Windows - Podman Machine Service Wrapper using WinSW

[nddipiazza]

Feature request description

Add support for using Podman as a background service on a Windows Server 202x intended for use with CI pipelines

Using WinSW , Add a Podman Windows service wrapper to podman

• Window service management would podman machine stop/start as needed.

Create a set of steps to install Podman as a background service on Windows Server
Then show a powershell script example of accessing using a podman client against that shared service

Suggest potential solution

Using WinSW , Add a Podman Windows service wrapper to podman

• Window service management would podman machine stop/start as needed.

Then ensure the podman client is able to properly access the podman machine hosted by windows service

Have you considered any alternatives?

N/a

Additional context

See: #25284 for the origin of this

[arixmkii]

WinSW seems to be abandoned unfortunately winsw/winsw#1102 (comment) So, one should expect potential blockers implementing this way.

[baude]

thanks for the comment @arixmkii

[nddipiazza]

shoot i just threw out a windows service wrapper i used in past. dang sucks it's not maintained. teaches me for putting the solution in the feature request

[arixmkii]

It was not to offend anyone. I posted it for additional context strictly from technical perspective. I apologize if it sounded offensive. It is not wrong to propose a solution for evaluation.

[baude]

is there another idea or approach or should we close this ?

[arixmkii]

It is possible to run windows service in golang

• https://dev.to/cosmic_predator/writing-a-windows-service-in-go-1d1m
• https://pkg.go.dev/golang.org/x/sys/windows/svc/example

This would be custom development, so, considerable amount of effort.

But what I'm more worried about is that original wrapper was designed for Jenkins and alike, and all these apps tend to have their configuration per app inside app folder. Podman machine is a per user, but service will run as privileged technical. So, it would need some mechanism to impersonate (or machine to handle config on demand (there is no code for this)) user while launching (and then machine will be available only for specific user). And having this would expose the service to a whole new vector of attacks. If there would appear RCE during machine start it would become an elevated RCE by service.

I believe there is more of this than just wrap a machine, but a question or feature to implement system wide Podman machine on Windows, where service will be a natural continuation.