Oracle RAC node again, use the node delete and node add procedures in Oracle Grid Infrastructure Installation and Upgrade Guide for Linux, and in Oracle Real Application Clusters Administration and Deployment Guide.